de4dot
|
f307520e62
|
Decrypt DS 4.1 strings
|
2012-04-30 08:33:05 +02:00 |
|
de4dot
|
e29a8ea692
|
Update cflow deobfuscator
|
2012-04-30 01:29:05 +02:00 |
|
de4dot
|
6b18d70e77
|
Move common code to another class
|
2012-04-30 01:26:34 +02:00 |
|
de4dot
|
83b14da5c8
|
Refactor: create common cflow deob iface
|
2012-04-29 23:51:04 +02:00 |
|
de4dot
|
920f079855
|
Set initlocals and add an option to disable it
|
2012-04-29 06:16:53 +02:00 |
|
de4dot
|
eb17298625
|
Move the field
|
2012-04-29 04:35:58 +02:00 |
|
de4dot
|
48b9c461f5
|
Restore calls to CodeDomProvider and ICodeCompiler
|
2012-04-29 04:03:10 +02:00 |
|
de4dot
|
9333e2415c
|
Rename class
|
2012-04-29 00:56:17 +02:00 |
|
de4dot
|
e548436ede
|
Restore calls to Icon/Bitmap .ctor
|
2012-04-29 00:51:09 +02:00 |
|
de4dot
|
b92b23df4a
|
Rename class and make it more general
|
2012-04-29 00:11:28 +02:00 |
|
de4dot
|
f9c78f8a8b
|
Decrypt CS 1.x encrypted methods
|
2012-04-28 08:50:37 +02:00 |
|
de4dot
|
03e2e621ea
|
Update detection of resource resolver type
|
2012-04-26 20:50:06 +02:00 |
|
de4dot
|
9754b01ba9
|
Merge branch 'master' into cs
|
2012-04-26 19:33:28 +02:00 |
|
de4dot
|
7a0804e035
|
Remove module references to the CS RT files
|
2012-04-26 17:14:54 +02:00 |
|
de4dot
|
7e5e7ddcd2
|
Find old string decrypter method
|
2012-04-26 16:53:52 +02:00 |
|
de4dot
|
67c866491d
|
Show the correct obfuscator name
|
2012-04-26 16:33:55 +02:00 |
|
de4dot
|
6f830b8329
|
Remove all obfuscator attributes
|
2012-04-26 16:23:07 +02:00 |
|
de4dot
|
aa6e7c0fc2
|
Add addAttributesToBeRemoved()
|
2012-04-26 16:08:39 +02:00 |
|
de4dot
|
960f934c67
|
Update detection of CS type
|
2012-04-26 14:46:22 +02:00 |
|
de4dot
|
e10dce2d95
|
Check for 32-bit or 64-bit method
|
2012-04-26 02:31:31 +02:00 |
|
de4dot
|
5b97faf2dd
|
Detect CS type when strings are encrypted, but methods aren't
|
2012-04-26 01:56:59 +02:00 |
|
de4dot
|
ab60692c2f
|
Return the correct return value
|
2012-04-26 01:48:59 +02:00 |
|
de4dot
|
d84d2e6a6c
|
Update CS detector and support an old string decrypter
|
2012-04-26 01:42:10 +02:00 |
|
de4dot
|
bff017a317
|
Throw InvalidMethodBody if IOException
|
2012-04-25 18:06:27 +02:00 |
|
de4dot
|
903db59827
|
Restore CS 3.0 "encrypted" methods
|
2012-04-25 13:49:22 +02:00 |
|
de4dot
|
4e89d707dc
|
Move code to DeobUtils
|
2012-04-25 13:21:53 +02:00 |
|
de4dot
|
8a45abfd3d
|
Stop earlier
|
2012-04-25 11:09:30 +02:00 |
|
de4dot
|
adea5b3ef6
|
Support latest MC build
|
2012-04-24 23:02:36 +02:00 |
|
de4dot
|
3a9422f798
|
Remove useless displs
|
2012-04-24 22:30:17 +02:00 |
|
de4dot
|
2b4fc0a836
|
Merge branch 'master' into cs
