From ff3b87e42efe2f58cddc1d5b25d0acf8ea94a8a9 Mon Sep 17 00:00:00 2001 From: de4dot Date: Mon, 24 Mar 2014 20:18:37 +0100 Subject: [PATCH] Use next handler if end is reached --- .../Agile_NET/vm/v2/CompositeHandlerDetector.cs | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/de4dot.code/deobfuscators/Agile_NET/vm/v2/CompositeHandlerDetector.cs b/de4dot.code/deobfuscators/Agile_NET/vm/v2/CompositeHandlerDetector.cs index 56900000..1dec73de 100644 --- a/de4dot.code/deobfuscators/Agile_NET/vm/v2/CompositeHandlerDetector.cs +++ b/de4dot.code/deobfuscators/Agile_NET/vm/v2/CompositeHandlerDetector.cs @@ -53,10 +53,10 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm.v2 { public readonly int BlockIndex; public int HashIndex; - public HandlerState(List blockSigInfos, int blockIndex, int instructionIndex) { + public HandlerState(List blockSigInfos, int blockIndex, int hashIndex) { this.BlockSigInfos = blockSigInfos; this.BlockIndex = blockIndex; - this.HashIndex = instructionIndex; + this.HashIndex = hashIndex; } public HandlerState Clone() { @@ -164,6 +164,8 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm.v2 { } } + if (nextState == null && findState.VisitedCompositeBlocks.Count != findState.CompositeState.BlockSigInfos.Count) + nextState = GetNextHandlerState(ref findState); if (nextState == null) { if (findState.VisitedCompositeBlocks.Count != findState.CompositeState.BlockSigInfos.Count) return false; @@ -181,6 +183,16 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm.v2 { } } + static HandlerState? GetNextHandlerState(ref FindHandlerState findState) { + for (int i = 0; i < findState.CompositeState.BlockSigInfos.Count; i++) { + if (findState.VisitedCompositeBlocks.ContainsKey(i)) + continue; + return new HandlerState(findState.CompositeState.BlockSigInfos, i, 0); + } + + return null; + } + static bool Compare(ref HandlerState handler, ref HandlerState composite) { var hhashes = handler.BlockSigInfos[handler.BlockIndex].Hashes; int hi = handler.HashIndex;