499 lines
14 KiB
C#
499 lines
14 KiB
C#
/*
|
|
Copyright (C) 2011-2012 de4dot@gmail.com
|
|
|
|
This file is part of de4dot.
|
|
|
|
de4dot is free software: you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
(at your option) any later version.
|
|
|
|
de4dot is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with de4dot. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
using System;
|
|
using System.Collections.Generic;
|
|
using System.Runtime.InteropServices;
|
|
using System.IO;
|
|
using System.Text;
|
|
using dnlib.IO;
|
|
using dnlib.DotNet;
|
|
using dnlib.DotNet.Emit;
|
|
using de4dot.blocks;
|
|
|
|
using CR = System.Runtime.InteropServices;
|
|
using DR = dnlib.DotNet;
|
|
|
|
namespace de4dot.code.deobfuscators.Babel_NET {
|
|
class ImageReader {
|
|
static int METHODS_SIG = 0x0000BEBA;
|
|
static int METADATA_SIG = 0x0100BEBA;
|
|
static int METHOD_NAMES_SIG = 0x0200BEBA;
|
|
static int ASSEMBLY_NAMES_SIG = 0x0201BEBA;
|
|
static int TYPEREFS_SIG = 0x0202BEBA;
|
|
static int STRINGS_SIG = 0x0203BEBA;
|
|
|
|
enum TypeId : byte {
|
|
TypeRef = 0,
|
|
GenericInstance = 1,
|
|
Pointer = 2,
|
|
Array = 3,
|
|
ByRef = 4,
|
|
}
|
|
|
|
ModuleDefMD module;
|
|
IBinaryReader reader;
|
|
string[] strings;
|
|
AssemblyRef[] assemblyNames;
|
|
Dictionary<string, int> methodOffsets;
|
|
List<TypeSig> typeRefs;
|
|
MemberRefConverter memberRefConverter;
|
|
IDeobfuscatorContext deobfuscatorContext;
|
|
|
|
public ImageReader(IDeobfuscatorContext deobfuscatorContext, ModuleDefMD module, byte[] data) {
|
|
this.deobfuscatorContext = deobfuscatorContext;
|
|
this.module = module;
|
|
this.reader = MemoryImageStream.Create(data);
|
|
this.memberRefConverter = new MemberRefConverter(module);
|
|
}
|
|
|
|
public bool initialize() {
|
|
if (reader.ReadInt32() != METHODS_SIG)
|
|
return false;
|
|
|
|
int metadataOffset = getMetadataOffset();
|
|
if (metadataOffset < 0)
|
|
return false;
|
|
long pos = metadataOffset + 4;
|
|
reader.Position = pos;
|
|
int version = reader.ReadInt16(); // major, minor
|
|
if (version == 0x0001) {
|
|
initializeV10();
|
|
return true;
|
|
}
|
|
|
|
reader.Position = pos;
|
|
initializeV55();
|
|
return true;
|
|
}
|
|
|
|
void initializeV10() {
|
|
reader.ReadInt16();
|
|
int methodNamesOffset = (int)reader.ReadInt64();
|
|
int typeRefsOffset = (int)reader.ReadInt64();
|
|
int assemblyRefsOffset = (int)reader.ReadInt64();
|
|
int stringsOffset = (int)reader.ReadInt64();
|
|
|
|
initializeStrings(stringsOffset);
|
|
initializeAssemblyNames(assemblyRefsOffset);
|
|
initializeMethodNames(methodNamesOffset);
|
|
initializeTypeRefs(typeRefsOffset);
|
|
}
|
|
|
|
void initializeV55() {
|
|
int methodNamesOffset = (int)reader.ReadInt64() ^ METADATA_SIG;
|
|
int typeRefsOffset = (int)reader.ReadInt64() ^ (METADATA_SIG << 1);
|
|
int assemblyRefsOffset = (int)reader.ReadInt64() ^ ((METADATA_SIG << 1) + 1);
|
|
int stringsOffset = (int)reader.ReadInt64() ^ (((METADATA_SIG << 1) + 1) << 1);
|
|
|
|
initializeStrings(stringsOffset);
