monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'master' into confuser

Browse Source
This commit is contained in:
de4dot 2012-08-13 02:00:03 +02:00
commit f571a7ec22
5 changed files with 6 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
blocks/cflow/BranchEmulator.cs
View File

@ -220,7 +220,7 @@ namespace de4dot.blocks.cflow {
return emulateBranch(1, Int64Value.compareFalse((Int64Value)val1)); return emulateBranch(1, Int64Value.compareFalse((Int64Value)val1));
else if (val1.isNull()) else if (val1.isNull())
return emulateBranch(1, true); return emulateBranch(1, true);
else if (val1.isObject() || val1.isString() || val1.isBoxed()) else if (val1.isObject() || val1.isString())
return emulateBranch(1, false); return emulateBranch(1, false);
else else
return false; return false;
@ -235,7 +235,7 @@ namespace de4dot.blocks.cflow {
return emulateBranch(1, Int64Value.compareTrue((Int64Value)val1)); return emulateBranch(1, Int64Value.compareTrue((Int64Value)val1));
else if (val1.isNull()) else if (val1.isNull())
return emulateBranch(1, false); return emulateBranch(1, false);
else if (val1.isObject() || val1.isString() || val1.isBoxed()) else if (val1.isObject() || val1.isString())
return emulateBranch(1, true); return emulateBranch(1, true);
else else
return false; return false;

26
de4dot.code/ObfuscatedFile.cs
View File

@ -248,7 +248,6 @@ namespace de4dot.code {
if (this.deob != null) { if (this.deob != null) {
deob.init(module); deob.init(module);
deob.DeobfuscatedFile = this; deob.DeobfuscatedFile = this;
deob.earlyDetect();
deob.detect(); deob.detect();
return; return;
} }
@ -261,35 +260,14 @@ namespace de4dot.code {
if (options.ForcedObfuscatorType != null) { if (options.ForcedObfuscatorType != null) {
foreach (var deob in deobfuscators) { foreach (var deob in deobfuscators) {
if (string.Equals(options.ForcedObfuscatorType, deob.Type, StringComparison.OrdinalIgnoreCase)) { if (string.Equals(options.ForcedObfuscatorType, deob.Type, StringComparison.OrdinalIgnoreCase)) {
deob.earlyDetect();
this.deob = deob; this.deob = deob;
deob.detect(); deob.detect();
return; return;
} }
} }
} }
else { else
this.deob = earlyDetectObfuscator(deobfuscators); this.deob = detectObfuscator2(deobfuscators);
if (this.deob == null)
this.deob = detectObfuscator2(deobfuscators);
else
this.deob.detect();
}
}
IDeobfuscator earlyDetectObfuscator(IEnumerable<IDeobfuscator> deobfuscators) {
IDeobfuscator detected = null;
int detectVal = 0;
foreach (var deob in deobfuscators) {
int val = deob.earlyDetect();
if (val > 0)
Log.v("{0,3}: {1}", val, deob.TypeLong);
if (val > detectVal) {
detectVal = val;
detected = deob;
}
}
return detected;
} }
IDeobfuscator detectObfuscator2(IEnumerable<IDeobfuscator> deobfuscators) { IDeobfuscator detectObfuscator2(IEnumerable<IDeobfuscator> deobfuscators) {

4
de4dot.code/deobfuscators/DeobfuscatorBase.cs
View File

@ -127,10 +127,6 @@ namespace de4dot.code.deobfuscators {
return optionsBase.ValidNameRegex.isMatch(name); return optionsBase.ValidNameRegex.isMatch(name);
} }
public virtual int earlyDetect() {
return 0;
}
public virtual int detect() { public virtual int detect() {
scanForObfuscator(); scanForObfuscator();
return detectInternal(); return detectInternal();

5
de4dot.code/deobfuscators/IDeobfuscator.cs
View File

@ -72,11 +72,6 @@ namespace de4dot.code.deobfuscators {
void init(ModuleDefinition module); void init(ModuleDefinition module);
// Same as detect() but may be used by deobfuscators to detect obfuscator that decrypt
// metadata at runtime. Code in detect() assume they can access everything. 0 should be
// returned if not detected.
int earlyDetect();
// Returns 0 if it's not detected, or > 0 if detected (higher value => more likely true). // Returns 0 if it's not detected, or > 0 if detected (higher value => more likely true).
// This method is always called. // This method is always called.
int detect(); int detect();

2
de4dot.code/deobfuscators/Unknown/Deobfuscator.cs
View File

@ -86,6 +86,8 @@ namespace de4dot.code.deobfuscators.Unknown {
string scanTypes() { string scanTypes() {
foreach (var type in module.Types) { foreach (var type in module.Types) {
if (type.FullName == "ConfusedByAttribute")
return "Confuser";
if (type.FullName == "ZYXDNGuarder") if (type.FullName == "ZYXDNGuarder")
return "DNGuard HVM"; return "DNGuard HVM";
if (type.Name.Contains("();\t")) if (type.Name.Contains("();\t"))