From f374308d1e943140be1ccf686f4020ed20861e9b Mon Sep 17 00:00:00 2001 From: de4dot Date: Tue, 18 Oct 2011 08:28:23 +0200 Subject: [PATCH] Emulate instrs only if last instr is bcc/switch --- blocks/cflow/BlocksControlFlowDeobfuscator.cs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/blocks/cflow/BlocksControlFlowDeobfuscator.cs b/blocks/cflow/BlocksControlFlowDeobfuscator.cs index 3af5e0ad..01b99543 100644 --- a/blocks/cflow/BlocksControlFlowDeobfuscator.cs +++ b/blocks/cflow/BlocksControlFlowDeobfuscator.cs @@ -18,6 +18,7 @@ */ using System.Collections.Generic; +using Mono.Cecil.Cil; namespace de4dot.blocks.cflow { public class BlocksControlFlowDeobfuscator { @@ -41,7 +42,9 @@ namespace de4dot.blocks.cflow { removeDeadBlocks(); mergeBlocks(); foreach (var block in blocks.MethodBlocks.getAllBlocks()) { - //TODO: Only do this if it's a bcc block. switch blocks should use other code. + var lastInstr = block.LastInstr; + if (!DotNetUtils.isConditionalBranch(lastInstr.OpCode.Code) && lastInstr.OpCode.Code != Code.Switch) + continue; blockControlFlowDeobfuscator.init(block, blocks.Method.Parameters, blocks.Locals); changed |= blockControlFlowDeobfuscator.deobfuscate(); }