|
|
initializeAssemblyNames(assemblyRefsOffset);
|
|
initializeMethodNames(methodNamesOffset);
|
|
initializeTypeRefs(typeRefsOffset);
|
|
}
|
|
|
|
public void restore(string name, MethodDef method) {
|
|
var babelMethod = getMethod(name);
|
|
var body = method.Body;
|
|
|
|
body.MaxStack = babelMethod.MaxStack;
|
|
body.InitLocals = babelMethod.InitLocals;
|
|
|
|
body.Variables.Clear();
|
|
foreach (var local in babelMethod.Locals)
|
|
body.Variables.Add(local);
|
|
|
|
var toNewOperand = new Dictionary<object, object>();
|
|
if (babelMethod.ThisParameter != null)
|
|
toNewOperand[babelMethod.ThisParameter] = method.Parameters[0];
|
|
for (int i = 0; i < babelMethod.Parameters.Length; i++)
|
|
toNewOperand[babelMethod.Parameters[i]] = method.Parameters[i + method.Parameters.MethodSigIndexBase];
|
|
|
|
body.Instructions.Clear();
|
|
foreach (var instr in babelMethod.Instructions) {
|
|
object newOperand;
|
|
if (instr.Operand != null && toNewOperand.TryGetValue(instr.Operand, out newOperand))
|
|
instr.Operand = newOperand;
|
|
body.Instructions.Add(instr);
|
|
}
|
|
|
|
body.ExceptionHandlers.Clear();
|
|
foreach (var eh in babelMethod.ExceptionHandlers)
|
|
body.ExceptionHandlers.Add(eh);
|
|
}
|
|
|
|
BabelMethodDef getMethod(string name) {
|
|
int offset = methodOffsets[name];
|
|
methodOffsets.Remove(name);
|
|
reader.Position = offset;
|
|
return new MethodDefReader(this, reader).read();
|
|
}
|
|
|
|
public string readString() {
|
|
return strings[readVariableLengthInt32()];
|
|
}
|
|
|
|
public TypeSig readTypeSig() {
|
|
return typeRefs[readVariableLengthInt32()];
|
|
}
|
|
|
|
public TypeSig[] readTypeSigs() {
|
|
var refs = new TypeSig[readVariableLengthInt32()];
|
|
for (int i = 0; i < refs.Length; i++)
|
|
refs[i] = readTypeSig();
|
|
return refs;
|
|
}
|
|
|
|
public IField readFieldRef() {
|
|
var name = readString();
|
|
var declaringType = readTypeSig();
|
|
|
|
var fields = getFields(resolve(declaringType), name);
|
|
if (fields == null || fields.Count != 1) {
|
|
throw new ApplicationException(string.Format("Couldn't find one field named '{0}' in type {1}",
|
|
name,
|
|
Utils.removeNewlines(declaringType)));
|
|
}
|
|
|
|
return memberRefConverter.convert(fields[0]);
|
|
}
|
|
|
|
static List<FieldDef> getFields(TypeDef type, string name) {
|
|
if (type == null)
|
|
return null;
|
|
return new List<FieldDef>(type.FindFields(name));
|
|
}
|
|
|
|
public IMethod readMethodRef() {
|
|
var babelMethodRef = new MethodRefReader(this, reader).read();
|
|
|
|
var method = getMethodRef(babelMethodRef);
|
|
if (method == null) {
|
|
throw new ApplicationException(string.Format("Could not find method '{0}' in type '{1}'",
|
|
Utils.removeNewlines(babelMethodRef.Name),
|
|
Utils.removeNewlines(babelMethodRef.DeclaringType)));
|
|
}
|
|
|
|
var git = babelMethodRef.DeclaringType.ToGenericInstSig();
|
|
if (git == null)
|
|
return method;
|
|
|
|
var mr = new MemberRefUser(module, method.Name, method.MethodSig.Clone(), babelMethodRef.DeclaringType.ToTypeDefOrRef());
