void Deobfuscate(MethodDef method, BlocksCflowDeobfuscator cflowDeobfuscator, MethodPrinter methodPrinter, bool isVerbose, bool isVV)
{
if (!HasNonEmptyBody(method))
{
return;
}
var blocks = new Blocks(method);
int numRemovedLocals = 0;
int oldNumInstructions = method.Body.Instructions.Count;
deob.DeobfuscateMethodBegin(blocks);
if (options.ControlFlowDeobfuscation)
{
cflowDeobfuscator.Initialize(blocks);
cflowDeobfuscator.Deobfuscate();
}
if (deob.DeobfuscateOther(blocks) && options.ControlFlowDeobfuscation)
{
cflowDeobfuscator.Deobfuscate();
}
if (options.ControlFlowDeobfuscation)
{
if (CanOptimizeLocals())
{
numRemovedLocals = blocks.OptimizeLocals();
}
blocks.RepartitionBlocks();
}
DeobfuscateStrings(blocks);
deob.DeobfuscateMethodEnd(blocks);
IList <Instruction> allInstructions;
IList <ExceptionHandler> allExceptionHandlers;
blocks.GetCode(out allInstructions, out allExceptionHandlers);
DotNetUtils.RestoreBody(method, allInstructions, allExceptionHandlers);
if (isVerbose && numRemovedLocals > 0)
{
Logger.v("Removed {0} unused local(s)", numRemovedLocals);
}
int numRemovedInstructions = oldNumInstructions - method.Body.Instructions.Count;
if (isVerbose && numRemovedInstructions > 0)
{
Logger.v("Removed {0} dead instruction(s)", numRemovedInstructions);
}
if (isVV)
{
Logger.Log(LoggerEvent.VeryVerbose, "Deobfuscated code:");
Logger.Instance.Indent();
methodPrinter.Print(LoggerEvent.VeryVerbose, allInstructions, allExceptionHandlers);
Logger.Instance.DeIndent();
}
}
public static void Execute()
{
foreach (TypeDef type in Context.module.GetTypes())
{
foreach (MethodDef method in type.Methods)
{
bool flag = method.HasBody && ContainsControlFlow(method);
if (flag)
{
for (int i = 0; i < 1; i++)
{
CfDeob = new BlocksCflowDeobfuscator();
Blocks blocks = new Blocks(method);
List <Block> test = blocks.MethodBlocks.GetAllBlocks();
blocks.RemoveDeadBlocks();
blocks.RepartitionBlocks();
blocks.UpdateBlocks();
blocks.Method.Body.SimplifyBranches();
blocks.Method.Body.OptimizeBranches();
CfDeob.Initialize(blocks);
CfDeob.Add(new ControlFlow_BlockDeobfuscator());
CfDeob.Deobfuscate();
blocks.RepartitionBlocks();
IList <Instruction> instructions;
IList <ExceptionHandler> exceptionHandlers;
blocks.GetCode(out instructions, out exceptionHandlers);
DotNetUtils.RestoreBody(method, instructions, exceptionHandlers);
}
}
}
}
}
public static void DeobfuscateCflow(MethodDef meth)
{
for (int i = 0; i < 1; i++)
{
CfDeob = new BlocksCflowDeobfuscator();
Blocks blocks = new Blocks(meth);
List <Block> test = blocks.MethodBlocks.GetAllBlocks();
blocks.RemoveDeadBlocks();
blocks.RepartitionBlocks();
blocks.UpdateBlocks();
blocks.Method.Body.SimplifyBranches();
blocks.Method.Body.OptimizeBranches();
CfDeob.Initialize(blocks);
//CfDeob.Deobfuscate();
CfDeob.Add(new Cflow());
// CfDeob.Add(new Cflow());
CfDeob.Deobfuscate();
blocks.RepartitionBlocks();
