de4dot
|
9f8cac4dac
|
Fix #56
|
2012-07-08 08:14:36 +02:00 |
|
de4dot
|
598529a039
|
Support calli instruction
|
2012-07-08 04:18:26 +02:00 |
|
de4dot
|
16d5a31640
|
Create a SentinelType
|
2012-07-08 03:50:50 +02:00 |
|
de4dot
|
1581ec959d
|
Merge branch 'master' into new_code
|
2012-07-07 19:35:54 +02:00 |
|
de4dot
|
1867a06e84
|
Continue if same method
|
2012-07-07 09:09:55 +02:00 |
|
de4dot
|
ad6c6401b9
|
Support VS2008
|
2012-07-07 07:16:55 +02:00 |
|
de4dot
|
e440270a63
|
Fix proxy calls
|
2012-07-07 01:59:03 +02:00 |
|
de4dot
|
0a5764a093
|
Change method to take a ref to a type
|
2012-07-07 00:58:18 +02:00 |
|
de4dot
|
02c89550cb
|
Update the counter
|
2012-07-05 23:19:37 +02:00 |
|
de4dot
|
d5c8f6842a
|
Update log string
|
2012-07-02 21:49:59 +02:00 |
|
de4dot
|
8a34b6e015
|
Make method static
|
2012-07-02 21:49:45 +02:00 |
|
de4dot
|
b9e88972ae
|
Support latest CO build
|
2012-07-02 14:26:00 +02:00 |
|
de4dot
|
23697e2c00
|
Support ILP 1.0.5
|
2012-07-01 16:23:51 +02:00 |
|
de4dot
|
4c5fa3e809
|
Remove ILP detection
|
2012-06-27 15:19:09 +02:00 |
|
de4dot
|
4236514691
|
Merge branch 'ilp' into new_code
|
2012-06-27 15:15:55 +02:00 |
|
de4dot
|
a2baf1fdea
|
Merge branch 'master' into new_code
|
2012-06-27 15:15:03 +02:00 |
|
de4dot
|
4dce00b35a
|
Merge branch 'rummage' into new_code
Conflicts:
de4dot.cui/Program.cs
|
2012-06-27 15:14:40 +02:00 |
|
de4dot
|
199a0b4043
|
New version: 1.8.6
|
2012-06-27 10:46:12 +02:00 |
|
de4dot
|
12797ecb03
|
Support latest CO build
|
2012-06-27 10:45:45 +02:00 |
|
de4dot
|
cd0a193bdf
|
Support latest AN build
|
2012-06-27 10:27:16 +02:00 |
|
de4dot
|
d1259460e3
|
Update detection of decrypter constants. Fixes #59
|
2012-06-25 01:14:26 +02:00 |
|
de4dot
|
fa594c6213
|
Add better BL support
|
2012-06-12 11:15:19 +02:00 |
|
de4dot
|
4a29eae1c8
|
Add more inflate() overloads
|
2012-06-11 21:20:14 +02:00 |
|
de4dot
|
31118c11ba
|
Add the code from SharpZipLib that de4dot uses
|
2012-06-11 21:18:03 +02:00 |
|
de4dot
|
b964996388
|
Support Babel.NET 5.5
|
2012-06-06 21:16:32 +02:00 |
|
de4dot
|
a8bf74ca78
|
Support Rummage
|
2012-06-06 11:40:48 +02:00 |
|
de4dot
|
6d675fea54
|
Add XTEA decrypter
|
2012-06-06 11:39:48 +02:00 |
|
de4dot
|
3264bfc5cd
|
Support latest CO build
|
2012-06-04 09:51:07 +02:00 |
|
de4dot
|
5567c9a06a
|
Warn if strings resource couldn't be found
|
