/* Copyright (C) 2011 de4dot@gmail.com This file is part of de4dot. de4dot is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. de4dot is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with de4dot. If not, see . */ using System.Collections.Generic; using System.IO; using Mono.Cecil; using de4dot.blocks; namespace de4dot.code.deobfuscators.Babel_NET { class StringDecrypter { ModuleDefinition module; Dictionary offsetToString = new Dictionary(); TypeDefinition decrypterType; MethodDefinition decryptMethod; EmbeddedResource encryptedResource; public bool Detected { get { return decrypterType != null; } } public TypeDefinition Type { get { return decrypterType; } } public MethodDefinition DecryptMethod { get { return decryptMethod; } } public EmbeddedResource Resource { get { return encryptedResource; } } public StringDecrypter(ModuleDefinition module) { this.module = module; } public void find() { foreach (var type in module.Types) { if (!isDecrypterType(type)) continue; var method = DotNetUtils.getMethod(type, "System.String", "(System.Int32)"); if (method == null) continue; decrypterType = type; decryptMethod = method; return; } } bool isDecrypterType(TypeDefinition type) { if (type.HasEvents) return false; if (type.NestedTypes.Count != 1) return false; if (type.Fields.Count != 0) return false; var nested = type.NestedTypes[0]; if (nested.HasProperties || nested.HasEvents) return false; if (nested.Fields.Count != 1) return false; if (!MemberReferenceHelper.compareTypes(nested.Fields[0].FieldType, nested)) return false; if (DotNetUtils.getMethod(nested, "System.Reflection.Emit.MethodBuilder", "(System.Reflection.Emit.TypeBuilder)") == null) return false; if (DotNetUtils.getMethod(nested, "System.String", "(System.Int32)") == null) return false; return true; } public void initialize() { if (decrypterType == null) return; if (encryptedResource != null) return; encryptedResource = findResource(); if (encryptedResource == null) return; var decrypted = new ResourceDecrypter(module).decrypt(encryptedResource.GetResourceData()); var reader = new BinaryReader(new MemoryStream(decrypted)); while (reader.BaseStream.Position < reader.BaseStream.Length) offsetToString[(int)reader.BaseStream.Position] = reader.ReadString(); } EmbeddedResource findResource() { foreach (var method in decrypterType.Methods) { foreach (var s in DotNetUtils.getCodeStrings(method)) { var resource = DotNetUtils.getResource(module, s) as EmbeddedResource; if (resource != null) return resource; } } return null; } public string decrypt(int offset) { return offsetToString[offset]; } } }