de4dot
|
58b1b27c69
|
Use correct upper limit in loop, and return false on failure...
|
2012-08-21 20:17:21 +02:00 |
|
de4dot
|
3b9ba16df6
|
Make restoreMethod() virtual
|
2012-08-21 20:14:43 +02:00 |
|
de4dot
|
64cc8e3856
|
Decrypt CO encrypted methods
|
2012-08-21 15:40:06 +02:00 |
|
de4dot
|
0a5973e541
|
Update detection of CO types
|
2012-08-21 15:06:42 +02:00 |
|
de4dot
|
957a8ab8dd
|
Move method to new CoUtils class
|
2012-08-21 15:04:40 +02:00 |
|
de4dot
|
729780c235
|
Update MethodBodyReaderBase
- Change field types to IList<T>
- Add restoreMethod()
- Add readInstructionsNumBytes()
|
2012-08-21 14:59:46 +02:00 |
|
de4dot
|
db9e5c412c
|
Add the latest revision number
|
2012-08-18 08:37:03 +02:00 |
|
de4dot
|
6bf54bbae2
|
Use version from ConfusedBy attribute on module/asm to narrow down the detected version
|
2012-08-16 01:12:10 +02:00 |
|
de4dot
|
9e4fa4511b
|
Merge branch 'master' into confuser
|
2012-08-16 01:06:13 +02:00 |
|
de4dot
|
bfcd42804e
|
Add getModuleAttribute()
|
2012-08-15 19:33:57 +02:00 |
|
de4dot
|
f571a7ec22
|
Merge branch 'master' into confuser
|
2012-08-13 02:00:03 +02:00 |
|
de4dot
|
1768de1d6b
|
Remove earlyDetect()
|
2012-08-13 00:54:46 +02:00 |
|
de4dot
|
b5aebd4731
|
Set ILOnly flag in .NET header
|
2012-08-12 02:52:48 +02:00 |
|
de4dot
|
4b9ee54409
|
Return string decrypter method tokens
|
2012-08-12 02:47:03 +02:00 |
|
de4dot
|
0d04bef305
|
Log the returned revisions
|
2012-08-12 00:38:26 +02:00 |
|
de4dot
|
5376c74919
|
Detect anti dump version
|
2012-08-11 22:55:48 +02:00 |
|
de4dot
|
f7c1676d1d
|
Detect anti debugger version
|
2012-08-11 22:55:41 +02:00 |
|
de4dot
|
0d9c298dcb
|
Move methods
|
2012-08-11 22:34:08 +02:00 |
|
de4dot
|
77b8b0f471
|
Let's use this variable...
|
2012-08-11 04:55:49 +02:00 |
|
de4dot
|
3837ec8e1b
|
Update detection of compressor
|
2012-08-11 04:15:29 +02:00 |
|
de4dot
|
e9125616b9
|
Remember detected compressor version
|
2012-08-11 01:15:25 +02:00 |
|
de4dot
|
ed919ee528
|
Update detection of compressor version
|
2012-08-11 00:37:19 +02:00 |
|
de4dot
|
965bf1f2e6
|
Detect Confuser 1.8 r75369 proxy methods creator
|
2012-08-10 23:19:30 +02:00 |
|
de4dot
|
e256ecfa9a
|
Detect Confuser 1.7 r73479 proxy methods creator
|
2012-08-10 23:19:30 +02:00 |
|
de4dot
|
1fffd44a2a
|
Detect Confuser 1.6 r70489 proxy methods creator
|
2012-08-10 23:19:29 +02:00 |
|
de4dot
|
30f6771541
|
Detect Confuser 1.6 r66631 proxy methods creator
|
2012-08-10 23:19:28 +02:00 |
|
de4dot
|
9cf4887061
|
Detect Confuser 1.4 r58802 proxy methods creator
|
2012-08-10 23:19:28 +02:00 |
|
de4dot
|
e3e051b876
|
Detect Confuser 1.3 r55604 proxy methods creator
|
2012-08-10 23:19:21 +02:00 |
|
de4dot
|
b647b59fad
|
Detect Confuser 1.3 r55346 proxy methods creator
|
2012-08-10 21:29:15 +02:00 |
|
de4dot
|
b3b3f222cf
|
Use the greatest version we find
|
2012-08-10 21:29:15 +02:00 |
|
de4dot
|
2a283b922b
|
Detect Confuser 1.2 r54564 proxy methods creator
|
2012-08-10 21:29:03 +02:00 |
|
de4dot
|
35ddd30e08
|
Detect Confuser 1.1 r50378 proxy methods creator
|
2012-08-10 20:43:11 +02:00 |
|
de4dot
|
be29d8aed2
|
Detect Confuser 1.0 r42919 proxy methods creator
|
2012-08-10 20:14:47 +02:00 |
|
de4dot
|
612aeec0ab
|
Detect Confuser 1.7 r73566 compressor
|
2012-08-10 17:47:59 +02:00 |
|
de4dot
|
dfad2421b2
|
Detect Confuser 1.4 r57778 compressor
|
2012-08-10 17:25:04 +02:00 |
|
de4dot
|
12f7034894
|
Detect Confuser 1.0 r48717 compressor
|
2012-08-10 17:20:32 +02:00 |
|
de4dot
|
731d7bcb73
|
Support Confuser 1.7 r74021 constants encrypter (dynamic mode)
|
2012-08-10 17:00:55 +02:00 |
|
de4dot
|
d7eb818203
|
Detect Confuser 1.7 r74021 constants encrypter
|
2012-08-10 16:45:26 +02:00 |
|
de4dot
|
7984c94522
|
Detect Confuser 1.7 r72989 constants encrypter
|
2012-08-10 16:29:24 +02:00 |
|
de4dot
|
80f2a08ff1
|
Add latest rev
|
2012-08-10 15:51:58 +02:00 |
|
de4dot
|
7aa2a157d0
|
Detect Confuser 1.9 r75725 methods encrypter (JIT)
|
2012-08-10 04:12:20 +02:00 |
|
de4dot
|
754c5a1400
|
Detect Confuser 1.8 r75291 methods encrypter (JIT)
|
2012-08-10 03:46:14 +02:00 |
|
de4dot
|
29448fe3cb
|
Detect Confuser 1.8 r75288 methods encrypter (JIT)
|
2012-08-10 03:39:37 +02:00 |
|
de4dot
|
2f19f876f7
|