2012-06-04 06:34:32 +02:00 |
|
de4dot
|
3582b773ca
|
Support ILP
|
2012-06-04 05:02:46 +02:00 |
|
de4dot
|
27a91f5942
|
Change parameters type from [] to IList
|
2012-06-04 03:55:25 +02:00 |
|
de4dot
|
286462db4b
|
Move file
|
2012-06-03 19:08:46 +02:00 |
|
de4dot
|
e75386d0f9
|
Move method to Utils.cs
|
2012-06-03 16:44:08 +02:00 |
|
de4dot
|
b844dbc428
|
Detect ILP
|
2012-06-02 20:56:36 +02:00 |
|
de4dot
|
bff92e02e7
|
Remove unused method
|
2012-06-02 17:32:05 +02:00 |
|
de4dot
|
d2ec4e2969
|
New version: 1.8.5
|
2012-06-02 07:27:50 +02:00 |
|
de4dot
|
ec8139f640
|
Refactor code and support latest AN build
|
2012-06-02 07:26:21 +02:00 |
|
de4dot
|
a25f4f4640
|
Remove proxy methods type and make sure all proxy methods are inlined
|
2012-06-02 03:33:21 +02:00 |
|
de4dot
|
3c99e8d0d6
|
Update valid name regex
|
2012-06-01 12:53:03 +02:00 |
|
de4dot
|
6696c26496
|
Assembly resolver init method is sometimes only called from Main()
|
2012-06-01 12:40:16 +02:00 |
|
de4dot
|
d091564d85
|
Fix ToString(). Should separate generic args with commas
|
2012-06-01 12:05:01 +02:00 |
|
de4dot
|
cd2851baf4
|
Add an option to disable dumping embedded assemblies
|
2012-06-01 12:01:45 +02:00 |
|
de4dot
|
58b62ff914
|
Decrypt main assembly and embedded assemblies
|
2012-06-01 11:53:54 +02:00 |
|
de4dot
|
ddc270b963
|
Remove newlines from names when calling logger methods
|
2012-05-31 06:08:01 +02:00 |
|
de4dot
|
96f9f4154d
|
Decrypt CF encrypted strings
|
2012-05-29 20:20:11 +02:00 |
|
de4dot
|
9b591c68d3
|
Fix CF proxy calls
|
2012-05-29 19:14:41 +02:00 |
|
de4dot
|
512c650e11
|
Add another proxy call fixer class
|
2012-05-29 19:13:43 +02:00 |
|
de4dot
|
24d1c5182b
|
Update comment
|
2012-05-29 19:07:01 +02:00 |
|
de4dot
|
58adda95b6
|
getAllBlocks() now returns a List instead of an IList
|
2012-05-29 19:06:41 +02:00 |
|
de4dot
|
7b3dcf8e05
|
Refactor proxy call fixer classes
|
2012-05-29 11:13:39 +02:00 |
|
de4dot
|
1b569a0d24
|
Support MPRESS
|
2012-05-28 18:00:29 +02:00 |
|
de4dot
|
3e6a259e8f
|
Add 50 more points if methods decrypter is detected
|
2012-05-27 07:43:26 +02:00 |
|
de4dot
|
c441a60372
|
Print CW version number
|
2012-05-27 07:00:13 +02:00 |
|
de4dot
|
eebb090827
|
Support old CW 2.x
|
2012-05-27 02:31:53 +02:00 |
|
de4dot
|
06a30473da
|
Decrypt strings encrypted with older CW version
|
2012-05-26 20:20:11 +02:00 |
