From fde811d1832627e6f7341ffb09effa9ecff8c9cc Mon Sep 17 00:00:00 2001 From: de4dot Date: Wed, 30 Nov 2011 19:04:49 +0100 Subject: [PATCH] Move isCode() to DeobUtils --- de4dot.code/deobfuscators/DeobUtils.cs | 12 ++++++++++++ .../dotNET_Reactor/MethodsDecrypter.cs | 16 ++-------------- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/de4dot.code/deobfuscators/DeobUtils.cs b/de4dot.code/deobfuscators/DeobUtils.cs index 670b1688..3f165c5a 100644 --- a/de4dot.code/deobfuscators/DeobUtils.cs +++ b/de4dot.code/deobfuscators/DeobUtils.cs @@ -50,5 +50,17 @@ namespace de4dot.deobfuscators { public static byte[] readModule(ModuleDefinition module) { return Utils.readFile(module.FullyQualifiedName); } + + public static bool isCode(short[] nativeCode, byte[] code) { + if (nativeCode.Length != code.Length) + return false; + for (int i = 0; i < nativeCode.Length; i++) { + if (nativeCode[i] == -1) + continue; + if ((byte)nativeCode[i] != code[i]) + return false; + } + return true; + } } } diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/MethodsDecrypter.cs b/de4dot.code/deobfuscators/dotNET_Reactor/MethodsDecrypter.cs index b2121898..5c7bcf53 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/MethodsDecrypter.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/MethodsDecrypter.cs @@ -211,7 +211,7 @@ namespace de4dot.deobfuscators.dotNET_Reactor { // Convert return true / false methods. The others are converted to // throw 0xDEADCODE. - if (isCode(nativeLdci4, methodData)) { + if (DeobUtils.isCode(nativeLdci4, methodData)) { uint val = BitConverter.ToUInt32(methodData, 4); // ldc.i4 XXXXXXXXh / ret methodData = new byte[] { 0x20, 0, 0, 0, 0, 0x2A }; @@ -220,7 +220,7 @@ namespace de4dot.deobfuscators.dotNET_Reactor { methodData[3] = (byte)(val >> 16); methodData[4] = (byte)(val >> 24); } - else if (isCode(nativeLdci4_0, methodData)) { + else if (DeobUtils.isCode(nativeLdci4_0, methodData)) { // ldc.i4.0 / ret methodData = new byte[] { 0x16, 0x2A }; } @@ -264,18 +264,6 @@ namespace de4dot.deobfuscators.dotNET_Reactor { return true; } - static bool isCode(short[] nativeCode, byte[] code) { - if (nativeCode.Length != code.Length) - return false; - for (int i = 0; i < nativeCode.Length; i++) { - if (nativeCode[i] == -1) - continue; - if ((byte)nativeCode[i] != code[i]) - return false; - } - return true; - } - static void patchDwords(PeImage peImage, BinaryReader reader, int count) { for (int i = 0; i < count; i++) { uint rva = reader.ReadUInt32();