monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Decrypt methods (CS RT is embedded inside the assembly)

Browse Source
This commit is contained in:
de4dot 2012-04-22 16:18:41 +02:00
parent 4d8eb601f2
commit fbba6a2aa8
2 changed files with 32 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
de4dot.code/deobfuscators/CliSecure/CliSecureRtType.cs
View File

@ -18,8 +18,10 @@
*/
using System;
using System.IO;
using Mono.Cecil;
using de4dot.blocks;
using de4dot.PE;
namespace de4dot.code.deobfuscators.CliSecure {
class CliSecureRtType {
@ -29,9 +31,10 @@ namespace de4dot.code.deobfuscators.CliSecure {
MethodDefinition initializeMethod;
MethodDefinition stringDecrypterMethod;
MethodDefinition loadMethod;
bool foundSig;
public bool Detected {
get { return cliSecureRtType != null; }
get { return foundSig || cliSecureRtType != null; }
}
public TypeDefinition Type {
@ -76,7 +79,9 @@ namespace de4dot.code.deobfuscators.CliSecure {
return;
if (find2())
return;
findOld();
if (findOld())
return;
findNativeCode();
}
bool find2() {
@ -143,6 +148,15 @@ namespace de4dot.code.deobfuscators.CliSecure {
return false;
}
bool findNativeCode() {
if ((module.Attributes & ModuleAttributes.ILOnly) != 0)
return false;
var peImage = new PeImage(new FileStream(module.FullyQualifiedName, FileMode.Open, FileAccess.Read, FileShare.Read));
foundSig = MethodsDecrypter.detect(peImage);
return foundSig;
}
static bool hasPinvokeMethod(TypeDefinition type, string methodName) {
foreach (var method in type.Methods) {
if (method.PInvokeInfo == null)

17
de4dot.code/deobfuscators/CliSecure/MethodsDecrypter.cs
View File

@ -278,8 +278,12 @@ namespace de4dot.code.deobfuscators.CliSecure {
return new CsHeader5(this);
}
static uint getCodeHeaderOffset(PeImage peImage) {
return peImage.rvaToOffset(peImage.Cor20Header.metadataDirectory.virtualAddress + peImage.Cor20Header.metadataDirectory.size);
}
public bool decrypt2(ref DumpedMethods dumpedMethods) {
uint codeHeaderOffset = peImage.rvaToOffset(peImage.Cor20Header.metadataDirectory.virtualAddress + peImage.Cor20Header.metadataDirectory.size);
uint codeHeaderOffset = getCodeHeaderOffset(peImage);
if (!readCodeHeader(codeHeaderOffset))
return false;
@ -350,5 +354,16 @@ namespace de4dot.code.deobfuscators.CliSecure {
return true;
}
public static bool detect(PeImage peImage) {
try {
uint codeHeaderOffset = getCodeHeaderOffset(peImage);
var sig = peImage.offsetReadBytes(codeHeaderOffset, 16);
return Utils.compare(sig, normalSignature) || Utils.compare(sig, proSignature);
}
catch {
return false;
}
}
}
}