|
de4dot
|
adaf41c769
|
Decrypt embedded assemblies
|
2012-05-26 17:41:08 +02:00 |
|
de4dot
|
3a96ae391a
|
Move common resolver handler detector code to DeobUtils
|
2012-05-26 17:33:26 +02:00 |
|
de4dot
|
dbd7affaa8
|
Update valid name regex
|
2012-05-26 14:40:51 +02:00 |
|
de4dot
|
f1c8549066
|
Decrypt CW encrypted strings
|
2012-05-26 14:38:08 +02:00 |
|
de4dot
|
20452fe964
|
Decrypt CW encrypted methods
|
2012-05-26 05:26:00 +02:00 |
|
de4dot
|
b1f5fe92be
|
Clear invalid method bodies
|
2012-05-24 16:42:04 +02:00 |
|
de4dot
|
1a7c89a173
|
New version: 1.8.4
|
2012-05-19 09:02:26 +02:00 |
|
de4dot
|
c48b2d92c2
|
Support AN 6.0.0.5 (new build, same version)
|
2012-05-19 08:59:13 +02:00 |
|
de4dot
|
f6c5ed1c0c
|
New version: 1.8.3
|
2012-05-15 19:06:21 +02:00 |
|
de4dot
|
c3cdf95fcf
|
Support AN 6.0.0.5
|
2012-05-15 19:05:47 +02:00 |
|
de4dot
|
d1c09c3fae
|
New version: 1.8.2
|
2012-05-13 15:06:50 +02:00 |
|
de4dot
|
654ebf652e
|
Merge branch 'ds'
|
2012-05-12 21:40:01 +02:00 |
|
de4dot
|
bec6725aa7
|
Rename option
|
2012-05-12 21:39:49 +02:00 |
|
de4dot
|
40898cf238
|
Decrypt embedded assemblies (SL)
|
2012-05-11 19:38:31 +02:00 |
|
de4dot
|
ce3622f6e8
|
Use the correct variable
|
2012-05-11 18:18:19 +02:00 |
|
de4dot
|
94ee4064ed
|
Remove namespace prefix
|
2012-05-11 18:17:51 +02:00 |
|
de4dot
|
cd014f1d72
|
Update fields restorer
|
2012-05-10 20:20:29 +02:00 |
|
de4dot
|
1d2a78979f
|
Use generic prop creator if the type has a generic parameter
|
2012-05-10 19:00:12 +02:00 |
|
de4dot
|
f05a334c11
|
Make sure we don't rename a key to an already existing non-renamed key
|
2012-05-10 18:41:21 +02:00 |
|
de4dot
|
0b47ccf070
|
Remove cflow obfuscation arrays
|
2012-05-10 18:38:27 +02:00 |
|
de4dot
|
ae7e32ae5b
|
Remove decrypt method and other init method
|
2012-05-10 13:39:14 +02:00 |
|
de4dot
|
c5f8aaeb1a
|
Dump 4.1 embedded assemblies
|
2012-05-09 22:24:39 +02:00 |
|
de4dot
|
ee32b84283
|
Move code to DsUtils
|
2012-05-09 22:20:17 +02:00 |
|
de4dot
|
9b9e692947
|
Move version specific data to their own class
|
2012-05-09 19:10:20 +02:00 |
|
de4dot
|
dadc064b55
|
Decrypt V4.1 resources
|
2012-05-09 19:00:21 +02:00 |
|
de4dot
|
1aaa5df9ce
|
Support trial string encrypter
|
2012-05-09 17:30:35 +02:00 |
|
de4dot
|
3572bdfdcc
|
Set maxlen to 50. Fix incorrect method sig. Make sure there are no dupes.