Detect Confuser 1.8 r75257 methods encrypter
|
2012-08-10 03:29:38 +02:00 |
|
de4dot
|
3b6e56f3e4
|
Detect Confuser 1.7 r73430 methods encrypter
|
2012-08-10 03:21:58 +02:00 |
|
de4dot
|
9d386c528c
|
Detect Confuser 1.9 r75725 methods encrypter
|
2012-08-10 02:55:43 +02:00 |
|
de4dot
|
f998afd74e
|
Detect Confuser 1.8 r75288 methods encrypter
|
2012-08-10 02:47:12 +02:00 |
|
de4dot
|
88d9a26333
|
Detect Confuser 1.7 r72989 methods encrypter
|
2012-08-10 02:33:10 +02:00 |
|
de4dot
|
ca4fc5566a
|
Detect Confuser 1.4 r58852 methods decrypter
|
2012-08-10 02:08:35 +02:00 |
|
de4dot
|
c437a9fa8a
|
Fix maxRev
|
2012-08-09 23:32:11 +02:00 |
|
de4dot
|
3c4ec53cd5
|
Add RIP comment
|
2012-08-09 23:06:12 +02:00 |
|
de4dot
|
030b35696b
|
Update printing of version number
- Don't print + after revision if it's the latest revision
- Don't print + after version if it's the latest version
|
2012-08-09 18:27:31 +02:00 |
|
de4dot
|
95b6041788
|
Use the correct file extension when saving the main module
|
2012-08-09 14:14:15 +02:00 |
|
de4dot
|
291040abfe
|
Detect and print Confuser version
|
2012-08-09 12:05:16 +02:00 |
|
de4dot
|
d92ff23740
|
Detect Confuser 1.3 r55604 safe string encrypter
|
2012-08-09 11:34:27 +02:00 |
|
de4dot
|
72c22d7566
|
Add missing init call and rename methods
|
2012-08-09 01:20:58 +02:00 |
|
de4dot
|
752b28dc4c
|
Add space
|
2012-08-08 22:29:44 +02:00 |
|
de4dot
|
4993fd8700
|
Fix bug
|
2012-08-08 21:36:58 +02:00 |
|
de4dot
|
0ae0e17bb1
|
Support Confuser 1.9 r76119 anti debugger
|
2012-08-08 21:32:15 +02:00 |
|
de4dot
|
4be2145cb6
|
Support Confuser 1.9 r76101 proxy methods
|
2012-08-08 21:22:00 +02:00 |
|
de4dot
|
81e879e494
|
Update version numbers
|
2012-08-08 18:34:59 +02:00 |
|
de4dot
|
95cca2aded
|
Update version numbers
|
2012-08-08 18:34:37 +02:00 |
|
de4dot
|
4ca36a4250
|
Update version numbers
|
2012-08-08 18:34:24 +02:00 |
|
de4dot
|
5e2572a201
|
Update version numbers
|
2012-08-08 18:04:57 +02:00 |
|
de4dot
|
876c13c08a
|
Rename proxy method class
|
2012-08-08 17:40:24 +02:00 |
|
de4dot
|
a2798908b0
|
Merge other proxy method class with the V10 one
|
2012-08-08 17:38:38 +02:00 |
|
de4dot
|
94acbc7131
|
Detect Confuser 1.8 r75367 compressor
|
2012-08-08 14:44:01 +02:00 |
|
de4dot
|
edac6b1a91
|
Use the original module name, if available
|
2012-08-08 14:41:16 +02:00 |
|
de4dot
|
06d00f0588
|
Add comment
|
2012-08-08 14:32:41 +02:00 |
|
de4dot
|
536062ae39
|
Update detection of compressor modulus
|
2012-08-08 14:31:13 +02:00 |
|
de4dot
|
09e20597f8
|
Support Confuser 1.8 r75367 constants encrypter
|
2012-08-08 14:30:46 +02:00 |
|
de4dot
|
21deab4ee7
|
Support Confuser 1.8 r75367 resource encrypter
|
2012-08-08 12:14:54 +02:00 |
|
de4dot
|
efb828ac90
|
Rename class
|
2012-08-08 01:33:26 +02:00 |
|
de4dot
|
31832a15bb
|
Add RIP comment
|
2012-08-08 01:29:43 +02:00 |
|
de4dot
|
81ef7215ce
|
Set default key size
|
2012-08-08 01:19:29 +02:00 |
|
de4dot
|
d37643217f
|
Support Confuser 1.7 r75257 constants encrypter
|
2012-08-07 21:57:14 +02:00 |
|
de4dot
|
1bd7632b2c
|
Detect Confuser 1.7 r75184 compressor
|
2012-08-07 19:52:53 +02:00 |
|
de4dot
|
ade379c20b
|
Support Confuser 1.7 r75076 compressor (lzma)
|
2012-08-07 19:47:09 +02:00 |
|
de4dot
|
774e2e1880
|
Support Confuser 1.7 r75056 constants encrypter
|
2012-08-07 17:51:43 +02:00 |
|
de4dot
|
860dd5a0f5
|
Detect Confuser 1.7 r74816 constants encrypter
|
2012-08-07 17:28:53 +02:00 |
|
de4dot
|
64b48ec315
|
Support Confuser 1.7 r74788 constants encrypter
|
2012-08-07 15:26:16 +02:00 |
|
de4dot
|
6baa3f0e2f
|
Support Confuser 1.7 r74708 constants encrypter
|
2012-08-07 14:40:51 +02:00 |
|
de4dot
|
9db99626f2
|
Refactor
|
2012-08-05 20:25:43 +02:00 |
|
de4dot
|
ab57733ae4
|
Detect Confuser 1.7 r74708 proxy method handlers
|
2012-08-05 12:46:59 +02:00 |
|
de4dot
|
923fb1f9ca
|
Call the correct ctor
|
2012-08-05 04:42:59 +02:00 |
|
de4dot
|
926d53885e
|
Support Confuser 1.7 r74021 JIT methods encrypter
|
2012-08-05 02:38:23 +02:00 |
|
de4dot
|
f65715cac8
|
Add some comments
|
2012-08-05 02:37:31 +02:00 |
|
de4dot
|
a3dbf5273d
|
Support Confuser 1.7 r73822 constants encrypter
|
2012-08-05 02:07:43 +02:00 |
|
de4dot
|
9ba6594278
|
Rename variable
|
2012-08-05 02:06:19 +02:00 |