|
2012-04-24 11:39:31 +02:00 |
|
de4dot
|
eebb831c4b
|
Update CSVM opcode handler detection code
|
2012-04-24 11:33:17 +02:00 |
|
de4dot
|
586be53fef
|
Fix method names
|
2012-04-23 19:37:05 +02:00 |
|
de4dot
|
7a399e7913
|
Rename class and update comments
|
2012-04-23 15:02:15 +02:00 |
|
de4dot
|
ea7a533027
|
Make fields read only
|
2012-04-23 15:00:42 +02:00 |
|
de4dot
|
b28dd6277a
|
Fix method names
|
2012-04-23 14:47:05 +02:00 |
|
de4dot
|
0a0b491072
|
Copy foundSig field
|
2012-04-23 14:40:56 +02:00 |
|
de4dot
|
dba8d8ebef
|
Use a using statement to make sure the file is closed when we return
|
2012-04-23 14:25:12 +02:00 |
|
de4dot
|
4f34e5c374
|
Restore .NET data directory so it can be deobfuscated
|
2012-04-23 02:04:34 +02:00 |
|
de4dot
|
790dc9f445
|
codeOffs should not be file offset
|
2012-04-22 21:26:57 +02:00 |
|
de4dot
|
c9fa7caf91
|
Decrypt CS 5.0 encrypted methods
|
2012-04-22 21:19:57 +02:00 |
|
de4dot
|
d3f1a2fd8e
|
Decrypt CS 4.5 encrypted methods
|
2012-04-22 20:35:01 +02:00 |
|
de4dot
|
fbba6a2aa8
|
Decrypt methods (CS RT is embedded inside the assembly)
|
2012-04-22 16:18:41 +02:00 |
|
de4dot
|
c9f63a5866
|
Restore CS 4.0 "encrypted" methods
|
2012-04-22 15:36:26 +02:00 |
|
de4dot
|
59e2e51882
|
Throw if invalid method body
|
2012-04-22 14:13:48 +02:00 |
|
de4dot
|
1a79ffde92
|
Move code to a new class
|
2012-04-22 13:43:43 +02:00 |
|
de4dot
|
0d41f9e41e
|
Remove useless field
|
2012-04-21 23:10:06 +02:00 |
|
de4dot
|
46152761ee
|
Input could be null
|
2012-04-17 14:13:40 +02:00 |
|
de4dot
|
941929cf7a
|
Support latest CO build
|
2012-04-15 23:42:11 +02:00 |
|
de4dot
|
0df7b918ea
|
Refactor
|
2012-04-13 05:03:52 +02:00 |
|
de4dot
|
a459bc107c
|
Make sure <Module>::.cctor() only calls <CliSecureRT>::Initialize()
|
2012-04-13 05:03:51 +02:00 |
|
de4dot
|
043730e599
|
Ignore invalid method indexes
|
2012-04-11 03:11:01 +02:00 |
|
de4dot
|
3a8e1499f2
|
Use dynamic decryption if static decryption fails
|
2012-04-11 03:09:59 +02:00 |
|
de4dot
|
588373f5ff
|
Add code to decrypt methods using the new dynamic methods decrypter
|
2012-04-10 21:28:22 +02:00 |
|
de4dot
|
1e33610ce8
|
Support latest MC build
|
2012-04-10 19:06:03 +02:00 |
|
de4dot
|
b97dacbc54
|
Merge branch 'cs'
|
2012-04-10 16:32:40 +02:00 |
|
de4dot
|
c756d543c1
|
Rename PE namespace
|
2012-04-10 16:32:15 +02:00 |
|
de4dot
|
553337adb7
|
Support EF 3.3.149
|
2012-04-10 03:52:18 +02:00 |
|
de4dot
|
2d583316cf
|
Use the constant
|
2012-04-08 11:36:24 +02:00 |
|
de4dot
|
634e9ec023
|
Reverse return value
|
2012-04-07 06:47:19 +02:00 |
|
de4dot
|
11f992b0f2
|
Support some more instrs
