/*
Copyright (C) 2011-2012 de4dot@gmail.com
This file is part of de4dot.
de4dot is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
de4dot is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with de4dot. If not, see .
*/
using System.Collections.Generic;
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.SmartAssembly {
class StringsEncoderInfo {
// SmartAssembly.HouseOfCards.Strings, the class that creates the string decrypter
// delegates
public TypeDef StringsType { get; set; }
public TypeDef GetStringDelegate { get; set; }
public MethodDef CreateStringDelegateMethod { get; set; }
// The class that decodes the strings. Called by the strings delegate or normal code.
public TypeDef StringDecrypterClass { get; set; }
}
class StringEncoderClassFinder {
ModuleDefMD module;
ISimpleDeobfuscator simpleDeobfuscator;
IList stringsEncoderInfos = new List();
public IList StringsEncoderInfos {
get { return stringsEncoderInfos; }
}
public StringEncoderClassFinder(ModuleDefMD module, ISimpleDeobfuscator simpleDeobfuscator) {
this.module = module;
this.simpleDeobfuscator = simpleDeobfuscator;
}
TypeDef getType(ITypeDefOrRef typeRef) {
return DotNetUtils.getType(module, typeRef);
}
public void find() {
findHouseOfCardsStrings_v2();
if (stringsEncoderInfos.Count == 0)
findHouseOfCardsStrings_v1();
findStringDecrypterClasses();
}
// Finds SmartAssembly.HouseOfCards.Strings. It's the class that creates the string
// decrypter delegates.
void findHouseOfCardsStrings_v2() {
foreach (var type in module.Types) {
if (type.Methods.Count != 1)
continue;
foreach (var method in DotNetUtils.findMethods(type.Methods, "System.Void", new string[] { "System.Type" })) {
if (checkDelegateCreatorMethod(type, method))
break;
}
}
}
void findHouseOfCardsStrings_v1() {
foreach (var type in module.Types) {
if (type.Methods.Count != 1)
continue;
foreach (var method in DotNetUtils.findMethods(type.Methods, "System.Void", new string[] { })) {
if (checkDelegateCreatorMethod(type, method))
break;
}
}
}
bool checkDelegateCreatorMethod(TypeDef type, MethodDef method) {
simpleDeobfuscator.deobfuscate(method);
var getStringDelegate = findGetStringDelegate(method);
if (getStringDelegate == null)
return false;
var stringDecrypterClass = findStringDecrypterClass(method);
if (stringDecrypterClass == null)
return false;
stringsEncoderInfos.Add(new StringsEncoderInfo {
StringsType = type,
GetStringDelegate = getStringDelegate,
StringDecrypterClass = stringDecrypterClass,
CreateStringDelegateMethod = method,
});
return true;
}
// Finds the SmartAssembly.Delegates.GetString delegate
TypeDef findGetStringDelegate(MethodDef stringsCreateDelegateMethod) {
if (!stringsCreateDelegateMethod.HasBody)
return null;
foreach (var ldtoken in stringsCreateDelegateMethod.Body.Instructions) {
if (ldtoken.OpCode.Code != Code.Ldtoken)
continue;
var typeToken = ldtoken.Operand as ITypeDefOrRef;
if (typeToken == null)
continue;
var delegateType = getType(typeToken);
if (!DotNetUtils.derivesFromDelegate(delegateType))
continue;
var invoke = delegateType.FindMethod("Invoke");
if (invoke == null || !DotNetUtils.isMethod(invoke, "System.String", "(System.Int32)"))
continue;
return delegateType;
}
return null;
}
// Finds the SmartAssembly.StringsEncoding.Strings class. This class decrypts the
// strings in the resources. It gets called by the SmartAssembly.Delegates.GetString
// delegate instances which were created by SmartAssembly.HouseOfCards.Strings.
TypeDef findStringDecrypterClass(MethodDef stringsCreateDelegateMethod) {
if (!stringsCreateDelegateMethod.HasBody)
return null;
foreach (var ldtoken in stringsCreateDelegateMethod.Body.Instructions) {
if (ldtoken.OpCode.Code != Code.Ldtoken)
continue;
var typeToken = ldtoken.Operand as ITypeDefOrRef;
if (typeToken == null)
continue;
var type = getType(typeToken);
if (type == null || DotNetUtils.derivesFromDelegate(type))
continue;
if (!couldBeStringDecrypterClass(type))
continue;
return type;
}
return null;
}
void findStringDecrypterClasses() {
var foundClasses = new Dictionary();
foreach (var info in stringsEncoderInfos)
foundClasses[info.StringDecrypterClass] = true;
foreach (var type in module.Types) {
if (!foundClasses.ContainsKey(type) && couldBeStringDecrypterClass(type)) {
stringsEncoderInfos.Add(new StringsEncoderInfo {
StringsType = null,
GetStringDelegate = null,
StringDecrypterClass = type,
});
}
}
}
static string[] fields1x = new string[] {
"System.IO.Stream",
};
static string[] fields2x = new string[] {
"System.IO.Stream",
"System.Int32",
};
static string[] fields3x = new string[] {
"System.Byte[]",
"System.Int32",
};
bool couldBeStringDecrypterClass(TypeDef type) {
var fields = new FieldTypes(type);
if (fields.exists("System.Collections.Hashtable") ||
fields.exists("System.Collections.Generic.Dictionary`2") ||
fields.exactly(fields3x)) {
if (type.FindStaticConstructor() == null)
return false;
}
else if (fields.exactly(fields1x) || fields.exactly(fields2x)) {
}
else
return false;
var methods = new List(DotNetUtils.getNormalMethods(type));
if (methods.Count != 1)
return false;
var method = methods[0];
if (!DotNetUtils.isMethod(method, "System.String", "(System.Int32)"))
return false;
if (!method.IsStatic || !method.HasBody)
return false;
return true;
}
}
}