From f567e09845faccee52d74474ca3c8aec5a2d8cca Mon Sep 17 00:00:00 2001 From: de4dot Date: Wed, 30 Nov 2011 18:27:01 +0100 Subject: [PATCH] Add 'using de4dot.PE' --- de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs | 3 ++- .../deobfuscators/CliSecure/MethodsDecrypter.cs | 13 +++++++------ 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs b/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs index 1a042e80..b2dc4984 100644 --- a/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs @@ -21,6 +21,7 @@ using System.Collections.Generic; using Mono.Cecil; using Mono.MyStuff; using de4dot.blocks; +using de4dot.PE; namespace de4dot.deobfuscators.CliSecure { class DeobfuscatorInfo : DeobfuscatorInfoBase { @@ -139,7 +140,7 @@ namespace de4dot.deobfuscators.CliSecure { return false; byte[] fileData = DeobUtils.readModule(module); - var peImage = new PE.PeImage(fileData); + var peImage = new PeImage(fileData); if (!new MethodsDecrypter().decrypt(peImage, ref dumpedMethods)) { Log.v("Methods aren't encrypted or invalid signature"); diff --git a/de4dot.code/deobfuscators/CliSecure/MethodsDecrypter.cs b/de4dot.code/deobfuscators/CliSecure/MethodsDecrypter.cs index 8cc5775d..cb4d1bd4 100644 --- a/de4dot.code/deobfuscators/CliSecure/MethodsDecrypter.cs +++ b/de4dot.code/deobfuscators/CliSecure/MethodsDecrypter.cs @@ -20,6 +20,7 @@ using System; using System.Collections.Generic; using Mono.MyStuff; +using de4dot.PE; namespace de4dot.deobfuscators.CliSecure { class CodeHeader { @@ -50,7 +51,7 @@ namespace de4dot.deobfuscators.CliSecure { static byte[] normalSignature = new byte[16] { 0x08, 0x44, 0x65, 0xE1, 0x8C, 0x82, 0x13, 0x4C, 0x9C, 0x85, 0xB4, 0x17, 0xDA, 0x51, 0xAD, 0x25 }; static byte[] proSignature = new byte[16] { 0x68, 0xA0, 0xBB, 0x60, 0x13, 0x65, 0x5F, 0x41, 0xAE, 0x42, 0xAB, 0x42, 0x9B, 0x6B, 0x4E, 0xC1 }; - PE.PeImage peImage; + PeImage peImage; CodeHeader codeHeader = new CodeHeader(); IDecrypter decrypter; @@ -59,11 +60,11 @@ namespace de4dot.deobfuscators.CliSecure { } abstract class DecrypterBase : IDecrypter { - protected PE.PeImage peImage; + protected PeImage peImage; protected CodeHeader codeHeader; protected uint endOfMetadata; - public DecrypterBase(PE.PeImage peImage, CodeHeader codeHeader) { + public DecrypterBase(PeImage peImage, CodeHeader codeHeader) { this.peImage = peImage; this.codeHeader = codeHeader; endOfMetadata = peImage.rvaToOffset(peImage.Cor20Header.metadataDirectory.virtualAddress + peImage.Cor20Header.metadataDirectory.size); @@ -89,7 +90,7 @@ namespace de4dot.deobfuscators.CliSecure { } class NormalDecrypter : DecrypterBase { - public NormalDecrypter(PE.PeImage peImage, CodeHeader codeHeader) + public NormalDecrypter(PeImage peImage, CodeHeader codeHeader) : base(peImage, codeHeader) { } @@ -109,7 +110,7 @@ namespace de4dot.deobfuscators.CliSecure { class ProDecrypter : DecrypterBase { uint[] key = new uint[4]; - public ProDecrypter(PE.PeImage peImage, CodeHeader codeHeader) + public ProDecrypter(PeImage peImage, CodeHeader codeHeader) : base(peImage, codeHeader) { for (int i = 0; i < 4; i++) key[i] = be_readUint32(codeHeader.decryptionKey, i * 4); @@ -154,7 +155,7 @@ namespace de4dot.deobfuscators.CliSecure { } } - public bool decrypt(PE.PeImage peImage, ref Dictionary dumpedMethods) { + public bool decrypt(PeImage peImage, ref Dictionary dumpedMethods) { this.peImage = peImage; uint offset = peImage.rvaToOffset(peImage.Cor20Header.metadataDirectory.virtualAddress + peImage.Cor20Header.metadataDirectory.size);