|
2012-05-09 17:28:52 +02:00 |
|
de4dot
|
e5a64a4402
|
Remove more XC attributes
|
2012-05-06 13:07:34 +02:00 |
|
de4dot
|
44fea8f185
|
Fix problems found while testing
|
2012-05-03 17:24:59 +02:00 |
|
de4dot
|
b27e1b36af
|
Add option to disable cast deobfuscation
|
2012-05-03 16:51:36 +02:00 |
|
de4dot
|
ea205dcae8
|
Add option to disable renaming resource keys
|
2012-05-03 16:48:03 +02:00 |
|
de4dot
|
955c1f10bd
|
Rename resource keys
|
2012-05-03 16:47:34 +02:00 |
|
de4dot
|
76a10b1f34
|
Add Data property
|
2012-05-03 16:40:17 +02:00 |
|
de4dot
|
83725200c1
|
Add isValidResourceKeyName()
|
2012-05-03 14:53:01 +02:00 |
|
de4dot
|
2761216e39
|
Add a resource reader
|
2012-05-03 14:34:58 +02:00 |
|
de4dot
|
83dc4226c1
|
Make sure string decrypter methods aren't detected as inlined methods
|
2012-05-03 09:51:26 +02:00 |
|
de4dot
|
870dab5b90
|
Fix renaming events/properties
|
2012-05-03 09:05:05 +02:00 |
|
de4dot
|
fb9e217dac
|
Add a cast deobfuscator
|
2012-05-03 08:01:35 +02:00 |
|
de4dot
|
c61161be1d
|
Ignore method attributes
|
2012-05-02 18:43:57 +02:00 |
|
de4dot
|
597fcb0210
|
Cflow deob methods
|
2012-05-02 13:51:07 +02:00 |
|
de4dot
|
e8049c6a05
|
Inline some obfuscated methods
|
2012-05-02 10:48:44 +02:00 |
|
de4dot
|
db14e73369
|
Make sure index is correct, and add method to read arg constants
|
2012-05-02 10:47:21 +02:00 |
|
de4dot
|
b15b581c46
|
Deobfuscate string decrypter cctor
|
2012-04-30 21:47:23 +02:00 |
|
de4dot
|
2594317b18
|
Use other sb ctor
|
2012-04-30 12:49:43 +02:00 |
|
de4dot
|
1805e352c4
|
Disable using unknown args by default
|
2012-04-30 12:18:47 +02:00 |
|
de4dot
|
f307520e62
|
Decrypt DS 4.1 strings
|
2012-04-30 08:33:05 +02:00 |
|
de4dot
|
a1daee56f8
|
Support more types of args
|
2012-04-30 08:31:09 +02:00 |
|
de4dot
|
e29a8ea692
|
Update cflow deobfuscator
|
2012-04-30 01:29:05 +02:00 |
|
de4dot
|
6b18d70e77
|
Move common code to another class
|
2012-04-30 01:26:34 +02:00 |
|
de4dot
|
83b14da5c8
|
Refactor: create common cflow deob iface
|
2012-04-29 23:51:04 +02:00 |
|
de4dot
|
920f079855
|
Set initlocals and add an option to disable it
|
2012-04-29 06:16:53 +02:00 |
|
de4dot
|
eb17298625
|
Move the field
|
2012-04-29 04:35:58 +02:00 |
|
de4dot
|
48b9c461f5
|
Restore calls to CodeDomProvider and ICodeCompiler
|
2012-04-29 04:03:10 +02:00 |
|
de4dot
|
9333e2415c
|
Rename class
|
2012-04-29 00:56:17 +02:00 |
|
de4dot
|
e548436ede
|
Restore calls to Icon/Bitmap .ctor
|
2012-04-29 00:51:09 +02:00 |
|
de4dot
|
b92b23df4a
|
Rename class and make it more general
|
2012-04-29 00:11:28 +02:00 |
|
de4dot
|
f9c78f8a8b
|
Decrypt CS 1.x encrypted methods
|
2012-04-28 08:50:37 +02:00 |
|
de4dot
|
03e2e621ea
|
Update detection of resource resolver type
|
2012-04-26 20:50:06 +02:00 |
|
de4dot
|
9754b01ba9
|
Merge branch 'master' into cs
|
2012-04-26 19:33:28 +02:00 |
|
de4dot
|
7a0804e035
|
Remove module references to the CS RT files
|
2012-04-26 17:14:54 +02:00 |
|
de4dot
|
7e5e7ddcd2
|
Find old string decrypter method
