Beispiel #1
0
        public override IDeobfuscator ModuleReloaded(ModuleDefMD module)
        {
            if (module.Assembly != null)
            {
                realAssemblyInfo = null;
            }
            if (realAssemblyInfo != null)
            {
                realAssemblyInfo.realAssembly.Modules.Insert(0, module);
                if (realAssemblyInfo.entryPointToken != 0)
                {
                    module.EntryPoint = module.ResolveToken((int)realAssemblyInfo.entryPointToken) as MethodDef;
                }
                module.Kind = realAssemblyInfo.kind;
                module.Name = new UTF8String(realAssemblyInfo.moduleName);
            }

            var newOne = new Deobfuscator(options);

            DeobfuscatedFile.SetDeobfuscator(newOne);
            newOne.realAssemblyInfo = realAssemblyInfo;
            newOne.decryptState     = decryptState;
            newOne.DeobfuscatedFile = DeobfuscatedFile;
            newOne.ModuleBytes      = ModuleBytes;
            newOne.embeddedAssemblyInfos.AddRange(embeddedAssemblyInfos);
            newOne.SetModule(module);
            newOne.RemoveObfuscatorAttribute();
            newOne.jitMethodsDecrypter = hasUnpacked ? new JitMethodsDecrypter(module, DeobfuscatedFile) :
                                         new JitMethodsDecrypter(module, DeobfuscatedFile, jitMethodsDecrypter);
            if ((newOne.decryptState & DecryptState.CanDecryptMethods) != 0)
            {
                try {
                    newOne.jitMethodsDecrypter.Find();
                }
                catch {
                }
                if (newOne.jitMethodsDecrypter.Detected)
                {
                    return(newOne);
                }
            }
            newOne.memoryMethodsDecrypter = hasUnpacked ? new MemoryMethodsDecrypter(module, DeobfuscatedFile) :
                                            new MemoryMethodsDecrypter(module, DeobfuscatedFile, memoryMethodsDecrypter);
            if ((newOne.decryptState & DecryptState.CanDecryptMethods) != 0)
            {
                newOne.memoryMethodsDecrypter.Find();
                if (newOne.memoryMethodsDecrypter.Detected)
                {
                    return(newOne);
                }
            }
            newOne.InitializeTheRest(this);
            return(newOne);
        }