IList <Instruction> instructions;
IList <ExceptionHandler> exceptionHandlers;
blocks.GetCode(out instructions, out exceptionHandlers);
DotNetUtils.RestoreBody(meth, instructions, exceptionHandlers);
}
}
// All Cflow Remover Credits Go to : https://github.com/SychicBoy/.NetReactorCfCleaner
public static void Execute(Context Ctx)
{
var CfDeob = new BlocksCflowDeobfuscator();
ExecuteArithmetic(Ctx);
foreach (var TypeDef in Ctx.DnModule.Types.ToArray())
{
foreach (var MethodDef in TypeDef.Methods.Where(x => x.HasBody && ContainsSwitch(x)).ToArray())
{
try
{
Blocks blocks = new Blocks(MethodDef);
List <Block> test = blocks.MethodBlocks.GetAllBlocks();
blocks.RemoveDeadBlocks();
blocks.RepartitionBlocks();
blocks.UpdateBlocks();
blocks.Method.Body.SimplifyBranches();
blocks.Method.Body.OptimizeBranches();
CfDeob.Initialize(blocks);
CfDeob.Deobfuscate();
blocks.RepartitionBlocks();
IList <Instruction> instructions;
IList <ExceptionHandler> exceptionHandlers;
blocks.GetCode(out instructions, out exceptionHandlers);
DotNetUtils.RestoreBody(MethodDef, instructions, exceptionHandlers);
}
catch
{
}
}
}
}
void deobfuscate(MethodDefinition method, BlocksCflowDeobfuscator cflowDeobfuscator, MethodPrinter methodPrinter)
{
if (!hasNonEmptyBody(method))
{
return;
}
var blocks = new Blocks(method);
int numRemovedLocals = 0;
int oldNumInstructions = method.Body.Instructions.Count;
deob.deobfuscateMethodBegin(blocks);
if (options.ControlFlowDeobfuscation)
{
cflowDeobfuscator.init(blocks);
cflowDeobfuscator.deobfuscate();
}
if (deob.deobfuscateOther(blocks) && options.ControlFlowDeobfuscation)
{
cflowDeobfuscator.deobfuscate();
}
if (options.ControlFlowDeobfuscation)
{
numRemovedLocals = blocks.optimizeLocals();
blocks.repartitionBlocks();
}
deobfuscateStrings(blocks);
deob.deobfuscateMethodEnd(blocks);
IList <Instruction> allInstructions;
IList <ExceptionHandler> allExceptionHandlers;
blocks.getCode(out allInstructions, out allExceptionHandlers);
DotNetUtils.restoreBody(method, allInstructions, allExceptionHandlers);
if (numRemovedLocals > 0)
{
Log.v("Removed {0} unused local(s)", numRemovedLocals);
}
int numRemovedInstructions = oldNumInstructions - method.Body.Instructions.Count;
if (numRemovedInstructions > 0)
{
Log.v("Removed {0} dead instruction(s)", numRemovedInstructions);
}
const Log.LogLevel dumpLogLevel = Log.LogLevel.veryverbose;
if (Log.isAtLeast(dumpLogLevel))
{
Log.log(dumpLogLevel, "Deobfuscated code:");
Log.indent();
methodPrinter.print(dumpLogLevel, allInstructions, allExceptionHandlers);
Log.deIndent();
}
}
void deobfuscateMethods()
{
if (savedMethodBodies != null)
{
savedMethodBodies.restoreAll();
savedMethodBodies = null;
}
deob.DeobfuscatedFile = null;
if (!options.ControlFlowDeobfuscation)
{
// If it's the unknown type, we don't remove any types that could cause Mono.Cecil
// to throw an exception.
