/*
Copyright (C) 2011-2014 de4dot@gmail.com
This file is part of de4dot.
de4dot is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
de4dot is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with de4dot. If not, see .
*/
using System;
using System.Collections.Generic;
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CryptoObfuscator {
class ProxyCallFixer : ProxyCallFixer2 {
Dictionary methodToType = new Dictionary();
public ProxyCallFixer(ModuleDefMD module)
: base(module) {
}
enum ProxyCreatorType {
None,
CallOrCallvirt,
CallCtor,
Newobj,
}
class Context {
public uint typeToken;
public uint methodToken;
public uint declaringTypeToken;
public ProxyCreatorType proxyCreatorType;
public Context(uint typeToken, uint methodToken, uint declaringTypeToken, ProxyCreatorType proxyCreatorType) {
this.typeToken = typeToken;
this.methodToken = methodToken;
this.declaringTypeToken = declaringTypeToken;
this.proxyCreatorType = proxyCreatorType;
}
}
protected override object CheckCctor(TypeDef type, MethodDef cctor) {
var instructions = cctor.Body.Instructions;
for (int i = 0; i < instructions.Count; i++) {
var instrs = DotNetUtils.GetInstructions(instructions, i, OpCodes.Ldc_I4, OpCodes.Ldc_I4, OpCodes.Ldc_I4, OpCodes.Call);
if (instrs == null)
continue;
uint typeToken = (uint)(int)instrs[0].Operand;
uint methodToken = (uint)(int)instrs[1].Operand;
uint declaringTypeToken = (uint)(int)instrs[2].Operand;
var createMethod = instrs[3].Operand as MethodDef;
ProxyCreatorType proxyCreatorType;
if (!methodToType.TryGetValue(createMethod, out proxyCreatorType))
continue;
return new Context(typeToken, methodToken, declaringTypeToken, proxyCreatorType);
}
return null;
}
protected override void GetCallInfo(object context, FieldDef field, out IMethod calledMethod, out OpCode callOpcode) {
var ctx = (Context)context;
switch (ctx.proxyCreatorType) {
case ProxyCreatorType.CallOrCallvirt:
callOpcode = field.IsFamilyOrAssembly ? OpCodes.Callvirt : OpCodes.Call;
break;
case ProxyCreatorType.CallCtor:
callOpcode = OpCodes.Call;
break;
case ProxyCreatorType.Newobj:
callOpcode = OpCodes.Newobj;
break;
default:
throw new ApplicationException(string.Format("Invalid proxy creator type: {0}", ctx.proxyCreatorType));
}
calledMethod = module.ResolveToken(ctx.methodToken) as IMethod;
}
public void FindDelegateCreator() {
foreach (var type in module.Types) {
var createMethod = GetProxyCreateMethod(type);
if (createMethod == null)
continue;
var proxyCreatorType = GetProxyCreatorType(type, createMethod);
if (proxyCreatorType == ProxyCreatorType.None)
continue;
methodToType[createMethod] = proxyCreatorType;
SetDelegateCreatorMethod(createMethod);
}
}
MethodDef GetProxyCreateMethod(TypeDef type) {
if (DotNetUtils.FindFieldType(type, "System.ModuleHandle", true) == null)
return null;
if (type.Fields.Count < 1 || type.Fields.Count > 20)
return null;
MethodDef createMethod = null;
foreach (var m in type.Methods) {
if (m.Name == ".ctor" || m.Name == ".cctor")
continue;
if (createMethod == null && DotNetUtils.IsMethod(m, "System.Void", "(System.Int32,System.Int32,System.Int32)")) {
createMethod = m;
continue;
}
continue;
}
if (createMethod == null || !createMethod.HasBody)
return null;
if (!DeobUtils.HasInteger(createMethod, 0xFFFFFF))
return null;
return createMethod;
}
ProxyCreatorType GetProxyCreatorType(TypeDef type, MethodDef createMethod) {
int numCalls = 0, numCallvirts = 0, numNewobjs = 0;
foreach (var instr in createMethod.Body.Instructions) {
if (instr.OpCode.Code != Code.Ldsfld)
continue;
var field = instr.Operand as IField;
if (field == null)
continue;
switch (field.FullName) {
case "System.Reflection.Emit.OpCode System.Reflection.Emit.OpCodes::Call":
numCalls++;
break;
case "System.Reflection.Emit.OpCode System.Reflection.Emit.OpCodes::Callvirt":
numCallvirts++;
break;
case "System.Reflection.Emit.OpCode System.Reflection.Emit.OpCodes::Newobj":
numNewobjs++;
break;
}
}
if (numCalls == 1 && numCallvirts == 1 && numNewobjs == 0)
return ProxyCreatorType.CallOrCallvirt;
if (numCalls == 1 && numCallvirts == 0 && numNewobjs == 0)
return ProxyCreatorType.CallCtor;
if (numCalls == 0 && numCallvirts == 0 && numNewobjs == 1)
return ProxyCreatorType.Newobj;
return ProxyCreatorType.None;
}
}
}