|
de4dot
|
48ea288574
|
Support Confuser 1.7 r73822 resource encrypter
|
2012-08-05 01:57:36 +02:00 |
|
de4dot
|
5ded502104
|
Remove invalid asm ref added by Confuser 1.7 r73764
|
2012-08-04 11:21:52 +02:00 |
|
de4dot
|
13d0cff55b
|
Support Confuser 1.7 r73764 constants encrypter
|
2012-08-04 11:01:24 +02:00 |
|
de4dot
|
bc1a3e5ece
|
Support Confuser 1.7 r73740 proxy methods
|
2012-08-04 09:26:13 +02:00 |
|
de4dot
|
ed3b6607da
|
Support Confuser 1.7 r73740 constants encrypter (dynamic mode)
|
2012-08-04 09:20:42 +02:00 |
|
de4dot
|
cc1eeccaf9
|
Support Confuser 1.7 r73740 native methods
|
2012-08-04 09:16:06 +02:00 |
|
de4dot
|
2a68e3d27c
|
Add a comment
|
2012-08-03 23:49:18 +02:00 |
|
de4dot
|
82dd08b348
|
Support Confuser 1.7 r73479 methods encrypter
|
2012-08-03 23:30:31 +02:00 |
|
de4dot
|
00d27a89f6
|
Support Confuser 1.7 r73477 compressor
|
2012-08-03 22:55:11 +02:00 |
|
de4dot
|
2c33d80ccc
|
Support netmodules
|
2012-08-03 20:24:14 +02:00 |
|
de4dot
|
1646786bc5
|
Fix bug in reading code + extra sections
|
2012-08-03 19:36:40 +02:00 |
|
de4dot
|
c913b6929a
|
Support Confuser 1.7 r73477 methods encrypter
|
2012-08-03 00:28:28 +02:00 |
|
de4dot
|
642b59667c
|
Move key init code to a new method
|
2012-08-02 22:08:29 +02:00 |
|
de4dot
|
b333cc32da
|
Rename arg
|
2012-08-02 21:57:47 +02:00 |
|
de4dot
|
4800755e47
|
Merge branch 'master' into confuser
|
2012-08-02 19:53:36 +02:00 |
|
de4dot
|
b455ae8dab
|
Fix arg name
|
2012-08-02 19:53:30 +02:00 |
|
de4dot
|
c4608df16f
|
Support Confuser 1.7 r73404 compressor
|
2012-08-02 19:53:15 +02:00 |
|
de4dot
|
343ed177bb
|
Support Confuser 1.7 r73404 constants encrypter
|
2012-08-02 19:14:35 +02:00 |
|
de4dot
|
7a77421c0e
|
Move method
|
2012-08-02 19:13:42 +02:00 |
|
de4dot
|
13420b80eb
|
Support Confuser 1.7 r73404 resource encrypter
|
2012-08-02 18:26:01 +02:00 |
|
de4dot
|
b5ef7a7b12
|
Rename proxy class to ...V10
|
2012-08-02 17:23:16 +02:00 |
|
de4dot
|
1f4ec139db
|
Support Confuser 1.7 r73404 methods encrypter
|
2012-08-02 17:01:14 +02:00 |
|
de4dot
|
e1758ddbb0
|
Support Confuser 1.6 r71742 methods decrypter
|
2012-08-02 11:12:20 +02:00 |
|
de4dot
|
8473253aa6
|
Support Confuser 1.5 r60785 compressor
|
2012-08-02 08:40:52 +02:00 |
|
de4dot
|
3d28201159
|
Add support for Confuser 1.5 r60785 constants encrypter (dynamic mode)
|
2012-08-02 08:11:21 +02:00 |
|
de4dot
|
1f9514e168
|
Move const reader and decrypt method
|
2012-08-02 08:08:50 +02:00 |
|
de4dot
|
1d5b341ed6
|
Return if invalid index
|
2012-08-02 08:07:26 +02:00 |
|
de4dot
|
6e262eb621
|
Add support for Confuser 1.5 r60785 constants encrypter (normal mode)
|
2012-08-01 22:38:57 +02:00 |
|
de4dot
|
d888ffd8e5
|
Merge branch 'master' into confuser
|
2012-08-01 22:20:47 +02:00 |
|
de4dot
|
e496cea7da
|
Add an option to remove a present unbox.any instr
|
2012-08-01 22:20:35 +02:00 |
|
de4dot
|
b45060d35a
|
Add RIP comment
|
2012-08-01 18:10:15 +02:00 |
|
de4dot
|
7f3399a9c4
|
Remove unreachable code
|
2012-08-01 18:09:58 +02:00 |
|
de4dot
|
4a3104963c
|
Fix cast
|
2012-08-01 18:09:24 +02:00 |
|
de4dot
|
d3c75288e7
|
Support Confuser 1.5a r59014 methods decrypter
|
2012-08-01 15:00:47 +02:00 |
|
de4dot
|
11ff8a55b1
|
Support Confuser 1.4 r58857 proxy methods
|
2012-08-01 14:24:45 +02:00 |
|
de4dot
|
910472ad04
|
Support Confuser 1.4 r58852 compressor
|
2012-08-01 14:05:29 +02:00 |
|
de4dot
|
99f0f8f480
|
Don't return main asm if it hasn't been unpacked
|
2012-08-01 13:48:41 +02:00 |
|
de4dot
|
4a6c6fee68
|
Update method name
|
2012-08-01 13:37:43 +02:00 |
|
de4dot
|
60cc3c7909
|
Update detection of key
|
2012-08-01 13:36:12 +02:00 |
|
de4dot
|
7e19539a61
|
Add code to handle an obfuscator bug
|
2012-08-01 13:03:36 +02:00 |
|
de4dot
|
b60eca8ae2
|
Add an option to only dump the main embedded asm
|
2012-08-01 12:37:26 +02:00 |
|
de4dot
|
002da4602a
|
Support Confuser 1.4 r58802 compressor and dump embedded asms
|
2012-08-01 11:41:31 +02:00 |
|
de4dot
|
8477e79b88
|
Move code to ConfuserUtils
|
2012-08-01 11:40:15 +02:00 |
|
de4dot
|
7b3cb1e007
|
Support Confuser 1.4 r58802 method proxies
|
2012-08-01 10:01:26 +02:00 |
|
de4dot
|
6953760ffc
|
Change Confuser type from cn to cr
'cr' is what the author of Confuser uses.