if (deob.Type == "un" || options.KeepObfuscatorTypes)
{
return;
}
}
Log.v("Deobfuscating methods");
var methodPrinter = new MethodPrinter();
var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators);
foreach (var method in getAllMethods())
{
Log.v("Deobfuscating {0} ({1:X8})", Utils.removeNewlines(method), method.MetadataToken.ToUInt32());
Log.indent();
int oldIndentLevel = Log.indentLevel;
try {
deobfuscate(method, cflowDeobfuscator, methodPrinter);
}
catch (ApplicationException) {
throw;
}
catch (Exception ex) {
if (!canLoadMethodBody(method))
{
Log.v("Invalid method body. {0:X8}", method.MetadataToken.ToInt32());
method.Body = new MethodBody(method);
}
else
{
Log.w("Could not deobfuscate method {0:X8}. Hello, E.T.: {1}", // E.T. = exception type
method.MetadataToken.ToInt32(),
ex.GetType());
}
}
finally {
Log.indentLevel = oldIndentLevel;
}
removeNoInliningAttribute(method);
Log.deIndent();
}
}
void ISimpleDeobfuscator.Deobfuscate(MethodDef method, bool force)
{
if (method == null || (!force && Check(method, SimpleDeobFlags.HasDeobfuscated)))
{
return;
}
Deobfuscate(method, "Deobfuscating control flow", (blocks) => {
var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators);
cflowDeobfuscator.Initialize(blocks);
cflowDeobfuscator.Deobfuscate();
});
}
void ISimpleDeobfuscator.deobfuscate(MethodDef method, bool force)
{
if (!force && check(method, SimpleDeobFlags.HasDeobfuscated))
{
return;
}
deobfuscate(method, "Deobfuscating control flow", (blocks) => {
var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators);
cflowDeobfuscator.init(blocks);
cflowDeobfuscator.deobfuscate();
});
}
private static void ControlFlowClean()
{
try
{
foreach (ModuleDef module in Globals.ASM.Modules) //Go through all the modules in the assembly
{
foreach (TypeDef type in module.GetTypes()) //Go through all the type and nested types in the module
{
foreach (MethodDef method in type.Methods) //Go through all the methods in the type
{
if (method.HasBody && ContainsControlFlow(method)) //Check to see if the method has a body and it contains a (Switch) opcode which is used in the Agile controlflow
{
for (int i = 0; i < 1; i++)
{
CfDeob = new BlocksCflowDeobfuscator();
Blocks blocks = new Blocks(method);
List <Block> test = blocks.MethodBlocks.GetAllBlocks();
blocks.RemoveDeadBlocks();
blocks.RepartitionBlocks();
blocks.UpdateBlocks();
blocks.Method.Body.SimplifyBranches();
blocks.Method.Body.OptimizeBranches();
CfDeob.Initialize(blocks);
//CfDeob.Deobfuscate();
CfDeob.Add(new ControlFlow());
// CfDeob.Add(new Cflow());
CfDeob.Deobfuscate();
blocks.RepartitionBlocks();
IList <Instruction> instructions;
IList <ExceptionHandler> exceptionHandlers;
blocks.GetCode(out instructions, out exceptionHandlers);
DotNetUtils.RestoreBody(method, instructions, exceptionHandlers);
}
controlflowCleaned++;
}
}
}
}
}
catch (Exception ex)
{
Console.ForegroundColor = ConsoleColor.Red;
Console.WriteLine("[-] Looks like something bad happened in the controlflow phase, please contact me to fix this issue.");
}
Console.ForegroundColor = ConsoleColor.Green;
Console.WriteLine(string.Format("[+] Controlflow cleaned in {0} methods", controlflowCleaned));
