Beispiel #1
0
        void InitDecrypters()
        {
            assemblyResolverInfo = new AssemblyResolverInfo(module, DeobfuscatedFile, this);
            assemblyResolverInfo.FindTypes();
            resourceDecrypterInfo = new ResourceDecrypterInfo(module, assemblyResolverInfo.SimpleZipTypeMethod, DeobfuscatedFile);
            resourceResolverInfo  = new ResourceResolverInfo(module, DeobfuscatedFile, this, assemblyResolverInfo);
            resourceResolverInfo.FindTypes();
            resourceDecrypter = new ResourceDecrypter(resourceDecrypterInfo);
            assemblyResolver  = new AssemblyResolver(resourceDecrypter, assemblyResolverInfo);
            resourceResolver  = new ResourceResolver(module, assemblyResolver, resourceResolverInfo);

            InitStringDecrypterInfos();
            assemblyResolverInfo.FindTypes();
            resourceResolverInfo.FindTypes();

            AddModuleCctorInitCallToBeRemoved(assemblyResolverInfo.CallResolverMethod);
            AddCallToBeRemoved(module.EntryPoint, assemblyResolverInfo.CallResolverMethod);
            AddModuleCctorInitCallToBeRemoved(resourceResolverInfo.CallResolverMethod);
            AddCallToBeRemoved(module.EntryPoint, resourceResolverInfo.CallResolverMethod);

            resourceDecrypterInfo.SetSimpleZipType(GetGlobalSimpleZipTypeMethod(), DeobfuscatedFile);

            if (!DecryptResources())
            {
                throw new ApplicationException("Could not decrypt resources");
            }

            DumpEmbeddedAssemblies();
        }
Beispiel #2
0
        void InitDecrypters()
        {
            assemblyResolverInfo = new AssemblyResolverInfo(module, DeobfuscatedFile, this);
            assemblyResolverInfo.FindTypes();
            resourceDecrypterInfo = new ResourceDecrypterInfo(module, assemblyResolverInfo.SimpleZipTypeMethod, DeobfuscatedFile);
            resourceResolverInfo  = new ResourceResolverInfo(module, DeobfuscatedFile, this, assemblyResolverInfo);
            resourceResolverInfo.FindTypes();
            resourceDecrypter = new ResourceDecrypter(resourceDecrypterInfo);
            assemblyResolver  = new AssemblyResolver(resourceDecrypter, assemblyResolverInfo);
            resourceResolver  = new ResourceResolver(module, assemblyResolver, resourceResolverInfo);

            InitStringDecrypterInfos();
            assemblyResolverInfo.FindTypes();
            resourceResolverInfo.FindTypes();

            AddModuleCctorInitCallToBeRemoved(assemblyResolverInfo.CallResolverMethod);
            AddCallToBeRemoved(module.EntryPoint, assemblyResolverInfo.CallResolverMethod);
            AddModuleCctorInitCallToBeRemoved(resourceResolverInfo.CallResolverMethod);
            AddCallToBeRemoved(module.EntryPoint, resourceResolverInfo.CallResolverMethod);

            resourceDecrypterInfo.SetSimpleZipType(GetGlobalSimpleZipTypeMethod(), DeobfuscatedFile);

            if (!DecryptResources())
            {
                throw new ApplicationException("Could not decrypt resources");
            }

            var bt = FindBigType();
            var candidateMthods = bt.Methods.Where(m => DotNetUtils.IsMethod(m, "System.String", "(System.Int32)"));

            //foreach (var cm in candidateMthods) {
            //	staticStringInliner.Add(cm, (method, gim, args) => {
            //
            //		var instrs = method.Body.Instructions;
            //		return args[0].ToString();
            //	});
            //}
            DumpEmbeddedAssemblies();
        }
Beispiel #3
0
		void InitDecrypters() {
			assemblyResolverInfo = new AssemblyResolverInfo(module, DeobfuscatedFile, this);
			assemblyResolverInfo.FindTypes();
			resourceDecrypterInfo = new ResourceDecrypterInfo(module, assemblyResolverInfo.SimpleZipTypeMethod, DeobfuscatedFile);
			resourceResolverInfo = new ResourceResolverInfo(module, DeobfuscatedFile, this, assemblyResolverInfo);
			resourceResolverInfo.FindTypes();
			resourceDecrypter = new ResourceDecrypter(resourceDecrypterInfo);
			assemblyResolver = new AssemblyResolver(resourceDecrypter, assemblyResolverInfo);
			resourceResolver = new ResourceResolver(module, assemblyResolver, resourceResolverInfo);

			InitStringDecrypterInfos();
			assemblyResolverInfo.FindTypes();
			resourceResolverInfo.FindTypes();

			AddModuleCctorInitCallToBeRemoved(assemblyResolverInfo.CallResolverMethod);
			AddCallToBeRemoved(module.EntryPoint, assemblyResolverInfo.CallResolverMethod);
			AddModuleCctorInitCallToBeRemoved(resourceResolverInfo.CallResolverMethod);
			AddCallToBeRemoved(module.EntryPoint, resourceResolverInfo.CallResolverMethod);

			resourceDecrypterInfo.SetSimpleZipType(GetGlobalSimpleZipTypeMethod(), DeobfuscatedFile);

			if (!DecryptResources())
				throw new ApplicationException("Could not decrypt resources");

			DumpEmbeddedAssemblies();
		}
Beispiel #4
0
        void InitStringDecrypterInfos()
        {
            var stringEncoderClassFinder = new StringEncoderClassFinder(module, DeobfuscatedFile);

            stringEncoderClassFinder.Find();
            foreach (var info in stringEncoderClassFinder.StringsEncoderInfos)
            {
                var sinfo = new StringDecrypterInfo(module, info.StringDecrypterClass)
                {
                    GetStringDelegate          = info.GetStringDelegate,
                    StringsType                = info.StringsType,
                    CreateStringDelegateMethod = info.CreateStringDelegateMethod,
                };
                stringDecrypterInfos.Add(sinfo);
            }

            // There may be more than one string decrypter. The strings in the first one's
            // methods may be decrypted by the other string decrypter.

            var initd = new Dictionary <StringDecrypterInfo, bool>(stringDecrypterInfos.Count);

            while (initd.Count != stringDecrypterInfos.Count)
            {
                StringDecrypterInfo initdInfo = null;
                for (int i = 0; i < 2; i++)
                {
                    foreach (var info in stringDecrypterInfos)
                    {
                        if (initd.ContainsKey(info))
                        {
                            continue;
                        }
                        if (info.Initialize(this, DeobfuscatedFile))
                        {
                            resourceDecrypterInfo.SetSimpleZipType(info.SimpleZipTypeMethod, DeobfuscatedFile);
                            initdInfo = info;
                            break;
                        }
                    }
                    if (initdInfo != null)
                    {
                        break;
                    }

                    assemblyResolverInfo.FindTypes();
                    resourceResolverInfo.FindTypes();
                    DecryptResources();
                }

                if (initdInfo == null)
                {
                    break;
                }

                initd[initdInfo] = true;
                InitStringDecrypter(initdInfo);
            }

            // Sometimes there could be a string decrypter present that isn't called by anyone.
            foreach (var info in stringDecrypterInfos)
            {
                if (initd.ContainsKey(info))
                {
                    continue;
                }
                Logger.v("String decrypter not initialized. Token {0:X8}", info.StringsEncodingClass.MDToken.ToInt32());
            }
        }