|
2012-08-01 09:18:06 +02:00 |
|
de4dot
|
17db2d332e
|
Support Confuser 1.4 r58802 string decrypter
|
2012-08-01 09:13:47 +02:00 |
|
de4dot
|
c2d56bd8d1
|
Fix compatibility with later v1.9 decrypter
|
2012-08-01 09:11:25 +02:00 |
|
de4dot
|
c652d49353
|
Remove Confuser 1.4 r58564 anti dumping type
|
2012-07-31 20:05:52 +02:00 |
|
de4dot
|
3e49c0bfa5
|
Support Confuser 1.4 r58564 compressor
|
2012-07-31 19:56:10 +02:00 |
|
de4dot
|
d99133658c
|
Support Confuser 1.4 r58564 proxy methods
|
2012-07-31 19:12:35 +02:00 |
|
de4dot
|
2a96ec9958
|
Support Confuser 1.4 r58564 methods encrypter
|
2012-07-31 17:17:16 +02:00 |
|
de4dot
|
17495e986f
|
Support Confuser 1.4 r58004 methods encrypter
|
2012-07-31 15:03:18 +02:00 |
|
de4dot
|
433a0d2b0a
|
Check for encrypted methods in moduleReloaded()
|
2012-07-31 14:25:40 +02:00 |
|
de4dot
|
a4be159b44
|
Support Confuser 1.4 r57884 methods encrypter
|
2012-07-31 14:24:49 +02:00 |
|
de4dot
|
9db8fc86a7
|
Merge branch 'master' into confuser
|
2012-07-31 12:51:33 +02:00 |
|
de4dot
|
9cbbea2c01
|
Use a better resource key
|
2012-07-31 12:50:55 +02:00 |
|
de4dot
|
c005ab2998
|
Check for div by zero
|
2012-07-31 12:43:23 +02:00 |
|
de4dot
|
ab04a72990
|
Update version number
|
2012-07-31 12:42:41 +02:00 |
|
de4dot
|
995e836fd8
|
Remove Confuser 1.3 r57588 anti debug method
|
2012-07-31 10:52:25 +02:00 |
|
de4dot
|
bb9e4cbf26
|
Remove resources with an invalid RVA
|
2012-07-31 10:41:20 +02:00 |
|
de4dot
|
4b2da13972
|
Decrypt encrypted strings resource before initializing string decrypter
|
2012-07-31 10:09:45 +02:00 |
|
de4dot
|
f370824a46
|
Make sure we only decrypt resources once
|
2012-07-31 10:08:46 +02:00 |
|
de4dot
|
b517755607
|
Support Confuser 1.3 r55802 resource encrypter
|
2012-07-31 10:00:46 +02:00 |
|
de4dot
|
a2038f348e
|
Support Confuser 1.3 r42915 "safe" string decrypter
|
2012-07-31 09:14:06 +02:00 |
|
de4dot
|
be9c95a759
|
Support Confuser 1.3 r55346's latest proxy methods code
|
2012-07-31 07:30:21 +02:00 |
|
de4dot
|
1f2de674f7
|
Support an updated Confuser proxy methods code
|
2012-07-31 07:15:38 +02:00 |
|
de4dot
|
4c5f955953
|
Merge branch 'master' into confuser
|
2012-07-31 07:13:25 +02:00 |
|
de4dot
|
dace82cca9
|
Add find2() method for derived classes
|
2012-07-31 07:13:07 +02:00 |
|
de4dot
|
4f4af7a44a
|
Support newer Confuser 1.0 and 1.1 string decrypters
|
2012-07-31 05:47:49 +02:00 |
|
de4dot
|
afb205aeea
|
Update detection of compressor
|
2012-07-31 04:44:45 +02:00 |
|
de4dot
|
83706f40a8
|
Update proxy fixer v1
|
2012-07-31 04:44:30 +02:00 |
|
de4dot
|
ed9849313a
|
Merge branch 'master' into confuser
|
2012-07-31 04:41:09 +02:00 |
|
de4dot
|
329efd9a0f
|
Add code to let a derived class to push new values
|
2012-07-31 04:40:45 +02:00 |
|
de4dot
|
87a8052cbe
|
Declaring type is null if it's already been removed
|
2012-07-31 04:40:06 +02:00 |
|
de4dot
|
1683c3ac1b
|
Update constants folder to support r8 values
|
2012-07-31 01:16:50 +02:00 |
|
de4dot
|
312a2fe063
|
Merge branch 'master' into confuser
|
2012-07-31 01:15:52 +02:00 |
|
de4dot
|
06b7374276
|
Add support for reading r8 values. Also rename some methods
|
2012-07-31 01:14:38 +02:00 |
|
de4dot
|
e657db9c8c
|
Support methods proxy in Confuser 1.0 r48717
|
2012-07-30 18:00:00 +02:00 |
|
de4dot
|
4a6713b728
|
Update detection of proxy fixer
|
2012-07-30 17:57:24 +02:00 |
|
de4dot
|
2e99bac40c
|
Unpack compressed Confuser assemblies
|
2012-07-30 14:11:04 +02:00 |
|
de4dot
|
7321e51a78
|
Decrypt Confuser 1.0 encrypted strings
|
2012-07-30 10:28:11 +02:00 |
|
de4dot
|
833a4bdd42
|
Merge branch 'master' into confuser
|
2012-07-30 09:19:25 +02:00 |
|
de4dot
|
85ce802131
|
Add Confuser 1.0 proxy call fixer
|
2012-07-30 09:19:17 +02:00 |
|
de4dot
|
83b805adc3
|
Move methods
|
2012-07-30 09:17:22 +02:00 |
|
de4dot
|
1e7be5c619
|
Make method static
|
2012-07-30 09:13:51 +02:00 |
|
de4dot
|
b33c2834df
|