}
//Removing Control Flow
public static void Cleaner(MethodDef method)
{
BlocksCflowDeobfuscator blocksCflowDeobfuscator = new BlocksCflowDeobfuscator();
Blocks blocks = new Blocks(method);
blocksCflowDeobfuscator.Initialize(blocks);
blocksCflowDeobfuscator.Deobfuscate();
blocks.RepartitionBlocks();
IList <Instruction> list;
IList <ExceptionHandler> exceptionHandlers;
blocks.GetCode(out list, out exceptionHandlers);
DotNetUtils.RestoreBody(method, list, exceptionHandlers);
}
void ISimpleDeobfuscator.deobfuscate(MethodDefinition method)
{
if (check(method, SimpleDeobFlags.HasDeobfuscated))
{
return;
}
deobfuscate(method, "Deobfuscating control flow", (blocks) => {
var cflowDeobfuscator = new BlocksCflowDeobfuscator {
MethodCallInliner = deob.MethodCallInliner
};
cflowDeobfuscator.init(blocks);
cflowDeobfuscator.deobfuscate();
});
}
void ISimpleDeobfuscator.Deobfuscate(MethodDef method, SimpleDeobfuscatorFlags flags)
{
bool force = (flags & SimpleDeobfuscatorFlags.Force) != 0;
if (method == null || (!force && Check(method, SimpleDeobFlags.HasDeobfuscated)))
{
return;
}
Deobfuscate(method, "Deobfuscating control flow", (blocks) => {
bool disableNewCFCode = (flags & SimpleDeobfuscatorFlags.DisableConstantsFolderExtraInstrs) != 0;
var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators, disableNewCFCode);
cflowDeobfuscator.Initialize(blocks);
cflowDeobfuscator.Deobfuscate();
});
}
public static (int, int) RemoveCF(ModuleDef moduleDef)
{
int success = 0;
int failed = 0;
foreach (TypeDef type in moduleDef.GetTypes())
{
foreach (MethodDef method in type.Methods)
{
if (method.HasBody && HasCF(method))
{
try
{
var cflowDeobfuscator = new BlocksCflowDeobfuscator();
Blocks blocks = new Blocks(method);
List <Block> test = blocks.MethodBlocks.GetAllBlocks();
blocks.RemoveDeadBlocks();
blocks.RepartitionBlocks();
blocks.UpdateBlocks();
blocks.Method.Body.OptimizeBranches();
blocks.UpdateBlocks();
blocks.Method.Body.SimplifyBranches();
blocks.UpdateBlocks();
cflowDeobfuscator.Initialize(blocks);
cflowDeobfuscator.Add(new ControlFlow_BlockDeobfuscator());
cflowDeobfuscator.Deobfuscate();
blocks.RepartitionBlocks();
IList <Instruction> instructions;
IList <ExceptionHandler> exceptionHandlers;
blocks.GetCode(out instructions, out exceptionHandlers);
DotNetUtils.RestoreBody(method, instructions, exceptionHandlers);
success++;
}
catch (Exception e)
{
Console.WriteLine($"Failed to deobfuscate {method.DeclaringType.Name}:{method.Name} with exception: {e.Message}");
failed++;
}
}
}
}
return(success, failed);
}
public static void BlockDeobfuscator(MethodDef methodDef)
{
var cfDeob = new BlocksCflowDeobfuscator();
var blocks = new Blocks(methodDef);
blocks.RemoveDeadBlocks();
blocks.RepartitionBlocks();
blocks.UpdateBlocks();
blocks.Method.Body.SimplifyBranches();
blocks.Method.Body.OptimizeBranches();
cfDeob.Initialize(blocks);
cfDeob.Deobfuscate();
blocks.RepartitionBlocks();
blocks.RemoveDeadBlocks();
blocks.OptimizeLocals();
blocks.Method.Body.SimplifyBranches();
blocks.Method.Body.OptimizeBranches();
blocks.GetCode(out var instructions, out var exceptionHandlers);
