monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Move isCode() to DeobUtils

Browse Source
This commit is contained in:
de4dot 2011-11-30 19:04:49 +01:00
parent b7a44b459d
commit fde811d183
2 changed files with 14 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
de4dot.code/deobfuscators/DeobUtils.cs
View File

@ -50,5 +50,17 @@ namespace de4dot.deobfuscators {
public static byte[] readModule(ModuleDefinition module) {
return Utils.readFile(module.FullyQualifiedName);
}
public static bool isCode(short[] nativeCode, byte[] code) {
if (nativeCode.Length != code.Length)
return false;
for (int i = 0; i < nativeCode.Length; i++) {
if (nativeCode[i] == -1)
continue;
if ((byte)nativeCode[i] != code[i])
return false;
}
return true;
}
}
}

16
de4dot.code/deobfuscators/dotNET_Reactor/MethodsDecrypter.cs
View File

@ -211,7 +211,7 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
// Convert return true / false methods. The others are converted to
// throw 0xDEADCODE.
if (isCode(nativeLdci4, methodData)) {
if (DeobUtils.isCode(nativeLdci4, methodData)) {
uint val = BitConverter.ToUInt32(methodData, 4);
// ldc.i4 XXXXXXXXh / ret
methodData = new byte[] { 0x20, 0, 0, 0, 0, 0x2A };
@ -220,7 +220,7 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
methodData[3] = (byte)(val >> 16);
methodData[4] = (byte)(val >> 24);
}
else if (isCode(nativeLdci4_0, methodData)) {
else if (DeobUtils.isCode(nativeLdci4_0, methodData)) {
// ldc.i4.0 / ret
methodData = new byte[] { 0x16, 0x2A };
}
@ -264,18 +264,6 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
return true;
}
static bool isCode(short[] nativeCode, byte[] code) {
if (nativeCode.Length != code.Length)
return false;
for (int i = 0; i < nativeCode.Length; i++) {
if (nativeCode[i] == -1)
continue;
if ((byte)nativeCode[i] != code[i])
return false;
}
return true;
}
static void patchDwords(PeImage peImage, BinaryReader reader, int count) {
for (int i = 0; i < count; i++) {
uint rva = reader.ReadUInt32();