Add 'using de4dot.PE'
This commit is contained in:
parent
28ec2485fc
commit
f567e09845
|
@ -21,6 +21,7 @@ using System.Collections.Generic;
|
||||||
using Mono.Cecil;
|
using Mono.Cecil;
|
||||||
using Mono.MyStuff;
|
using Mono.MyStuff;
|
||||||
using de4dot.blocks;
|
using de4dot.blocks;
|
||||||
|
using de4dot.PE;
|
||||||
|
|
||||||
namespace de4dot.deobfuscators.CliSecure {
|
namespace de4dot.deobfuscators.CliSecure {
|
||||||
class DeobfuscatorInfo : DeobfuscatorInfoBase {
|
class DeobfuscatorInfo : DeobfuscatorInfoBase {
|
||||||
|
@ -139,7 +140,7 @@ namespace de4dot.deobfuscators.CliSecure {
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
byte[] fileData = DeobUtils.readModule(module);
|
byte[] fileData = DeobUtils.readModule(module);
|
||||||
var peImage = new PE.PeImage(fileData);
|
var peImage = new PeImage(fileData);
|
||||||
|
|
||||||
if (!new MethodsDecrypter().decrypt(peImage, ref dumpedMethods)) {
|
if (!new MethodsDecrypter().decrypt(peImage, ref dumpedMethods)) {
|
||||||
Log.v("Methods aren't encrypted or invalid signature");
|
Log.v("Methods aren't encrypted or invalid signature");
|
||||||
|
|
|
@ -20,6 +20,7 @@
|
||||||
using System;
|
using System;
|
||||||
using System.Collections.Generic;
|
using System.Collections.Generic;
|
||||||
using Mono.MyStuff;
|
using Mono.MyStuff;
|
||||||
|
using de4dot.PE;
|
||||||
|
|
||||||
namespace de4dot.deobfuscators.CliSecure {
|
namespace de4dot.deobfuscators.CliSecure {
|
||||||
class CodeHeader {
|
class CodeHeader {
|
||||||
|
@ -50,7 +51,7 @@ namespace de4dot.deobfuscators.CliSecure {
|
||||||
static byte[] normalSignature = new byte[16] { 0x08, 0x44, 0x65, 0xE1, 0x8C, 0x82, 0x13, 0x4C, 0x9C, 0x85, 0xB4, 0x17, 0xDA, 0x51, 0xAD, 0x25 };
|
static byte[] normalSignature = new byte[16] { 0x08, 0x44, 0x65, 0xE1, 0x8C, 0x82, 0x13, 0x4C, 0x9C, 0x85, 0xB4, 0x17, 0xDA, 0x51, 0xAD, 0x25 };
|
||||||
static byte[] proSignature = new byte[16] { 0x68, 0xA0, 0xBB, 0x60, 0x13, 0x65, 0x5F, 0x41, 0xAE, 0x42, 0xAB, 0x42, 0x9B, 0x6B, 0x4E, 0xC1 };
|
static byte[] proSignature = new byte[16] { 0x68, 0xA0, 0xBB, 0x60, 0x13, 0x65, 0x5F, 0x41, 0xAE, 0x42, 0xAB, 0x42, 0x9B, 0x6B, 0x4E, 0xC1 };
|
||||||
|
|
||||||
PE.PeImage peImage;
|
PeImage peImage;
|
||||||
CodeHeader codeHeader = new CodeHeader();
|
CodeHeader codeHeader = new CodeHeader();
|
||||||
IDecrypter decrypter;
|
IDecrypter decrypter;
|
||||||
|
|
||||||
|
@ -59,11 +60,11 @@ namespace de4dot.deobfuscators.CliSecure {
|
||||||
}
|
}
|
||||||
|
|
||||||
abstract class DecrypterBase : IDecrypter {
|
abstract class DecrypterBase : IDecrypter {
|
||||||
protected PE.PeImage peImage;
|
protected PeImage peImage;
|
||||||
protected CodeHeader codeHeader;
|
protected CodeHeader codeHeader;
|
||||||
protected uint endOfMetadata;
|
protected uint endOfMetadata;
|
||||||
|
|
||||||
public DecrypterBase(PE.PeImage peImage, CodeHeader codeHeader) {
|
public DecrypterBase(PeImage peImage, CodeHeader codeHeader) {
|
||||||
this.peImage = peImage;
|
this.peImage = peImage;
|
||||||
this.codeHeader = codeHeader;
|
this.codeHeader = codeHeader;
|
||||||
endOfMetadata = peImage.rvaToOffset(peImage.Cor20Header.metadataDirectory.virtualAddress + peImage.Cor20Header.metadataDirectory.size);
|
endOfMetadata = peImage.rvaToOffset(peImage.Cor20Header.metadataDirectory.virtualAddress + peImage.Cor20Header.metadataDirectory.size);
|
||||||
|
@ -89,7 +90,7 @@ namespace de4dot.deobfuscators.CliSecure {
|
||||||
}
|
}
|
||||||
|
|
||||||
class NormalDecrypter : DecrypterBase {
|
class NormalDecrypter : DecrypterBase {
|
||||||
public NormalDecrypter(PE.PeImage peImage, CodeHeader codeHeader)
|
public NormalDecrypter(PeImage peImage, CodeHeader codeHeader)
|
||||||
: base(peImage, codeHeader) {
|
: base(peImage, codeHeader) {
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -109,7 +110,7 @@ namespace de4dot.deobfuscators.CliSecure {
|
||||||
class ProDecrypter : DecrypterBase {
|
class ProDecrypter : DecrypterBase {
|
||||||
uint[] key = new uint[4];
|
uint[] key = new uint[4];
|
||||||
|
|
||||||
public ProDecrypter(PE.PeImage peImage, CodeHeader codeHeader)
|
public ProDecrypter(PeImage peImage, CodeHeader codeHeader)
|
||||||
: base(peImage, codeHeader) {
|
: base(peImage, codeHeader) {
|
||||||
for (int i = 0; i < 4; i++)
|
for (int i = 0; i < 4; i++)
|
||||||
key[i] = be_readUint32(codeHeader.decryptionKey, i * 4);
|
key[i] = be_readUint32(codeHeader.decryptionKey, i * 4);
|
||||||
|
@ -154,7 +155,7 @@ namespace de4dot.deobfuscators.CliSecure {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
public bool decrypt(PE.PeImage peImage, ref Dictionary<uint, DumpedMethod> dumpedMethods) {
|
public bool decrypt(PeImage peImage, ref Dictionary<uint, DumpedMethod> dumpedMethods) {
|
||||||
this.peImage = peImage;
|
this.peImage = peImage;
|
||||||
|
|
||||||
uint offset = peImage.rvaToOffset(peImage.Cor20Header.metadataDirectory.virtualAddress + peImage.Cor20Header.metadataDirectory.size);
|
uint offset = peImage.rvaToOffset(peImage.Cor20Header.metadataDirectory.virtualAddress + peImage.Cor20Header.metadataDirectory.size);
|
||||||
|
|
Loading…
Reference in New Issue
Block a user