DotNetUtils.RestoreBody(methodDef, instructions, exceptionHandlers);
}
public static void CFLow()
{
foreach (TypeDef type in module.Types)
{
foreach (MethodDef method in type.Methods)
{
if (method.HasBody == false)
{
continue;
}
BlocksCflowDeobfuscator blocksCflowDeobfuscator = new BlocksCflowDeobfuscator();
Blocks blocks = new Blocks(method);
blocksCflowDeobfuscator.Initialize(blocks);
blocksCflowDeobfuscator.Deobfuscate();
blocks.RepartitionBlocks();
IList <Instruction> list;
IList <ExceptionHandler> exceptionHandlers;
blocks.GetCode(out list, out exceptionHandlers);
DotNetUtils.RestoreBody(method, list, exceptionHandlers);
}
}
}
void DeobfuscateMethods()
{
if (savedMethodBodies != null)
{
savedMethodBodies.RestoreAll();
savedMethodBodies = null;
}
deob.DeobfuscatedFile = null;
if (!options.ControlFlowDeobfuscation)
{
if (options.KeepObfuscatorTypes || deob.Type == "un")
{
return;
}
}
bool isVerbose = !Logger.Instance.IgnoresEvent(LoggerEvent.Verbose);
bool isVV = !Logger.Instance.IgnoresEvent(LoggerEvent.VeryVerbose);
if (isVerbose)
{
Logger.v("Deobfuscating methods");
}
var methodPrinter = new MethodPrinter();
var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators);
foreach (var method in GetAllMethods())
{
if (isVerbose)
{
Logger.v("Deobfuscating {0} ({1:X8})", Utils.RemoveNewlines(method), method.MDToken.ToUInt32());
Logger.Instance.Indent();
}
int oldIndentLevel = Logger.Instance.IndentLevel;
try {
Deobfuscate(method, cflowDeobfuscator, methodPrinter, isVerbose, isVV);
}
catch (Exception ex) {
if (!CanLoadMethodBody(method))
{
if (isVerbose)
{
Logger.v("Invalid method body. {0:X8}", method.MDToken.ToInt32());
}
method.Body = new CilBody();
}
else
{
Logger.w("Could not deobfuscate method {0:X8}. Hello, E.T.: {1}", // E.T. = exception type
method.MDToken.ToInt32(),
ex.GetType());
}
}
finally {
Logger.Instance.IndentLevel = oldIndentLevel;
}
RemoveNoInliningAttribute(method);
if (isVerbose)
{
Logger.Instance.DeIndent();
}
}
}
private void unpack(ModuleDef module)
{
this.methods = new List <MethodDef>();
if (module.HasTypes)
{
foreach (TypeDef type in module.Types)
{
this.AddMethods(type);
}
}
BlocksCflowDeobfuscator blocksCflowDeobfuscator = new BlocksCflowDeobfuscator();
for (int i = 0; i < this.methods.Count; i++)
{
Blocks blocks = new Blocks(this.methods[i]);
blocksCflowDeobfuscator.Initialize(blocks);
blocksCflowDeobfuscator.Deobfuscate();
blocks.RepartitionBlocks();
IList <Instruction> list;
IList <ExceptionHandler> exceptionHandlers;
blocks.GetCode(out list, out exceptionHandlers);
DotNetUtils.RestoreBody(this.methods[i], list, exceptionHandlers);
}
for (int i = 0; i < this.methods.Count; i++)
{
for (int j = 0; j < this.methods[i].Body.Instructions.Count; j++)
{
if (this.methods[i].Body.Instructions[j].IsLdcI4() && j + 1 < this.methods[i].Body.Instructions.Count && this.methods[i].Body.Instructions[j + 1].OpCode == OpCodes.Pop)
{
this.methods[i].Body.Instructions[j].OpCode = OpCodes.Nop;
this.methods[i].Body.Instructions[j + 1].OpCode = OpCodes.Nop;
for (int k = 0; k < this.methods[i].Body.Instructions.Count; k++)
{