Don't deobfuscate cflow unless the method sig is void name()
|
2012-07-30 09:13:17 +02:00 |
|
de4dot
|
fb47689f58
|
Decrypt Confuser encrypted methods (memory)
|
2012-07-29 20:04:35 +02:00 |
|
de4dot
|
0eaa1466fb
|
Move common code to a base class
|
2012-07-29 20:02:12 +02:00 |
|
de4dot
|
5b026a0d05
|
Add null check
|
2012-07-29 14:26:57 +02:00 |
|
de4dot
|
e225a342ae
|
Support type=dynamic const decryption
|
2012-07-29 14:23:27 +02:00 |
|
de4dot
|
5d1aefec16
|
Merge branch 'master' into confuser
|
2012-07-29 14:21:45 +02:00 |
|
de4dot
|
de8090df61
|
Add setConstant methods
|
2012-07-29 14:21:13 +02:00 |
|
de4dot
|
f20b2e648b
|
Fix detection when numeric const encryption is enabled
|
2012-07-29 13:24:50 +02:00 |
|
de4dot
|
892116ad63
|
Add ConstantsInliner class
|
2012-07-29 13:22:36 +02:00 |
|
de4dot
|
7c4994f624
|
Merge branch 'master' into confuser
|
2012-07-29 13:21:03 +02:00 |
|
de4dot
|
c3c1ab64d8
|
Add setDeobfuscator() method
|
2012-07-29 13:19:12 +02:00 |
|
de4dot
|
2274ceeee4
|
Support the normal const decrypter
|
2012-07-29 10:17:05 +02:00 |
|
de4dot
|
24337f2a70
|
Merge branch 'master' into confuser
|
2012-07-29 09:49:55 +02:00 |
|
de4dot
|
f07f664553
|
Don't cast to a possible value type when result can be null
|
2012-07-29 09:49:00 +02:00 |
|
de4dot
|
ae63a63d20
|
Remove unecessary code
|
2012-07-28 21:28:27 +02:00 |
|
de4dot
|
db5c6fcf26
|
Decrypt Confuser encrypted constants
|
2012-07-28 04:45:27 +02:00 |
|
de4dot
|
b2ad946425
|
Merge branch 'master' into confuser
|
2012-07-28 04:39:30 +02:00 |
|
de4dot
|
cb6a3ac503
|
Support generic decrypter methods
|
2012-07-28 04:39:14 +02:00 |
|
de4dot
|
839684685e
|
Assume invalid code so check for null
|
2012-07-27 21:38:03 +02:00 |
|
de4dot
|
685d2c2ef0
|
Print a message if MethodData isn't encrypted
|
2012-07-27 21:35:55 +02:00 |
|
de4dot
|
6a15bfeee7
|
Decrypt Confuser encrypted resources
|
2012-07-27 12:49:00 +02:00 |
|
de4dot
|
471628b843
|
Update exception string
|
2012-07-27 09:21:03 +02:00 |
|
de4dot
|
16e6a986c7
|
Remove ConfusedByAttribute type
|
2012-07-27 08:50:58 +02:00 |
|
de4dot
|
872b4f61a2
|
Remove anti dumper type
|
2012-07-27 08:47:37 +02:00 |
|
de4dot
|
4840a117cf
|
Remove anti debugger type
|
2012-07-27 08:40:21 +02:00 |
|
de4dot
|
38d94819ee
|
Remove method decrypter type and init method call
|
2012-07-27 08:23:55 +02:00 |
|
de4dot
|
74970e80ff
|
Add Confuser proxy fixer
|
2012-07-27 08:11:23 +02:00 |
|
de4dot
|
a48a03b9ab
|
Move methods to ConfuserUtils
|
2012-07-27 08:07:17 +02:00 |
|
de4dot
|
135dcd5a3c
|
Merge branch 'master' into confuser
|
2012-07-27 08:03:30 +02:00 |
|
de4dot
|
e88479f71d
|
Add OtherMethods prop
|
2012-07-27 08:03:02 +02:00 |
|
de4dot
|
3abb8de345
|
getFieldToMethodDictionary() is now a non-virtual method
|
2012-07-27 07:57:13 +02:00 |
|
de4dot
|
70bd973cdd
|
Decrypt Confuser 1.9 encrypted JIT methods
|
2012-07-26 20:12:12 +02:00 |
|
de4dot
|
1a1ccb2121
|
Update code since GetUserString() arg is now a token
|
2012-07-26 20:07:27 +02:00 |
|
de4dot
|
bbd41a549c
|
Add MD5 and SHA256 sum methods
|
2012-07-26 16:35:28 +02:00 |
|
de4dot
|
5fc6e1ac75
|
Add method to get a 64-bit int
|
2012-07-25 21:06:35 +02:00 |
|
de4dot
|
423c33a9f2
|
Append 32 to 32-bit methods and fields
|
2012-07-25 20:48:06 +02:00 |
|
de4dot
|
e2ec6548ed
|
Add more ctors and add EmulateConvInstructions prop
|
2012-07-25 20:43:22 +02:00 |
|
de4dot
|
a815a70415
|
Rename arrays
|
2012-07-24 19:58:00 +02:00 |
|
de4dot
|
880441571e
|
Update class comment
|
2012-07-24 19:52:34 +02:00 |
|
de4dot
|
c31e6c2c3d
|
Main embedded asm doesn't always have the same asm name as the original asm
|
2012-07-24 19:05:50 +02:00 |
|
de4dot
|
e1f8793302
|
Add option to disable decrypting main embedded assembly
|
2012-07-24 18:52:39 +02:00 |
|
de4dot
|
490ce203b6
|
Update invalid name regex
|
2012-07-24 18:13:18 +02:00 |
|
de4dot
|
e54b026ae7
|
Make the embedded (original) start up assembly the new decrypted assembly