|
|
return module.UpdateRowId(mr);
|
|
}
|
|
|
|
IMethod getMethodRef(BabelMethodreference babelMethodRef) {
|
|
var declaringType = resolve(babelMethodRef.DeclaringType);
|
|
if (declaringType == null)
|
|
return null;
|
|
|
|
var methods = getMethods(declaringType, babelMethodRef);
|
|
if (methods.Count != 1) {
|
|
throw new ApplicationException(string.Format("Couldn't find one method named '{0}' in type {1}",
|
|
babelMethodRef.Name,
|
|
Utils.removeNewlines(declaringType)));
|
|
}
|
|
|
|
return methods[0];
|
|
}
|
|
|
|
List<IMethod> getMethods(TypeDef declaringType, BabelMethodreference babelMethodRef) {
|
|
var methods = new List<IMethod>();
|
|
|
|
var gis = babelMethodRef.DeclaringType as GenericInstSig;
|
|
var gim = babelMethodRef.GenericArguments;
|
|
foreach (var method in declaringType.Methods) {
|
|
if (compareMethod(GenericArgsSubstitutor.create(method, gis, gim), babelMethodRef)) {
|
|
if (!babelMethodRef.IsGenericMethod)
|
|
methods.Add(memberRefConverter.convert(method));
|
|
else {
|
|
var gim2 = new GenericInstMethodSig(babelMethodRef.GenericArguments);
|
|
var ms = module.UpdateRowId(new MethodSpecUser(memberRefConverter.convert(method), gim2));
|
|
methods.Add(ms);
|
|
}
|
|
}
|
|
}
|
|
|
|
return methods;
|
|
}
|
|
|
|
bool compareMethod(IMethod method, BabelMethodreference babelMethodRef) {
|
|
var sig = method.MethodSig;
|
|
if (sig.Params.Count != babelMethodRef.Parameters.Length)
|
|
return false;
|
|
if (method.Name != babelMethodRef.Name)
|
|
return false;
|
|
if (sig.HasThis != babelMethodRef.HasThis)
|
|
return false;
|
|
if (sig.GenParamCount != babelMethodRef.GenericArguments.Length)
|
|
return false;
|
|
|
|
if (!new SigComparer().Equals(sig.RetType, babelMethodRef.ReturnType))
|
|
return false;
|
|
|
|
for (int i = 0; i < babelMethodRef.Parameters.Length; i++) {
|
|
if (!new SigComparer().Equals(sig.Params[i], babelMethodRef.Parameters[i].Type))
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
TypeDef resolve(TypeSig type) {
|
|
type = type.RemovePinnedAndModifiers();
|
|
|
|
var gis = type as GenericInstSig;
|
|
if (gis != null)
|
|
type = gis.GenericType;
|
|
|
|
var tdrs = type as TypeDefOrRefSig;
|
|
if (tdrs == null)
|
|
return null;
|
|
|
|
var td = tdrs.TypeDef;
|
|
if (td != null)
|
|
return td;
|
|
|
|
var tr = tdrs.TypeRef;
|
|
if (tr != null)
|
|
return tr.Resolve();
|
|
|
|
return null;
|
|
}
|
|
|
|
public MethodSig readCallSite() {
|
|
var returnType = readTypeSig();
|
|
var paramTypes = readTypeSigs();
|
|
var callingConvention = (CR.CallingConvention)reader.ReadInt32();
|
|
|
|
return new MethodSig(convertCallingConvention(callingConvention), 0, returnType, paramTypes);
|
|
}
|
|
|
|
static DR.CallingConvention convertCallingConvention(CR.CallingConvention callingConvention) {
|
|
switch (callingConvention) {
|
|
case CR.CallingConvention.Winapi: return DR.CallingConvention.Default;
|
|
case CR.CallingConvention.Cdecl: return DR.CallingConvention.C;