if (this.methods[i].Body.Instructions[k].OpCode == OpCodes.Br || this.methods[i].Body.Instructions[k].OpCode == OpCodes.Br_S)
{
if (this.methods[i].Body.Instructions[k].Operand is Instruction)
{
Instruction instruction = this.methods[i].Body.Instructions[k].Operand as Instruction;
if (instruction == this.methods[i].Body.Instructions[j + 1])
{
if (k - 1 >= 0 && this.methods[i].Body.Instructions[k - 1].IsLdcI4())
{
this.methods[i].Body.Instructions[k - 1].OpCode = OpCodes.Nop;
}
}
}
}
}
}
if (this.methods[i].Body.Instructions[j].OpCode == OpCodes.Dup && j + 1 < this.methods[i].Body.Instructions.Count && this.methods[i].Body.Instructions[j + 1].OpCode == OpCodes.Pop)
{
this.methods[i].Body.Instructions[j].OpCode = OpCodes.Nop;
this.methods[i].Body.Instructions[j + 1].OpCode = OpCodes.Nop;
for (int k = 0; k < this.methods[i].Body.Instructions.Count; k++)
{
if (this.methods[i].Body.Instructions[k].OpCode == OpCodes.Br || this.methods[i].Body.Instructions[k].OpCode == OpCodes.Br_S)
{
if (this.methods[i].Body.Instructions[k].Operand is Instruction)
{
Instruction instruction = this.methods[i].Body.Instructions[k].Operand as Instruction;
if (instruction == this.methods[i].Body.Instructions[j + 1])
{
if (k - 1 >= 0 && this.methods[i].Body.Instructions[k - 1].OpCode == OpCodes.Dup)
{
this.methods[i].Body.Instructions[k - 1].OpCode = OpCodes.Nop;
}
}
}
}
}
}
}
}
for (int i = 0; i < this.methods.Count; i++)
{
Blocks blocks = new Blocks(this.methods[i]);
blocksCflowDeobfuscator.Initialize(blocks);
blocksCflowDeobfuscator.Deobfuscate();
blocks.RepartitionBlocks();
IList <Instruction> list;
IList <ExceptionHandler> exceptionHandlers;
blocks.GetCode(out list, out exceptionHandlers);
DotNetUtils.RestoreBody(this.methods[i], list, exceptionHandlers);
}
for (int i = 0; i < this.methods.Count; i++)
{
Dictionary <Instruction, Instruction> dictionary = new Dictionary <Instruction, Instruction>();
for (int j = 0; j < this.methods[i].Body.Instructions.Count; j++)
{
if (this.methods[i].Body.Instructions[j].IsConditionalBranch())
{
Instruction instruction2 = this.methods[i].Body.Instructions[j];
for (int k = 0; k < this.methods[i].Body.Instructions.Count; k++)
{
if (this.methods[i].Body.Instructions[k].IsBr())
{
Instruction instruction3 = this.methods[i].Body.Instructions[k];
Instruction instruction4 = this.methods[i].Body.Instructions[k].Operand as Instruction;
if (instruction4 == instruction2)
{
if (!dictionary.ContainsKey(instruction4))
{
this.methods[i].Body.Instructions[k].OpCode = instruction2.GetOpCode();
this.methods[i].Body.Instructions[k].Operand = instruction2.GetOperand();
this.methods[i].Body.Instructions.Insert(k + 1, OpCodes.Br.ToInstruction(this.methods[i].Body.Instructions[j + 1]));
k++;
dictionary.Add(instruction4, this.methods[i].Body.Instructions[k]);
}
}
}
}
}
}
this.methods[i].Body.SimplifyBranches();
this.methods[i].Body.OptimizeBranches();
}
for (int i = 0; i < this.methods.Count; i++)
{
Blocks blocks = new Blocks(this.methods[i]);
blocksCflowDeobfuscator.Initialize(blocks);
blocksCflowDeobfuscator.Deobfuscate();
blocks.RepartitionBlocks();
IList <Instruction> list;
IList <ExceptionHandler> exceptionHandlers;
blocks.GetCode(out list, out exceptionHandlers);