|
2012-07-24 17:49:04 +02:00 |
|
de4dot
|
4374a08020
|
getDecryptedModule() can now be called multiple times
|
2012-07-24 17:02:27 +02:00 |
|
de4dot
|
c8477bdbce
|
Print a warning and use default encoding if the code page doesn't exist
|
2012-07-23 13:19:04 +02:00 |
|
de4dot
|
8a81e98b3f
|
Fix invalid Mvid
|
2012-07-23 13:15:32 +02:00 |
|
de4dot
|
6c04a950e7
|
Remove duplicate resources
|
2012-07-23 10:22:39 +02:00 |
|
de4dot
|
b03cb46f53
|
Rename class
|
2012-07-23 10:08:13 +02:00 |
|
de4dot
|
ebbc8d2ab8
|
Remove encoding arg
|
2012-07-23 10:04:40 +02:00 |
|
de4dot
|
74aaf19257
|
Support the latest CO build
|
2012-07-22 20:35:33 +02:00 |
|
de4dot
|
2320c458cf
|
Check for null (invalid method ref in call instr)
|
2012-07-21 23:13:34 +02:00 |
|
de4dot
|
762e043236
|
Merge branch 'co' into new_code
Conflicts:
de4dot.code/de4dot.code.csproj
de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs
|
2012-07-21 12:14:04 +02:00 |
|
de4dot
|
940aa20534
|
Merge branch 'master' into new_code
Conflicts:
de4dot.code/de4dot.code.csproj
|
2012-07-21 11:24:32 +02:00 |
|
de4dot
|
fd9d4a40cc
|
Support another MC runtime
|
2012-07-21 11:13:59 +02:00 |
|
de4dot
|
e05bfc9c8a
|
Decrypt strings
|
2012-07-20 21:54:56 +02:00 |
|
de4dot
|
dfafc4a94b
|
Remove useless method
|
2012-07-20 18:32:49 +02:00 |
|
de4dot
|
9b48632354
|
Refactor
|
2012-07-20 18:15:40 +02:00 |
|
de4dot
|
8b82f8b47d
|
Support the latest MC versions
|
2012-07-20 14:49:47 +02:00 |
|
de4dot
|
1eaa9f8c51
|
Add verify methods
|
2012-07-20 14:48:19 +02:00 |
|
de4dot
|
d9b3a81ba9
|
Add little endian encrypt/decrypt methods
|
2012-07-20 14:47:55 +02:00 |
|
de4dot
|
9b71da3633
|
Remove call to InitializeArray
|
2012-07-18 14:39:27 +02:00 |
|
de4dot
|
d0712b46aa
|
Update detection of resource resolver class
|
2012-07-16 20:00:37 +02:00 |
|
de4dot
|
6766c10969
|
Split array state into a new class
|
2012-07-16 19:59:50 +02:00 |
|
de4dot
|
ca65972c64
|
Add a force option to deobfuscate() method
|
2012-07-16 18:02:32 +02:00 |
|
de4dot
|
2aa3c8aaea
|
Add constants decrypter
|
2012-07-11 08:05:06 +02:00 |
|
de4dot
|
8f2f2f46ce
|
Support latest CO build
|
2012-07-11 02:15:33 +02:00 |
|
de4dot
|
9f8cac4dac
|
Fix #56
|
2012-07-08 08:14:36 +02:00 |
|
de4dot
|
598529a039
|
Support calli instruction
|
2012-07-08 04:18:26 +02:00 |
|
de4dot
|
16d5a31640
|
Create a SentinelType
|
2012-07-08 03:50:50 +02:00 |
|
de4dot
|
1581ec959d
|
Merge branch 'master' into new_code
|
2012-07-07 19:35:54 +02:00 |
|
de4dot
|
1867a06e84
|
Continue if same method
|
2012-07-07 09:09:55 +02:00 |
|
de4dot
|
ad6c6401b9
|
Support VS2008
|
2012-07-07 07:16:55 +02:00 |
|
de4dot
|
e440270a63
|
Fix proxy calls
|
2012-07-07 01:59:03 +02:00 |
|
de4dot
|
0a5764a093
|
Change method to take a ref to a type
|
2012-07-07 00:58:18 +02:00 |
|
de4dot
|
02c89550cb
|
Update the counter
|
2012-07-05 23:19:37 +02:00 |
|
de4dot
|
d5c8f6842a
|
Update log string
|
2012-07-02 21:49:59 +02:00 |
|
de4dot
|
8a34b6e015
|
Make method static
|
2012-07-02 21:49:45 +02:00 |
|
de4dot
|
b9e88972ae
|
Support latest CO build
|
2012-07-02 14:26:00 +02:00 |
|
de4dot
|
23697e2c00
|
Support ILP 1.0.5
|
2012-07-01 16:23:51 +02:00 |
|
de4dot
|
4c5fa3e809
|
Remove ILP detection
|
2012-06-27 15:19:09 +02:00 |
|
de4dot
|
4236514691
|
Merge branch 'ilp' into new_code
|
2012-06-27 15:15:55 +02:00 |
|
de4dot
|
a2baf1fdea
|
Merge branch 'master' into new_code
|
2012-06-27 15:15:03 +02:00 |
|
de4dot
|
4dce00b35a
|
Merge branch 'rummage' into new_code
Conflicts:
de4dot.cui/Program.cs
|
2012-06-27 15:14:40 +02:00 |
|
de4dot
|
12797ecb03
|
Support latest CO build
|
2012-06-27 10:45:45 +02:00 |
|
de4dot
|
cd0a193bdf
|
Support latest AN build
|
2012-06-27 10:27:16 +02:00 |
|
de4dot
|
d1259460e3
|
Update detection of decrypter constants. Fixes #59
|
2012-06-25 01:14:26 +02:00 |
|
de4dot
|
fa594c6213
|
Add better BL support
|
2012-06-12 11:15:19 +02:00 |
|
de4dot
|
4a29eae1c8
|
