Beispiel #1
0
        public void Initialize(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
        {
            if (methodsDecrypter == null)
            {
                return;
            }

            encryptedResource = BabelUtils.FindEmbeddedResource(module, methodsDecrypter, simpleDeobfuscator, deob);
            if (encryptedResource != null)
            {
                AddImageReader("", resourceDecrypter.Decrypt(encryptedResource.CreateReader().ToArray()));
            }
        }
Beispiel #2
0
        public void Initialize(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
        {
            if (resolverType == null)
            {
                return;
            }

            encryptedResource = BabelUtils.FindEmbeddedResource(module, resolverType, simpleDeobfuscator, deob);
            if (encryptedResource == null)
            {
                Logger.w("Could not find embedded assemblies resource");
                return;
            }

            var decrypted     = resourceDecrypter.Decrypt(encryptedResource.GetReader().ToArray());
            var reader        = new BinaryReader(new MemoryStream(decrypted));
            int numAssemblies = reader.ReadInt32();

            embeddedAssemblyInfos = new EmbeddedAssemblyInfo[numAssemblies];
            for (int i = 0; i < numAssemblies; i++)
            {
                string name = reader.ReadString();
                var    data = reader.ReadBytes(reader.ReadInt32());
                var    mod  = ModuleDefMD.Load(data);
                embeddedAssemblyInfos[i] = new EmbeddedAssemblyInfo(name, DeobUtils.GetExtension(mod.Kind), data);
            }
        }
Beispiel #3
0
        public void Initialize(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
        {
            if (decrypterType == null)
            {
                return;
            }

            encryptedResource = BabelUtils.FindEmbeddedResource(module, decrypterType, simpleDeobfuscator, deob);
            if (encryptedResource == null)
            {
                Logger.w("Could not find encrypted constants resource");
                return;
            }

            var decrypted = resourceDecrypter.Decrypt(encryptedResource.Data.ReadAllBytes());
            var reader    = new BinaryReader(new MemoryStream(decrypted));
            int count;

            count         = reader.ReadInt32();
            decryptedInts = new int[count];
            while (count-- > 0)
            {
                decryptedInts[count] = reader.ReadInt32();
            }

            count          = reader.ReadInt32();
            decryptedLongs = new long[count];
            while (count-- > 0)
            {
                decryptedLongs[count] = reader.ReadInt64();
            }

            count           = reader.ReadInt32();
            decryptedFloats = new float[count];
            while (count-- > 0)
            {
                decryptedFloats[count] = reader.ReadSingle();
            }

            count            = reader.ReadInt32();
            decryptedDoubles = new double[count];
            while (count-- > 0)
            {
                decryptedDoubles[count] = reader.ReadDouble();
            }
        }
            public void Initialize(ModuleDefMD module, EmbeddedResource resource)
            {
                var decrypted = resourceDecrypter.Decrypt(resource.Data.ReadAllBytes());
                var reader    = new BinaryReader(new MemoryStream(decrypted));

                while (reader.BaseStream.Position < reader.BaseStream.Length)
                {
                    offsetToString[GetOffset((int)reader.BaseStream.Position)] = reader.ReadString();
                }
            }
        byte[] DecryptResourceAssembly()
        {
            var decrypted = resourceDecrypter.Decrypt(encryptedResource.Data.ReadAllBytes());
            var reader    = new BinaryReader(new MemoryStream(decrypted));

            int numResources = reader.ReadInt32() ^ xorKey1;

            for (int i = 0; i < numResources; i++)
            {
                reader.ReadString();
            }

            int len;

            if (hasXorKeys)
            {
                len = reader.ReadInt32() ^ xorKey2;
            }
            else
            {
                len = (int)(reader.BaseStream.Length - reader.BaseStream.Position);
            }
            return(reader.ReadBytes(len));
        }