public void Decrypt(ResourceDecrypter resourceDecrypter, ISimpleDeobfuscator simpleDeobfuscator)
{
if (decryptMethod == null)
{
return;
}
resource = CoUtils.GetResource(module, decrypterCctor);
if (resource == null)
{
return;
}
var decrypted = resourceDecrypter.Decrypt(resource.GetResourceStream());
var reader = MemoryImageStream.Create(decrypted);
int numEncrypted = reader.ReadInt32();
Logger.v("Restoring {0} encrypted methods", numEncrypted);
Logger.Instance.Indent();
for (int i = 0; i < numEncrypted; i++)
{
int delegateTypeToken = reader.ReadInt32();
uint codeOffset = reader.ReadUInt32();
var origOffset = reader.Position;
reader.Position = codeOffset;
Decrypt(reader, delegateTypeToken, simpleDeobfuscator);
reader.Position = origOffset;
}
Logger.Instance.DeIndent();
}
public void Initialize(ResourceDecrypter resourceDecrypter)
{
if (decrypterType == null)
{
return;
}
encryptedResource = CoUtils.GetResource(module, DotNetUtils.GetCodeStrings(decrypterType.FindStaticConstructor()));
encryptedResource.Data.Position = 0;
constantsData = resourceDecrypter.Decrypt(encryptedResource.Data.CreateStream());
}
public void Initialize(ResourceDecrypter resourceDecrypter) {
if (decryptedData != null || stringDecrypterType == null)
return;
var resourceName = GetResourceName();
stringResource = DotNetUtils.GetResource(module, resourceName) as EmbeddedResource;
if (stringResource == null)
return;
Logger.v("Adding string decrypter. Resource: {0}", Utils.ToCsharpString(stringResource.Name));
decryptedData = resourceDecrypter.Decrypt(stringResource.GetResourceStream());
}
public void Initialize(ResourceDecrypter resourceDecrypter)
{
if (decryptedData != null || stringDecrypterType == null)
{
return;
}
var resourceName = GetResourceName();
stringResource = DotNetUtils.GetResource(module, resourceName) as EmbeddedResource;
if (stringResource == null)
{
return;
}
Logger.v("Adding string decrypter. Resource: {0}", Utils.ToCsharpString(stringResource.Name));
decryptedData = resourceDecrypter.Decrypt(stringResource.GetResourceStream());
}
public EmbeddedResource MergeResources()
{
if (mergedIt)
{
return(null);
}
var resource = DotNetUtils.GetResource(module, GetResourceNames()) as EmbeddedResource;
if (resource == null)
{
return(null);
}
DeobUtils.DecryptAndAddResources(module, resource.Name.String, () => resourceDecrypter.Decrypt(resource.CreateReader().AsStream()));
mergedIt = true;
return(resource);
}
public void Initialize(ResourceDecrypter resourceDecrypter)
{
if (decrypterType == null)
{
return;
}
var cctor = decrypterType.FindStaticConstructor();
encryptedResource = CoUtils.GetResource(module, DotNetUtils.GetCodeStrings(cctor));
//if the return value is null, it is possible that resource name is encrypted
if (encryptedResource == null)
{
var Resources = new string[] { CoUtils.DecryptResourceName(module, cctor) };
encryptedResource = CoUtils.GetResource(module, Resources);
}
constantsData = resourceDecrypter.Decrypt(encryptedResource.GetReader().AsStream());
}
public void Initialize(ResourceDecrypter resourceDecrypter) {
if (decrypterType == null)
return;
encryptedResource = CoUtils.GetResource(module, DotNetUtils.GetCodeStrings(decrypterType.FindStaticConstructor()));
encryptedResource.Data.Position = 0;
constantsData = resourceDecrypter.Decrypt(encryptedResource.Data.CreateStream());
}
void DumpEmbeddedFile(EmbeddedResource resource, string assemblyName, string extension, string reason)
{
DeobfuscatedFile.CreateAssemblyFile(resourceDecrypter.Decrypt(resource.GetResourceStream()), Utils.GetAssemblySimpleName(assemblyName), extension);
AddResourceToBeRemoved(resource, reason);
}
public void Decrypt(ResourceDecrypter resourceDecrypter, ISimpleDeobfuscator simpleDeobfuscator) {
if (decryptMethod == null)
return;
resource = CoUtils.GetResource(module, decrypterCctor);
if (resource == null)
return;
var decrypted = resourceDecrypter.Decrypt(resource.GetResourceStream());
var reader = MemoryImageStream.Create(decrypted);
int numEncrypted = reader.ReadInt32();
Logger.v("Restoring {0} encrypted methods", numEncrypted);
Logger.Instance.Indent();
for (int i = 0; i < numEncrypted; i++) {
int delegateTypeToken = reader.ReadInt32();
uint codeOffset = reader.ReadUInt32();
var origOffset = reader.Position;
reader.Position = codeOffset;
Decrypt(reader, delegateTypeToken, simpleDeobfuscator);
reader.Position = origOffset;
}
Logger.Instance.DeIndent();
}
public void Initialize(ResourceDecrypter resourceDecrypter) {
if (decrypterType == null)
return;
MethodDef cctor = decrypterType.FindStaticConstructor();
encryptedResource = CoUtils.GetResource(module, DotNetUtils.GetCodeStrings(cctor));
//if the return value is null, it is possible that resource name is encrypted
if (encryptedResource == null) {
var Resources = new string[] { CoUtils.DecryptResourceName(module, cctor) };
encryptedResource = CoUtils.GetResource(module, Resources);
}
encryptedResource.Data.Position = 0;
constantsData = resourceDecrypter.Decrypt(encryptedResource.Data.CreateStream());
}
