Beispiel #1
0
        void Deobfuscate(MethodDef method, BlocksCflowDeobfuscator cflowDeobfuscator, MethodPrinter methodPrinter, bool isVerbose, bool isVV)
        {
            if (!HasNonEmptyBody(method))
            {
                return;
            }

            var blocks             = new Blocks(method);
            int numRemovedLocals   = 0;
            int oldNumInstructions = method.Body.Instructions.Count;

            deob.DeobfuscateMethodBegin(blocks);
            if (options.ControlFlowDeobfuscation)
            {
                cflowDeobfuscator.Initialize(blocks);
                cflowDeobfuscator.Deobfuscate();
            }

            if (deob.DeobfuscateOther(blocks) && options.ControlFlowDeobfuscation)
            {
                cflowDeobfuscator.Deobfuscate();
            }

            if (options.ControlFlowDeobfuscation)
            {
                if (CanOptimizeLocals())
                {
                    numRemovedLocals = blocks.OptimizeLocals();
                }
                blocks.RepartitionBlocks();
            }

            DeobfuscateStrings(blocks);
            deob.DeobfuscateMethodEnd(blocks);

            IList <Instruction>      allInstructions;
            IList <ExceptionHandler> allExceptionHandlers;

            blocks.GetCode(out allInstructions, out allExceptionHandlers);
            DotNetUtils.RestoreBody(method, allInstructions, allExceptionHandlers);

            if (isVerbose && numRemovedLocals > 0)
            {
                Logger.v("Removed {0} unused local(s)", numRemovedLocals);
            }
            int numRemovedInstructions = oldNumInstructions - method.Body.Instructions.Count;

            if (isVerbose && numRemovedInstructions > 0)
            {
                Logger.v("Removed {0} dead instruction(s)", numRemovedInstructions);
            }

            if (isVV)
            {
                Logger.Log(LoggerEvent.VeryVerbose, "Deobfuscated code:");
                Logger.Instance.Indent();
                methodPrinter.Print(LoggerEvent.VeryVerbose, allInstructions, allExceptionHandlers);
                Logger.Instance.DeIndent();
            }
        }