|
2012-04-06 22:07:52 +02:00 |
|
de4dot
|
52d6f73f5e
|
Add a newline
|
2012-04-06 16:36:07 +02:00 |
|
de4dot
|
1f74aeb1cf
|
Rename variable
|
2012-04-06 16:25:25 +02:00 |
|
de4dot
|
33e2177059
|
Restore constrained. prefix
|
2012-04-06 16:08:35 +02:00 |
|
de4dot
|
1935e58dbf
|
Support ldloca and ldarga
|
2012-04-06 16:08:09 +02:00 |
|
de4dot
|
5511ab833b
|
Update ldelema type, and add unbox.any and ldobj
|
2012-04-06 15:38:44 +02:00 |
|
de4dot
|
2949862614
|
Print warning if we failed to restore an instr op
|
2012-04-06 12:33:39 +02:00 |
|
de4dot
|
c39e421010
|
Fix locals
|
2012-04-06 12:25:15 +02:00 |
|
de4dot
|
86190ede1f
|
Print devirtualized methods
|
2012-04-06 11:05:06 +02:00 |
|
de4dot
|
237732e98e
|
Refactor
|
2012-04-05 20:45:16 +02:00 |
|
de4dot
|
da0878d765
|
Restore types that are generic parameters
|
2012-04-05 19:38:05 +02:00 |
|
de4dot
|
a38fe57ec1
|
Add CSVM devirtualizer
|
2012-04-05 19:15:10 +02:00 |
|
de4dot
|
0adbb3e70a
|
Move code to a new class
|
2012-04-05 18:05:27 +02:00 |
|
de4dot
|
1ead27107b
|
Don't add to list if null
|
2012-04-05 17:06:27 +02:00 |
|
de4dot
|
9cfe8431f6
|
Add shared deobfuscator data/methods
|
2012-04-04 21:06:10 +02:00 |
|
de4dot
|
7c8259905b
|
Update CO code. Fixes #39
|
2012-03-31 13:53:33 +02:00 |
|
de4dot
|
ec775b9ef5
|
Support another SK string encrypter
|
2012-03-27 15:33:57 +02:00 |
|
de4dot
|
065927f702
|
Use the property
|
2012-03-27 15:23:27 +02:00 |
|
de4dot
|
d1e499454e
|
Rename locals and fix problem with huge strings
|
2012-03-27 02:27:26 +02:00 |
|
de4dot
|
6e188aa7e0
|
Decrypt MC encrypted strings
|
2012-03-26 22:07:01 +02:00 |
|
de4dot
|
e76321aaad
|
Remove unused method
|
2012-03-26 20:12:07 +02:00 |
|
de4dot
|
716098d33a
|
Change locals to instance variables
|
2012-03-26 19:34:09 +02:00 |
|
de4dot
|
e62d4f910a
|
Update detection of MC type
|
2012-03-24 19:35:38 +01:00 |
|
de4dot
|
efd317489d
|
Support latest EF 3.3.143
|
2012-03-23 10:13:59 +01:00 |
|
de4dot
|
8ca040f0da
|
Use callsMethod()
|
2012-03-21 03:49:28 +01:00 |
|
de4dot
|
ad5a759cd9
|
Remove useless cases
|
2012-03-21 03:19:26 +01:00 |
|
de4dot
|
1e9b20e432
|
Support EF obfuscated CF assemblies
|
2012-03-18 22:59:34 +01:00 |
|
de4dot
|
4b81854ea5
|
Restore resource names ending in ".g.resources"
|
2012-03-17 22:12:51 +01:00 |
|
de4dot
|
6f01d48593
|
Change getCalledMethods() return type
|
2012-03-17 20:36:41 +01:00 |
|
de4dot
|
0b858c47ed
|
Support DS obfuscated SL assemblies
|
2012-03-17 15:02:48 +01:00 |
|
de4dot
|
37450a1515
|
Support old DS 3.0.3.41 - 3.0.4.44
|
2012-03-17 14:11:37 +01:00 |
|
de4dot
|
48c7d40fb6
|