DotNetUtils.RestoreBody(this.methods[i], list, exceptionHandlers);
}
int num = 0;
for (int i = 0; i < this.methods.Count; i++)
{
this.toberemoved = new List <int>();
this.integer_values_1 = new List <int>();
this.tobenooped_start = new List <int>();
this.tobenooped_len = new List <int>();
this.for_rem = new List <int>();
this.switchinstructions = new List <Instruction>();
this.wheretojump = new List <Instruction>();
for (int j = 0; j < this.methods[i].Body.Instructions.Count; j++)
{
if (j + 2 < this.methods[i].Body.Instructions.Count && this.methods[i].Body.Instructions[j].IsStloc() && (this.methods[i].Body.Instructions[j + 1].IsLdloc() || this.methods[i].Body.Instructions[j + 1].IsLdcI4()) && (this.methods[i].Body.Instructions[j + 2].IsLdcI4() || this.methods[i].Body.Instructions[j + 2].IsLdloc() || this.methods[i].Body.Instructions[j + 2].OpCode == OpCodes.Neg || this.methods[i].Body.Instructions[j + 2].OpCode == OpCodes.Not))
{
int stlocInsIndex = GetStlocInsIndex(this.methods[i].Body.Instructions, j);
if (stlocInsIndex != -1)
{
Instruction instruction5 = this.methods[i].Body.Instructions[stlocInsIndex - 1];
if ((stlocInsIndex - 1 >= 0 && this.methods[i].Body.Instructions[stlocInsIndex - 1].IsBr()) || this.methods[i].Body.Instructions[stlocInsIndex - 1].IsLdloc() || this.methods[i].Body.Instructions[stlocInsIndex - 1].IsLdcI4() || this.methods[i].Body.Instructions[stlocInsIndex - 1].OpCode == OpCodes.Xor)
{
int stlocInsIndex2 = GetStlocInsIndex(this.methods[i].Body.Instructions, stlocInsIndex + 1);
if (stlocInsIndex2 != -1)
{
int switchInsIndex = GetSwitchInsIndex(this.methods[i].Body.Instructions, stlocInsIndex2 + 1);
if (switchInsIndex != -1)
{
this.local_variable1 = this.methods[i].Body.Instructions[stlocInsIndex].GetLocal(this.methods[i].Body.Variables);
this.local_variable2 = this.methods[i].Body.Instructions[stlocInsIndex2].GetLocal(this.methods[i].Body.Variables);
if (this.local_variable1.Type != null && (this.local_variable1.Type.FullName == "System.Int32" || this.local_variable1.Type.FullName == "System.UInt32") && this.local_variable2.Type != null && (this.local_variable2.Type.FullName == "System.Int32" || this.local_variable2.Type.FullName == "System.UInt32"))
{
int num2 = switchInsIndex - j;
this.wheretojump.Add(this.methods[i].Body.Instructions[j]);
this.switchinstructions.Add(this.methods[i].Body.Instructions[switchInsIndex]);
this.tobenooped_start.Add(j);
this.tobenooped_len.Add(num2);
j += num2;
}
}
}
}
}
}
}
if (this.switchinstructions.Count > 0)
{
this.placeintindexes = new List <int>();
this.intvalues = new List <int>();
this.conditionalinstructions = new List <Instruction>();
this.brinstructions = new List <Instruction>();
this.realbrinstructions = new List <Instruction>();
this.instructions = this.methods[i].Body.Instructions;
this.method = this.methods[i];
this.InstructionParse2(0, 0, 0);
num += this.placeintindexes.Count;
for (int k = 0; k < this.placeintindexes.Count; k++)
{
this.methods[i].Body.Instructions[this.placeintindexes[k]].OpCode = OpCodes.Ldc_I4;
this.methods[i].Body.Instructions[this.placeintindexes[k]].Operand = this.intvalues[k];
}