|
|
case CR.CallingConvention.StdCall: return DR.CallingConvention.StdCall;
|
|
case CR.CallingConvention.ThisCall: return DR.CallingConvention.ThisCall;
|
|
case CR.CallingConvention.FastCall: return DR.CallingConvention.FastCall;
|
|
default: throw new ApplicationException(string.Format("Unknown CallingConvention {0}", callingConvention));
|
|
}
|
|
}
|
|
|
|
void initializeStrings(int headerOffset) {
|
|
reader.Position = headerOffset;
|
|
if (reader.ReadInt32() != STRINGS_SIG)
|
|
throw new ApplicationException("Invalid strings sig");
|
|
|
|
strings = new string[readVariableLengthInt32()];
|
|
for (int i = 0; i < strings.Length; i++)
|
|
strings[i] = reader.ReadString();
|
|
}
|
|
|
|
void initializeAssemblyNames(int headerOffset) {
|
|
reader.Position = headerOffset;
|
|
if (reader.ReadInt32() != ASSEMBLY_NAMES_SIG)
|
|
throw new ApplicationException("Invalid assembly names sig");
|
|
|
|
assemblyNames = new AssemblyRef[readVariableLengthInt32()];
|
|
for (int i = 0; i < assemblyNames.Length; i++)
|
|
assemblyNames[i] = module.UpdateRowId(new AssemblyRefUser(new AssemblyNameInfo(readString())));
|
|
}
|
|
|
|
void initializeMethodNames(int headerOffset) {
|
|
reader.Position = headerOffset;
|
|
if (reader.ReadInt32() != METHOD_NAMES_SIG)
|
|
throw new ApplicationException("Invalid methods sig");
|
|
|
|
int numMethods = readVariableLengthInt32();
|
|
methodOffsets = new Dictionary<string, int>(numMethods, StringComparer.Ordinal);
|
|
for (int i = 0; i < numMethods; i++) {
|
|
var methodName = readString();
|
|
methodOffsets[methodName] = readVariableLengthInt32();
|
|
}
|
|
}
|
|
|
|
void initializeTypeRefs(int headerOffset) {
|
|
reader.Position = headerOffset;
|
|
if (reader.ReadInt32() != TYPEREFS_SIG)
|
|
throw new ApplicationException("Invalid typerefs sig");
|
|
|
|
int numTypeRefs = reader.ReadInt32();
|
|
typeRefs = new List<TypeSig>(numTypeRefs + 1);
|
|
typeRefs.Add(null);
|
|
var genericArgFixes = new Dictionary<GenericInstSig, List<int>>();
|
|
for (int i = 0; i < numTypeRefs; i++) {
|
|
TypeId typeId = (TypeId)reader.ReadByte();
|
|
switch (typeId) {
|
|
case TypeId.TypeRef:
|
|
typeRefs.Add(readTypeRef());
|
|
break;
|
|
|
|
case TypeId.GenericInstance:
|
|
List<int> genericArgs;
|
|
var git = readGenericInstanceType(out genericArgs);
|
|
typeRefs.Add(git);
|
|
genericArgFixes[git] = genericArgs;
|
|
break;
|
|
|
|
case TypeId.Pointer:
|
|
typeRefs.Add(readPointerType());
|
|
break;
|
|
|
|
case TypeId.Array:
|
|
typeRefs.Add(readArrayType());
|
|
break;
|
|
|
|
case TypeId.ByRef:
|
|
typeRefs.Add(readByRefType());
|
|
break;
|
|
|
|
default:
|
|
throw new ApplicationException(string.Format("Unknown type id {0}", (int)typeId));
|
|
}
|
|
}
|
|
|
|
foreach (var kv in genericArgFixes) {
|
|
var git = kv.Key;
|
|
foreach (var typeNum in kv.Value)
|
|
git.GenericArguments.Add(typeRefs[typeNum]);
|
|
}
|
|
}
|
|
|
|
TypeSig readTypeRef() {
|
|
string ns, name;
|
|
parseReflectionTypeName(readString(), out ns, out name);
|