Add more inflate() overloads
|
2012-06-11 21:20:14 +02:00 |
|
de4dot
|
b964996388
|
Support Babel.NET 5.5
|
2012-06-06 21:16:32 +02:00 |
|
de4dot
|
a8bf74ca78
|
Support Rummage
|
2012-06-06 11:40:48 +02:00 |
|
de4dot
|
6d675fea54
|
Add XTEA decrypter
|
2012-06-06 11:39:48 +02:00 |
|
de4dot
|
3264bfc5cd
|
Support latest CO build
|
2012-06-04 09:51:07 +02:00 |
|
de4dot
|
5567c9a06a
|
Warn if strings resource couldn't be found
|
2012-06-04 06:34:32 +02:00 |
|
de4dot
|
3582b773ca
|
Support ILP
|
2012-06-04 05:02:46 +02:00 |
|
de4dot
|
27a91f5942
|
Change parameters type from [] to IList
|
2012-06-04 03:55:25 +02:00 |
|
de4dot
|
286462db4b
|
Move file
|
2012-06-03 19:08:46 +02:00 |
|
de4dot
|
b844dbc428
|
Detect ILP
|
2012-06-02 20:56:36 +02:00 |
|
de4dot
|
bff92e02e7
|
Remove unused method
|
2012-06-02 17:32:05 +02:00 |
|
de4dot
|
ec8139f640
|
Refactor code and support latest AN build
|
2012-06-02 07:26:21 +02:00 |
|
de4dot
|
a25f4f4640
|
Remove proxy methods type and make sure all proxy methods are inlined
|
2012-06-02 03:33:21 +02:00 |
|
de4dot
|
3c99e8d0d6
|
Update valid name regex
|
2012-06-01 12:53:03 +02:00 |
|
de4dot
|
6696c26496
|
Assembly resolver init method is sometimes only called from Main()
|
2012-06-01 12:40:16 +02:00 |
|
de4dot
|
d091564d85
|
Fix ToString(). Should separate generic args with commas
|
2012-06-01 12:05:01 +02:00 |
|
de4dot
|
cd2851baf4
|
Add an option to disable dumping embedded assemblies
|
2012-06-01 12:01:45 +02:00 |
|
de4dot
|
58b62ff914
|
Decrypt main assembly and embedded assemblies
|
2012-06-01 11:53:54 +02:00 |
|
de4dot
|
96f9f4154d
|
Decrypt CF encrypted strings
|
2012-05-29 20:20:11 +02:00 |
|
de4dot
|
9b591c68d3
|
Fix CF proxy calls
|
2012-05-29 19:14:41 +02:00 |
|
de4dot
|
512c650e11
|
Add another proxy call fixer class
|
2012-05-29 19:13:43 +02:00 |
|
de4dot
|
24d1c5182b
|
Update comment
|
2012-05-29 19:07:01 +02:00 |
|
de4dot
|
58adda95b6
|
getAllBlocks() now returns a List instead of an IList
|
2012-05-29 19:06:41 +02:00 |
|
de4dot
|
7b3dcf8e05
|
Refactor proxy call fixer classes
|
2012-05-29 11:13:39 +02:00 |
|
de4dot
|
1b569a0d24
|
Support MPRESS
|
2012-05-28 18:00:29 +02:00 |
|
de4dot
|
3e6a259e8f
|
Add 50 more points if methods decrypter is detected
|
2012-05-27 07:43:26 +02:00 |
|
de4dot
|
c441a60372
|
Print CW version number
|
2012-05-27 07:00:13 +02:00 |
|
de4dot
|
eebb090827
|
Support old CW 2.x
|
2012-05-27 02:31:53 +02:00 |
|
de4dot
|
06a30473da
|
Decrypt strings encrypted with older CW version
|
2012-05-26 20:20:11 +02:00 |
|
de4dot
|
adaf41c769
|
Decrypt embedded assemblies
|
2012-05-26 17:41:08 +02:00 |
|
de4dot
|
3a96ae391a
|
Move common resolver handler detector code to DeobUtils
|
2012-05-26 17:33:26 +02:00 |
|
de4dot
|
dbd7affaa8
|
Update valid name regex
|
2012-05-26 14:40:51 +02:00 |
|
de4dot
|
f1c8549066
|
Decrypt CW encrypted strings
|
2012-05-26 14:38:08 +02:00 |
|
de4dot
|
20452fe964
|
Decrypt CW encrypted methods
|
2012-05-26 05:26:00 +02:00 |
|
de4dot
|
c48b2d92c2
|
Support AN 6.0.0.5 (new build, same version)
|
2012-05-19 08:59:13 +02:00 |
|
de4dot
|
c3cdf95fcf
|
Support AN 6.0.0.5
|
2012-05-15 19:05:47 +02:00 |
|
de4dot
|
654ebf652e
|
Merge branch 'ds'
|
2012-05-12 21:40:01 +02:00 |
|
de4dot
|
bec6725aa7
|
Rename option
|
2012-05-12 21:39:49 +02:00 |
|
de4dot
|
40898cf238
|
Decrypt embedded assemblies (SL)
|
2012-05-11 19:38:31 +02:00 |
|
de4dot
|
ce3622f6e8
|
Use the correct variable
|
2012-05-11 18:18:19 +02:00 |
|
de4dot
|
94ee4064ed
|
Remove namespace prefix
|
2012-05-11 18:17:51 +02:00 |
|
de4dot
|
cd014f1d72
|
Update fields restorer
|
2012-05-10 20:20:29 +02:00 |
|
de4dot
|
0b47ccf070
|
Remove cflow obfuscation arrays
|
2012-05-10 18:38:27 +02:00 |
|
de4dot
|
ae7e32ae5b
|
Remove decrypt method and other init method
|
2012-05-10 13:39:14 +02:00 |
|
de4dot
|
c5f8aaeb1a
|
Dump 4.1 embedded assemblies
|
2012-05-09 22:24:39 +02:00 |
|
de4dot
|
ee32b84283
|
Move code to DsUtils
