Move isCode() to DeobUtils
This commit is contained in:
parent
b7a44b459d
commit
fde811d183
|
@ -50,5 +50,17 @@ namespace de4dot.deobfuscators {
|
||||||
public static byte[] readModule(ModuleDefinition module) {
|
public static byte[] readModule(ModuleDefinition module) {
|
||||||
return Utils.readFile(module.FullyQualifiedName);
|
return Utils.readFile(module.FullyQualifiedName);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
public static bool isCode(short[] nativeCode, byte[] code) {
|
||||||
|
if (nativeCode.Length != code.Length)
|
||||||
|
return false;
|
||||||
|
for (int i = 0; i < nativeCode.Length; i++) {
|
||||||
|
if (nativeCode[i] == -1)
|
||||||
|
continue;
|
||||||
|
if ((byte)nativeCode[i] != code[i])
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
return true;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -211,7 +211,7 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
|
||||||
|
|
||||||
// Convert return true / false methods. The others are converted to
|
// Convert return true / false methods. The others are converted to
|
||||||
// throw 0xDEADCODE.
|
// throw 0xDEADCODE.
|
||||||
if (isCode(nativeLdci4, methodData)) {
|
if (DeobUtils.isCode(nativeLdci4, methodData)) {
|
||||||
uint val = BitConverter.ToUInt32(methodData, 4);
|
uint val = BitConverter.ToUInt32(methodData, 4);
|
||||||
// ldc.i4 XXXXXXXXh / ret
|
// ldc.i4 XXXXXXXXh / ret
|
||||||
methodData = new byte[] { 0x20, 0, 0, 0, 0, 0x2A };
|
methodData = new byte[] { 0x20, 0, 0, 0, 0, 0x2A };
|
||||||
|
@ -220,7 +220,7 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
|
||||||
methodData[3] = (byte)(val >> 16);
|
methodData[3] = (byte)(val >> 16);
|
||||||
methodData[4] = (byte)(val >> 24);
|
methodData[4] = (byte)(val >> 24);
|
||||||
}
|
}
|
||||||
else if (isCode(nativeLdci4_0, methodData)) {
|
else if (DeobUtils.isCode(nativeLdci4_0, methodData)) {
|
||||||
// ldc.i4.0 / ret
|
// ldc.i4.0 / ret
|
||||||
methodData = new byte[] { 0x16, 0x2A };
|
methodData = new byte[] { 0x16, 0x2A };
|
||||||
}
|
}
|
||||||
|
@ -264,18 +264,6 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
static bool isCode(short[] nativeCode, byte[] code) {
|
|
||||||
if (nativeCode.Length != code.Length)
|
|
||||||
return false;
|
|
||||||
for (int i = 0; i < nativeCode.Length; i++) {
|
|
||||||
if (nativeCode[i] == -1)
|
|
||||||
continue;
|
|
||||||
if ((byte)nativeCode[i] != code[i])
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void patchDwords(PeImage peImage, BinaryReader reader, int count) {
|
static void patchDwords(PeImage peImage, BinaryReader reader, int count) {
|
||||||
for (int i = 0; i < count; i++) {
|
for (int i = 0; i < count; i++) {
|
||||||
uint rva = reader.ReadUInt32();
|
uint rva = reader.ReadUInt32();
|
||||||
|
|
Loading…
Reference in New Issue
Block a user