monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Move isCode() to DeobUtils

Browse Source
This commit is contained in:
de4dot 2011-11-30 19:04:49 +01:00
parent b7a44b459d
commit fde811d183
2 changed files with 14 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
de4dot.code/deobfuscators/DeobUtils.cs
View File

@ -50,5 +50,17 @@ namespace de4dot.deobfuscators {
public static byte[] readModule(ModuleDefinition module) { public static byte[] readModule(ModuleDefinition module) {
return Utils.readFile(module.FullyQualifiedName); return Utils.readFile(module.FullyQualifiedName);
} }
public static bool isCode(short[] nativeCode, byte[] code) {
if (nativeCode.Length != code.Length)
return false;
for (int i = 0; i < nativeCode.Length; i++) {
if (nativeCode[i] == -1)
continue;
if ((byte)nativeCode[i] != code[i])
return false;
}
return true;
}
} }
} }

16
de4dot.code/deobfuscators/dotNET_Reactor/MethodsDecrypter.cs
View File

@ -211,7 +211,7 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
// Convert return true / false methods. The others are converted to // Convert return true / false methods. The others are converted to
// throw 0xDEADCODE. // throw 0xDEADCODE.
if (isCode(nativeLdci4, methodData)) { if (DeobUtils.isCode(nativeLdci4, methodData)) {
uint val = BitConverter.ToUInt32(methodData, 4); uint val = BitConverter.ToUInt32(methodData, 4);
// ldc.i4 XXXXXXXXh / ret // ldc.i4 XXXXXXXXh / ret
methodData = new byte[] { 0x20, 0, 0, 0, 0, 0x2A }; methodData = new byte[] { 0x20, 0, 0, 0, 0, 0x2A };
@ -220,7 +220,7 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
methodData[3] = (byte)(val >> 16); methodData[3] = (byte)(val >> 16);
methodData[4] = (byte)(val >> 24); methodData[4] = (byte)(val >> 24);
} }
else if (isCode(nativeLdci4_0, methodData)) { else if (DeobUtils.isCode(nativeLdci4_0, methodData)) {
// ldc.i4.0 / ret // ldc.i4.0 / ret
methodData = new byte[] { 0x16, 0x2A }; methodData = new byte[] { 0x16, 0x2A };
} }
@ -264,18 +264,6 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
return true; return true;
} }
static bool isCode(short[] nativeCode, byte[] code) {
if (nativeCode.Length != code.Length)
return false;
for (int i = 0; i < nativeCode.Length; i++) {
if (nativeCode[i] == -1)
continue;
if ((byte)nativeCode[i] != code[i])
return false;
}
return true;
}
static void patchDwords(PeImage peImage, BinaryReader reader, int count) { static void patchDwords(PeImage peImage, BinaryReader reader, int count) {
for (int i = 0; i < count; i++) { for (int i = 0; i < count; i++) {
uint rva = reader.ReadUInt32(); uint rva = reader.ReadUInt32();