Beispiel #1
0
        bool CheckType_v14_r58852(TypeDef type, MethodDef initMethod)
        {
            var virtualProtect = DotNetUtils.GetPInvokeMethod(type, "VirtualProtect");

            if (virtualProtect == null)
            {
                return(false);
            }
            if (!DotNetUtils.CallsMethod(initMethod, "System.IntPtr System.Runtime.InteropServices.Marshal::GetHINSTANCE(System.Reflection.Module)"))
            {
                return(false);
            }
            int virtualProtectCalls = ConfuserUtils.CountCalls(initMethod, virtualProtect);

            if (virtualProtectCalls != 14 && virtualProtectCalls != 16)
            {
                return(false);
            }
            if (!DeobUtils.HasInteger(initMethod, 0x3C))
            {
                return(false);
            }
            if (!DeobUtils.HasInteger(initMethod, 0x6c64746e))
            {
                return(false);
            }
            if (!DeobUtils.HasInteger(initMethod, 0x6c642e6c))
            {
                return(false);
            }
            if (!DeobUtils.HasInteger(initMethod, 0x6f43744e))
            {
                return(false);
            }
            if (!DeobUtils.HasInteger(initMethod, 0x6e69746e))
            {
                return(false);
            }
            int locallocs = ConfuserUtils.CountOpCode(initMethod, Code.Localloc);

            if (DeobUtils.HasInteger(initMethod, 0x18))
            {
                version = ConfuserVersion.v14_r58852;
            }
            else if (virtualProtectCalls == 16)
            {
                version = ConfuserVersion.v16_r69339;
            }
            else if (virtualProtectCalls == 14)
            {
                if (locallocs == 2)
                {
                    version = ConfuserVersion.v17_r74708;
                }
                else if (locallocs == 1)
                {
                    if (DotNetUtils.HasString(initMethod, "<Unknown>"))
                    {
                        version = ConfuserVersion.v18_r75257;
                    }
                    else if (IsRev75725(initMethod))
                    {
                        version = ConfuserVersion.v19_r75725;
                    }
                    else
                    {
                        version = ConfuserVersion.v19_r76186;
                    }
                }
                else
                {
                    return(false);
                }
            }
            else
            {
                return(false);
            }

            return(true);
        }