|
2012-05-09 22:20:17 +02:00 |
|
de4dot
|
9b9e692947
|
Move version specific data to their own class
|
2012-05-09 19:10:20 +02:00 |
|
de4dot
|
dadc064b55
|
Decrypt V4.1 resources
|
2012-05-09 19:00:21 +02:00 |
|
de4dot
|
1aaa5df9ce
|
Support trial string encrypter
|
2012-05-09 17:30:35 +02:00 |
|
de4dot
|
e5a64a4402
|
Remove more XC attributes
|
2012-05-06 13:07:34 +02:00 |
|
de4dot
|
b27e1b36af
|
Add option to disable cast deobfuscation
|
2012-05-03 16:51:36 +02:00 |
|
de4dot
|
ea205dcae8
|
Add option to disable renaming resource keys
|
2012-05-03 16:48:03 +02:00 |
|
de4dot
|
955c1f10bd
|
Rename resource keys
|
2012-05-03 16:47:34 +02:00 |
|
de4dot
|
83725200c1
|
Add isValidResourceKeyName()
|
2012-05-03 14:53:01 +02:00 |
|
de4dot
|
83dc4226c1
|
Make sure string decrypter methods aren't detected as inlined methods
|
2012-05-03 09:51:26 +02:00 |
|
de4dot
|
fb9e217dac
|
Add a cast deobfuscator
|
2012-05-03 08:01:35 +02:00 |
|
de4dot
|
c61161be1d
|
Ignore method attributes
|
2012-05-02 18:43:57 +02:00 |
|
de4dot
|
597fcb0210
|
Cflow deob methods
|
2012-05-02 13:51:07 +02:00 |
|
de4dot
|
e8049c6a05
|
Inline some obfuscated methods
|
2012-05-02 10:48:44 +02:00 |
|
de4dot
|
db14e73369
|
Make sure index is correct, and add method to read arg constants
|
2012-05-02 10:47:21 +02:00 |
|
de4dot
|
b15b581c46
|
Deobfuscate string decrypter cctor
|
2012-04-30 21:47:23 +02:00 |
|
de4dot
|
2594317b18
|
Use other sb ctor
|
2012-04-30 12:49:43 +02:00 |
|
de4dot
|
1805e352c4
|
Disable using unknown args by default
|
2012-04-30 12:18:47 +02:00 |
|
de4dot
|
f307520e62
|
Decrypt DS 4.1 strings
|
2012-04-30 08:33:05 +02:00 |
|
de4dot
|
e29a8ea692
|
Update cflow deobfuscator
|
2012-04-30 01:29:05 +02:00 |
|
de4dot
|
6b18d70e77
|
Move common code to another class
|
2012-04-30 01:26:34 +02:00 |
|
de4dot
|
83b14da5c8
|
Refactor: create common cflow deob iface
|
2012-04-29 23:51:04 +02:00 |
|
de4dot
|
920f079855
|
Set initlocals and add an option to disable it
|
2012-04-29 06:16:53 +02:00 |
|
de4dot
|
eb17298625
|
Move the field
|
2012-04-29 04:35:58 +02:00 |
|
de4dot
|
48b9c461f5
|
Restore calls to CodeDomProvider and ICodeCompiler
|
2012-04-29 04:03:10 +02:00 |
|
de4dot
|
9333e2415c
|
Rename class
|
2012-04-29 00:56:17 +02:00 |
|
de4dot
|
e548436ede
|
Restore calls to Icon/Bitmap .ctor
|
2012-04-29 00:51:09 +02:00 |
|
de4dot
|
b92b23df4a
|
Rename class and make it more general
|
2012-04-29 00:11:28 +02:00 |
|
de4dot
|
f9c78f8a8b
|
Decrypt CS 1.x encrypted methods
|
2012-04-28 08:50:37 +02:00 |
|
de4dot
|
03e2e621ea
|
Update detection of resource resolver type
|
2012-04-26 20:50:06 +02:00 |
|
de4dot
|
9754b01ba9
|
Merge branch 'master' into cs
|
2012-04-26 19:33:28 +02:00 |
|
de4dot
|
7a0804e035
|
Remove module references to the CS RT files
|
2012-04-26 17:14:54 +02:00 |
|
de4dot
|
7e5e7ddcd2
|
Find old string decrypter method
|
2012-04-26 16:53:52 +02:00 |
|
de4dot
|
67c866491d
|
Show the correct obfuscator name
|
2012-04-26 16:33:55 +02:00 |
|
de4dot
|
6f830b8329
|
Remove all obfuscator attributes
|
2012-04-26 16:23:07 +02:00 |
|
de4dot
|
aa6e7c0fc2
|
Add addAttributesToBeRemoved()
|
2012-04-26 16:08:39 +02:00 |
|
de4dot
|
960f934c67
|
Update detection of CS type
|
2012-04-26 14:46:22 +02:00 |
|
de4dot
|
e10dce2d95
|
Check for 32-bit or 64-bit method
|
2012-04-26 02:31:31 +02:00 |
|
de4dot
|
5b97faf2dd
|
Detect CS type when strings are encrypted, but methods aren't
|
2012-04-26 01:56:59 +02:00 |
|
de4dot
|
ab60692c2f
|
Return the correct return value
|
2012-04-26 01:48:59 +02:00 |
|
de4dot
|
d84d2e6a6c
|
Update CS detector and support an old string decrypter
|
2012-04-26 01:42:10 +02:00 |
|
de4dot
|
bff017a317
|
Throw InvalidMethodBody if IOException
|
2012-04-25 18:06:27 +02:00 |
|
de4dot
|
903db59827
|
Restore CS 3.0 "encrypted" methods
|
2012-04-25 13:49:22 +02:00 |
|
de4dot
|
4e89d707dc
|
Move code to DeobUtils
|
2012-04-25 13:21:53 +02:00 |
|