for (int k = 0; k < this.tobenooped_start.Count; k++)
{
for (int l = 0; l < this.tobenooped_len[k]; l++)
{
this.methods[i].Body.Instructions[this.tobenooped_start[k] + l].OpCode = OpCodes.Nop;
}
}
}
this.toberemoved = new List <int>();
this.integer_values_1 = new List <int>();
this.for_rem = new List <int>();
this.switchinstructions = new List <Instruction>();
for (int j = 0; j < this.methods[i].Body.Instructions.Count; j++)
{
if (j + 6 < this.methods[i].Body.Instructions.Count && this.methods[i].Body.Instructions[j].IsLdcI4())
{
if (this.methods[i].Body.Instructions[j + 1].OpCode == OpCodes.Xor)
{
if (this.methods[i].Body.Instructions[j + 2].IsLdcI4())
{
if (this.methods[i].Body.Instructions[j + 3].OpCode == OpCodes.Rem_Un)
{
if (this.methods[i].Body.Instructions[j + 4].OpCode == OpCodes.Switch)
{
this.toberemoved.Add(j);
this.integer_values_1.Add(this.methods[i].Body.Instructions[j].GetLdcI4Value());
this.for_rem.Add(this.methods[i].Body.Instructions[j + 2].GetLdcI4Value());
this.switchinstructions.Add(this.methods[i].Body.Instructions[j + 4]);
}
}
}
}
}
}
if (this.switchinstructions.Count > 0)
{
this.toberemovedindex = new List <int>();
this.toberemovedvalues = new List <int>();
this.conditionalinstructions = new List <Instruction>();
this.brinstructions = new List <Instruction>();
this.realbrinstructions = new List <Instruction>();
this.instructions = this.methods[i].Body.Instructions;
this.method = this.methods[i];
this.InstructionParseNoLocal(0);
num += this.toberemovedindex.Count;
if (this.toberemovedindex.Count > 0)
{
for (int m = 0; m < this.toberemoved.Count; m++)
{
for (int j = 0; j < 4; j++)
{
this.methods[i].Body.Instructions[j + this.toberemoved[m]].OpCode = OpCodes.Nop;
this.methods[i].Body.Instructions[j + this.toberemoved[m]].Operand = null;
}
}
for (int j = 0; j < this.toberemovedindex.Count; j++)
{
this.methods[i].Body.Instructions[this.toberemovedindex[j]].OpCode = OpCodes.Ldc_I4;
this.methods[i].Body.Instructions[this.toberemovedindex[j]].Operand = this.toberemovedvalues[j];
if (!this.methods[i].Body.Instructions[this.toberemovedindex[j] + 1].IsBr())
{
for (int k = 0; k < 4; k++)
{
this.methods[i].Body.Instructions[this.toberemovedindex[j] + k + 1].OpCode = OpCodes.Nop;
this.methods[i].Body.Instructions[this.toberemovedindex[j] + k + 1].Operand = null;
}
}
}
}
}
Blocks blocks = new Blocks(this.methods[i]);
blocksCflowDeobfuscator.Initialize(blocks);
blocksCflowDeobfuscator.Deobfuscate();
blocks.RepartitionBlocks();
IList <Instruction> list;
IList <ExceptionHandler> exceptionHandlers;
blocks.GetCode(out list, out exceptionHandlers);
DotNetUtils.RestoreBody(this.methods[i], list, exceptionHandlers);
this.methods[i].Body.SimplifyBranches();
this.methods[i].Body.OptimizeBranches();
}
for (int i = 0; i < this.methods.Count; i++)
{
Blocks blocks = new Blocks(this.methods[i]);
blocksCflowDeobfuscator.Initialize(blocks);
blocksCflowDeobfuscator.Deobfuscate();
blocks.RepartitionBlocks();
IList <Instruction> list;
IList <ExceptionHandler> exceptionHandlers;
blocks.GetCode(out list, out exceptionHandlers);
DotNetUtils.RestoreBody(this.methods[i], list, exceptionHandlers);
}
}