Inline method
|
2012-03-17 11:19:03 +01:00 |
|
de4dot
|
a3b052d15c
|
Should be "continue"
|
2012-03-17 11:18:52 +01:00 |
|
de4dot
|
9ecc5a313f
|
Support EF obfuscated SL assemblies
|
2012-03-16 23:22:24 +01:00 |
|
de4dot
|
d9aec67fcb
|
Rename
|
2012-03-16 22:39:50 +01:00 |
|
de4dot
|
ce9add13cb
|
Support CO obfuscated SL/CF assemblies
|
2012-03-15 22:36:23 +01:00 |
|
de4dot
|
0537a2edce
|
Use getModuleTypeCctor()
|
2012-03-15 09:38:52 +01:00 |
|
de4dot
|
67cb85e7ce
|
Update detection of obfuscator types
|
2012-03-15 09:15:12 +01:00 |
|
de4dot
|
e4fe749559
|
Use hasInteger() method
|
2012-03-15 02:19:35 +01:00 |
|
de4dot
|
27f382a017
|
Support a (new?) version of CryptoObfuscator. Fixes #33
|
2012-03-14 22:28:20 +01:00 |
|
de4dot
|
a405edf0fd
|
Support latest DeepSea version (4.0.4.32)
|
2012-03-13 20:37:33 +01:00 |
|
de4dot
|
ada90b1294
|
Add another CO detection check
|
2012-03-13 20:27:41 +01:00 |
|
de4dot
|
e949d8c926
|
Add support for latest EF 3.3.136
|
2012-03-13 09:26:40 +01:00 |
|
de4dot
|
7e1bf542af
|
Support a new EF 3.3 version that was released 1-2 days ago
|
2012-03-11 15:59:25 +01:00 |
|
de4dot
|
7d4c791575
|
Update detection of SA v2 string decrypter
|
2012-03-10 05:32:50 +01:00 |
|
de4dot
|
fafa60c4c9
|
Update expressions
|
2012-03-10 05:31:07 +01:00 |
|
de4dot
|
4e997910e4
|
Update detection of string decrypter type
|
2012-03-08 19:21:54 +01:00 |
|
de4dot
|
51fe58c4cd
|
Merge branch 'new_code'
|
2012-03-08 18:03:25 +01:00 |
|
de4dot
|
4a7b4f4111
|
Update name regex
|
2012-03-08 16:15:19 +01:00 |
|
de4dot
|
b4525ed58d
|
Support EF 3.3
|
2012-03-06 10:43:06 +01:00 |
|
de4dot
|
48d6a3b6fc
|
Merge branch 'mc'
|
2012-03-01 22:10:36 +01:00 |
|
de4dot
|
86987518d6
|
Method should not be public
|
2012-02-29 11:41:07 +01:00 |
|
de4dot
|
9bf30e165c
|
Rename classes
|
2012-02-29 11:41:06 +01:00 |
|
de4dot
|
9791e63e51
|
Engrish
|
2012-02-29 11:41:05 +01:00 |
|
de4dot
|
8740ba8419
|
Rename variable
|
2012-02-29 11:41:04 +01:00 |
|
de4dot
|
167368f488
|
Attributes are worth less
|
2012-02-29 00:13:57 +01:00 |
|
de4dot
|
b27635f493
|
Remove sealed flag from interfaces
|
2012-02-28 23:57:48 +01:00 |
|
de4dot
|
e6d0c4a043
|
Move version detection to a new class
|
2012-02-28 22:30:22 +01:00 |
|
de4dot
|
77228ecfca
|
Update name regex
|
2012-02-28 22:24:08 +01:00 |
|
de4dot
|
68b4315e95
|
Update detection of the type and remove another type
|
2012-02-28 20:49:03 +01:00 |
|
de4dot
|
269b695245
|
Update detection of that type
|
2012-02-28 20:44:05 +01:00 |
|
de4dot
|
c970e1f6ca
|
Support v3.0 - 3.1
|
2012-02-28 19:42:19 +01:00 |
|
de4dot
|
acb53f535b
|
Throw if init fails