|
2012-04-26 16:53:52 +02:00 |
|
de4dot
|
67c866491d
|
Show the correct obfuscator name
|
2012-04-26 16:33:55 +02:00 |
|
de4dot
|
6f830b8329
|
Remove all obfuscator attributes
|
2012-04-26 16:23:07 +02:00 |
|
de4dot
|
aa6e7c0fc2
|
Add addAttributesToBeRemoved()
|
2012-04-26 16:08:39 +02:00 |
|
de4dot
|
960f934c67
|
Update detection of CS type
|
2012-04-26 14:46:22 +02:00 |
|
de4dot
|
e10dce2d95
|
Check for 32-bit or 64-bit method
|
2012-04-26 02:31:31 +02:00 |
|
de4dot
|
5b97faf2dd
|
Detect CS type when strings are encrypted, but methods aren't
|
2012-04-26 01:56:59 +02:00 |
|
de4dot
|
ab60692c2f
|
Return the correct return value
|
2012-04-26 01:48:59 +02:00 |
|
de4dot
|
d84d2e6a6c
|
Update CS detector and support an old string decrypter
|
2012-04-26 01:42:10 +02:00 |
|
de4dot
|
bff017a317
|
Throw InvalidMethodBody if IOException
|
2012-04-25 18:06:27 +02:00 |
|
de4dot
|
903db59827
|
Restore CS 3.0 "encrypted" methods
|
2012-04-25 13:49:22 +02:00 |
|
de4dot
|
4e89d707dc
|
Move code to DeobUtils
|
2012-04-25 13:21:53 +02:00 |
|
de4dot
|
8a45abfd3d
|
Stop earlier
|
2012-04-25 11:09:30 +02:00 |
|
de4dot
|
adea5b3ef6
|
Support latest MC build
|
2012-04-24 23:02:36 +02:00 |
|
de4dot
|
3a9422f798
|
Remove useless displs
|
2012-04-24 22:30:17 +02:00 |
|
de4dot
|
2b4fc0a836
|
Merge branch 'master' into cs
|
2012-04-24 11:39:31 +02:00 |
|
de4dot
|
eebb831c4b
|
Update CSVM opcode handler detection code
|
2012-04-24 11:33:17 +02:00 |
|
de4dot
|
88d7607d10
|
Fix resolver
|
2012-04-24 11:25:39 +02:00 |
|
de4dot
|
586be53fef
|
Fix method names
|
2012-04-23 19:37:05 +02:00 |
|
de4dot
|
7a399e7913
|
Rename class and update comments
|
2012-04-23 15:02:15 +02:00 |
|
de4dot
|
ea7a533027
|
Make fields read only
|
2012-04-23 15:00:42 +02:00 |
|
de4dot
|
b28dd6277a
|
Fix method names
|
2012-04-23 14:47:05 +02:00 |
|
de4dot
|
0a0b491072
|
Copy foundSig field
|
2012-04-23 14:40:56 +02:00 |
|
de4dot
|
dba8d8ebef
|
Use a using statement to make sure the file is closed when we return
|
2012-04-23 14:25:12 +02:00 |
|
de4dot
|
4f34e5c374
|
Restore .NET data directory so it can be deobfuscated
|
2012-04-23 02:04:34 +02:00 |
|
de4dot
|
790dc9f445
|
codeOffs should not be file offset
|
2012-04-22 21:26:57 +02:00 |
|
de4dot
|
c9fa7caf91
|
Decrypt CS 5.0 encrypted methods
|
2012-04-22 21:19:57 +02:00 |
|
de4dot
|
d3f1a2fd8e
|
Decrypt CS 4.5 encrypted methods
|
2012-04-22 20:35:01 +02:00 |
|
de4dot
|
fbba6a2aa8
|
Decrypt methods (CS RT is embedded inside the assembly)
|
2012-04-22 16:18:41 +02:00 |
|
de4dot
|
c9f63a5866
|
Restore CS 4.0 "encrypted" methods
|
2012-04-22 15:36:26 +02:00 |
|
de4dot
|
59e2e51882
|
Throw if invalid method body
|
2012-04-22 14:13:48 +02:00 |
|
de4dot
|
1a79ffde92
|
Move code to a new class
|
2012-04-22 13:43:43 +02:00 |
|
de4dot
|
0d41f9e41e
|
Remove useless field
|
2012-04-21 23:10:06 +02:00 |
|
de4dot
|
46152761ee
|
Input could be null
|
2012-04-17 14:13:40 +02:00 |
|
de4dot
|
d637c1af9a
|
New version: 1.8.1
|
2012-04-15 23:42:57 +02:00 |
|