de4dot-cex/de4dot.code/deobfuscators/SmartAssembly/StringEncoderClassFinder.cs

/*
    Copyright (C) 2011-2012 de4dot@gmail.com

    This file is part of de4dot.

    de4dot is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    de4dot is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with de4dot.  If not, see <http://www.gnu.org/licenses/>.
*/

using System.Collections.Generic;
using dot10.DotNet;
using dot10.DotNet.Emit;
using de4dot.blocks;

namespace de4dot.code.deobfuscators.SmartAssembly {
	class StringsEncoderInfo {
		// SmartAssembly.HouseOfCards.Strings, the class that creates the string decrypter
		// delegates
		public TypeDef StringsType { get; set; }
		public TypeDef GetStringDelegate { get; set; }
		public MethodDef CreateStringDelegateMethod { get; set; }

		// The class that decodes the strings. Called by the strings delegate or normal code.
		public TypeDef StringDecrypterClass { get; set; }
	}

	class StringEncoderClassFinder {
		ModuleDefMD module;
		ISimpleDeobfuscator simpleDeobfuscator;
		IList<StringsEncoderInfo> stringsEncoderInfos = new List<StringsEncoderInfo>();

		public IList<StringsEncoderInfo> StringsEncoderInfos {
			get { return stringsEncoderInfos; }
		}

		public StringEncoderClassFinder(ModuleDefMD module, ISimpleDeobfuscator simpleDeobfuscator) {
			this.module = module;
			this.simpleDeobfuscator = simpleDeobfuscator;
		}

		TypeDef getType(ITypeDefOrRef typeReference) {
			return DotNetUtils.getType(module, typeReference);
		}

		public void find() {
			findHouseOfCardsStrings_v2();
			if (stringsEncoderInfos.Count == 0)
				findHouseOfCardsStrings_v1();

			findStringDecrypterClasses();
		}

		// Finds SmartAssembly.HouseOfCards.Strings. It's the class that creates the string
		// decrypter delegates.
		void findHouseOfCardsStrings_v2() {
			foreach (var type in module.Types) {
				if (type.Methods.Count != 1)
					continue;
				foreach (var method in DotNetUtils.findMethods(type.Methods, "System.Void", new string[] { "System.Type" })) {
					if (checkDelegateCreatorMethod(type, method))
						break;
				}
			}
		}

		void findHouseOfCardsStrings_v1() {
			foreach (var type in module.Types) {
				if (type.Methods.Count != 1)
					continue;
				foreach (var method in DotNetUtils.findMethods(type.Methods, "System.Void", new string[] { })) {
					if (checkDelegateCreatorMethod(type, method))
						break;
				}
			}
		}

		bool checkDelegateCreatorMethod(TypeDef type, MethodDef method) {
			simpleDeobfuscator.deobfuscate(method);

			var getStringDelegate = findGetStringDelegate(method);
			if (getStringDelegate == null)
				return false;

			var stringDecrypterClass = findStringDecrypterClass(method);
			if (stringDecrypterClass == null)
				return false;

			stringsEncoderInfos.Add(new StringsEncoderInfo {
				StringsType = type,
				GetStringDelegate = getStringDelegate,
				StringDecrypterClass = stringDecrypterClass,
				CreateStringDelegateMethod = method,
			});

			return true;
		}

		// Finds the SmartAssembly.Delegates.GetString delegate
		TypeDef findGetStringDelegate(MethodDef stringsCreateDelegateMethod) {
			if (!stringsCreateDelegateMethod.HasBody)
				return null;

			foreach (var ldtoken in stringsCreateDelegateMethod.Body.Instructions) {
				if (ldtoken.OpCode.Code != Code.Ldtoken)
					continue;
				var typeToken = ldtoken.Operand as ITypeDefOrRef;
				if (typeToken == null)
					continue;
				var delegateType = getType(typeToken);
				if (!DotNetUtils.derivesFromDelegate(delegateType))
					continue;
				var invoke = delegateType.FindMethod("Invoke");
				if (invoke == null || !DotNetUtils.isMethod(invoke, "System.String", "(System.Int32)"))
					continue;

				return delegateType;
			}

			return null;
		}

		// Finds the SmartAssembly.StringsEncoding.Strings class. This class decrypts the
		// strings in the resources. It gets called by the SmartAssembly.Delegates.GetString
		// delegate instances which were created by SmartAssembly.HouseOfCards.Strings.
		TypeDef findStringDecrypterClass(MethodDef stringsCreateDelegateMethod) {
			if (!stringsCreateDelegateMethod.HasBody)
				return null;

			foreach (var ldtoken in stringsCreateDelegateMethod.Body.Instructions) {
				if (ldtoken.OpCode.Code != Code.Ldtoken)
					continue;
				var typeToken = ldtoken.Operand as ITypeDefOrRef;
				if (typeToken == null)
					continue;
				var type = getType(typeToken);
				if (type == null || DotNetUtils.derivesFromDelegate(type))
					continue;
				if (!couldBeStringDecrypterClass(type))
					continue;

				return type;
			}

			return null;
		}

		void findStringDecrypterClasses() {
			var foundClasses = new Dictionary<TypeDef, bool>();
			foreach (var info in stringsEncoderInfos)
				foundClasses[info.StringDecrypterClass] = true;

			foreach (var type in module.Types) {
				if (!foundClasses.ContainsKey(type) && couldBeStringDecrypterClass(type)) {
					stringsEncoderInfos.Add(new StringsEncoderInfo {
						StringsType = null,
						GetStringDelegate = null,
						StringDecrypterClass = type,
					});
				}
			}
		}

		static string[] fields1x = new string[] {
			"System.IO.Stream",
		};
		static string[] fields2x = new string[] {
			"System.IO.Stream",
			"System.Int32",
		};
		static string[] fields3x = new string[] {
			"System.Byte[]",
			"System.Int32",
		};
		bool couldBeStringDecrypterClass(TypeDef type) {
			var fields = new FieldTypes(type);
			if (fields.exists("System.Collections.Hashtable") ||
				fields.exists("System.Collections.Generic.Dictionary`2<System.Int32,System.String>") ||
				fields.exactly(fields3x)) {
				if (type.FindStaticConstructor() == null)
					return false;
			}
			else if (fields.exactly(fields1x) || fields.exactly(fields2x)) {
			}
			else
				return false;

			var methods = new List<MethodDef>(DotNetUtils.getNormalMethods(type));
			if (methods.Count != 1)
				return false;
			var method = methods[0];
			if (!DotNetUtils.isMethod(method, "System.String", "(System.Int32)"))
				return false;
			if (!method.IsStatic || !method.HasBody)
				return false;

			return true;
		}
	}
}