|
2012-02-28 18:18:13 +01:00 |
|
de4dot
|
f37e5a12d0
|
Restore calls to Assembly::GetManifestResourceXXX methods
|
2012-02-28 18:17:33 +01:00 |
|
de4dot
|
d740a3f5f6
|
Move GetManifestResourceStream code to a new class
|
2012-02-28 18:14:41 +01:00 |
|
de4dot
|
e72fb7220a
|
Decrypt embedded assemblies and resources
|
2012-02-27 23:43:45 +01:00 |
|
de4dot
|
9bab65640c
|
Refactor
|
2012-02-27 12:55:37 +01:00 |
|
de4dot
|
3c480f4c6c
|
Add another warning message
|
2012-02-27 01:51:44 +01:00 |
|
de4dot
|
cee04d3bba
|
master was updated
|
2012-02-26 22:57:55 +01:00 |
|
de4dot
|
cf76c14b4b
|
Merge branch 'master' into mc
|
2012-02-26 22:55:06 +01:00 |
|
de4dot
|
efec6625ef
|
Update detection of EF 3.0 and 3.1
|
2012-02-26 22:54:28 +01:00 |
|
de4dot
|
2bff1242c1
|
Add static EF string decrypter
|
2012-02-26 22:48:43 +01:00 |
|
de4dot
|
da1d649ef4
|
Make sure no generic methods are inlined
|
2012-02-25 06:33:38 +01:00 |
|
de4dot
|
10ceb12e30
|
Change return type to IEnumerable<int>
|
2012-02-25 06:25:40 +01:00 |
|
de4dot
|
48758be8f0
|
Use a new class instead of the dict
|
2012-02-25 06:14:19 +01:00 |
|
de4dot
|
d09938ca47
|
Remove classes with null base type
|
2012-02-25 05:28:32 +01:00 |
|
de4dot
|
5288b4b3d2
|
Make sure enum instance field has proper flags set (make peverify happy)
|
2012-02-25 05:15:42 +01:00 |
|
de4dot
|
4ec4bb1d65
|
MC actually does rename symbols so add an updated regex
|
2012-02-23 11:52:19 +01:00 |
|
de4dot
|
6e8b32df21
|
Reverse sort comments
|
2012-02-23 10:59:02 +01:00 |
|
de4dot
|
7c4f014da3
|
Support old MC 3.2
|
2012-02-22 12:38:02 +01:00 |
|
de4dot
|
59ee55105d
|
Support some older MC version
|
2012-02-22 12:14:15 +01:00 |
|
de4dot
|
435d3303c3
|
Merge branch 'master' into mc
|
2012-02-21 17:33:45 +01:00 |
|
de4dot
|
538e4f738d
|
Fix issue #24. Don't remove decrypter type if there was an error
|
2012-02-21 17:14:02 +01:00 |
|
de4dot
|
e5145fcca9
|
Remove MC type and module refs
|
2012-02-21 12:01:39 +01:00 |
|
de4dot
|
7bc3930df9
|
Decrypt resources
|
2012-02-21 11:51:19 +01:00 |
|
de4dot
|
58a94a8420
|
Decrypt methods protected with older MC version
|
2012-02-21 09:26:05 +01:00 |
|
de4dot
|
eb223537f0
|
Decrypt methods (decryption #1-4, not #5-7)
|
2012-02-20 17:20:29 +01:00 |
|
de4dot
|
b422e08fb1
|
Add lookup() method for ModuleReferences
|
2012-02-20 17:18:22 +01:00 |
|
de4dot
|
8536e211dd
|
Detect MC
|
2012-02-20 04:58:46 +01:00 |
|
de4dot
|
fc497b1688
|
Add MaxtoCode files
|
2012-02-20 03:48:59 +01:00 |
|
de4dot
|
d7afc66c6d
|
Don't remove string decrypter type if there's still code calling it
|
2012-02-19 00:50:08 +01:00 |
|