|
var asmRef = assemblyNames[readVariableLengthInt32()];
|
|
var declaringType = readTypeSig();
|
|
var typeRef = new TypeRefUser(module, ns, name);
|
|
if (declaringType != null)
|
|
typeRef.ResolutionScope = getTypeRef(declaringType);
|
|
else
|
|
typeRef.ResolutionScope = asmRef;
|
|
|
|
return memberRefConverter.convert(typeRef);
|
|
}
|
|
|
|
TypeRef getTypeRef(TypeSig type) {
|
|
var tdr = type as TypeDefOrRefSig;
|
|
if (tdr == null)
|
|
throw new ApplicationException("Not a type ref");
|
|
if (tdr.TypeRef != null)
|
|
return tdr.TypeRef;
|
|
var td = tdr.TypeDef;
|
|
if (td != null)
|
|
return new Importer(module).Import(td) as TypeRef;
|
|
throw new ApplicationException("Not a type ref");
|
|
}
|
|
|
|
static void parseReflectionTypeName(string fullName, out string ns, out string name) {
|
|
int index = getLastChar(fullName, '.');
|
|
if (index < 0) {
|
|
ns = "";
|
|
name = fullName;
|
|
}
|
|
else {
|
|
ns = unEscape(fullName.Substring(0, index));
|
|
name = fullName.Substring(index + 1);
|
|
}
|
|
|
|
index = getLastChar(name, '+');
|
|
if (index < 0)
|
|
name = unEscape(name);
|
|
else {
|
|
ns = "";
|
|
name = unEscape(name.Substring(index + 1));
|
|
}
|
|
}
|
|
|
|
static int getLastChar(string name, char c) {
|
|
if (string.IsNullOrEmpty(name))
|
|
return -1;
|
|
int index = name.Length - 1;
|
|
while (true) {
|
|
index = name.LastIndexOf(c, index);
|
|
if (index < 0)
|
|
return -1;
|
|
if (index == 0)
|
|
return index;
|
|
if (name[index - 1] != '\\')
|
|
return index;
|
|
index--;
|
|
}
|
|
}
|
|
|
|
static string unEscape(string s) {
|
|
var sb = new StringBuilder(s.Length);
|
|
for (int i = 0; i < s.Length; i++) {
|
|
if (s[i] == '\\' && i + 1 < s.Length)
|
|
i++;
|
|
sb.Append(s[i]);
|
|
}
|
|
return sb.ToString();
|
|
}
|
|
|
|
GenericInstSig readGenericInstanceType(out List<int> genericArgs) {
|
|
var git = new GenericInstSig(readTypeSig() as ClassOrValueTypeSig);
|
|
int numArgs = readVariableLengthInt32();
|
|
genericArgs = new List<int>(numArgs);
|
|
for (int i = 0; i < numArgs; i++)
|
|
genericArgs.Add(readVariableLengthInt32());
|
|
return git;
|
|
}
|
|
|
|
PtrSig readPointerType() {
|
|
return new PtrSig(readTypeSig());
|
|
}
|
|
|
|
TypeSig readArrayType() {
|
|
var typeSig = readTypeSig();
|
|
int rank = readVariableLengthInt32();
|
|
if (rank == 1)
|
|
return new SZArraySig(typeSig);
|
|
return new ArraySig(typeSig, rank);
|
|
}
|
|
|
|
ByRefSig readByRefType() {
|
|
return new ByRefSig(readTypeSig());
|
|
}
|
|
|
|
public uint readVariableLengthUInt32() {
|
|
uint val;
|
|
reader.ReadCompressedUInt32(out val);
|
|
return val;
|
|
}
|
|
|
|
public int readVariableLengthInt32() {
|
|
uint val;
|
|
reader.ReadCompressedUInt32(out val);
|
|
return (int)val;
|
|
}
|
|
|
|
int getMetadataOffset() {
|
|
reader.Position = reader.Length - 4;
|
|
for (int i = 0; i < 30; i++) {
|
|
if (reader.ReadInt32() == METADATA_SIG)
|
|
return (int)reader.Position - 4;
|
|
reader.Position -= 8;
|
|
}
|
|
return -1;
|
|
}
|
|
}
|
|
}
|