// internal void Method21(int param19)
// {
// int metadataToken = param19 + 0x2000000;
// var typeDef = AsmDef.MainModule.Types.First(type => type.MetadataToken.ToInt32() == metadataToken);
// foreach (var fieldDef in typeDef.Fields)
// {
// string name = fieldDef.Name;
// StringBuilder builder = new StringBuilder();
// foreach (char t in name)
// {
// builder.Append((char) (((byte) t) + 0x2f));
// }
// int num3 = int.Parse(builder.ToString(), NumberStyles.HexNumber);
// int num4 = num3 & 0xffffff;
//// ReSharper disable UnusedVariable
// int num5 = num3 >> 0x18;
//// ReSharper restore UnusedVariable
// int num6 = 0xa000000 + num4;
//// ReSharper disable UnusedVariable
// var info2 = AsmDef.FindMethod(mDef => mDef.Resolve().MetadataToken.ToInt32() == num6);
//// ReSharper restore UnusedVariable
// // info.SetValue(null, Method_22(type, info2, num5));
// }
// }
#endregion
public MethodDefinition FindDecryptor()
{
var signature = new ILSignature
{
StartIndex = 0,
StartOpCode = OpCodes.Nop,
Instructions = new List <OpCode>
{
OpCodes.Ldsfld,
OpCodes.Call,
OpCodes.Newarr,
OpCodes.Stloc_0,
OpCodes.Ldc_R8,
OpCodes.Ldsfld,
OpCodes.Call
}
};
return(AsmDef.FindMethod(mDef => SignatureFinder.IsMatch(mDef, signature)));
}
public MethodDefinition FindDecryptor()
{
var signature = new ILSignature
{
StartIndex = 0,
StartOpCode = OpCodes.Nop,
Instructions = new List<OpCode>
{
OpCodes.Ldsfld,
OpCodes.Call,
OpCodes.Newarr,
OpCodes.Stloc_0,
OpCodes.Ldc_R8,
OpCodes.Ldsfld,
OpCodes.Call
}
};
return AsmDef.FindMethod(mDef => SignatureFinder.IsMatch(mDef, signature));
}
public static MethodDefinition FindDecryptor()
{
var signature = new ILSignature
{
StartIndex = 1,
StartOpCode = OpCodes.Nop,
Instructions = new List <OpCode>
{
OpCodes.Callvirt,
OpCodes.Stloc_0,
OpCodes.Ldloc_0,
OpCodes.Newarr,
OpCodes.Stloc_1,
OpCodes.Ldc_I4_0,
OpCodes.Stloc_2
}
};
return(AsmDef.FindMethod(mdef => SignatureFinder.IsMatch(mdef, signature)));
}
public static MethodDefinition FindDecryptor(AssemblyDefinition asmDef)
{
foreach (var modDef in asmDef.Modules)
{
foreach (var typeDef in modDef.Types)
{
foreach (var mDef in typeDef.Methods)
{
var signature = new ILSignature
{
Start = 1,
StartOpCode = OpCodes.Nop,
Instructions = new List <OpCode>
{
OpCodes.Callvirt,
OpCodes.Stloc_0,
OpCodes.Ldloc_0,
OpCodes.Newarr,
OpCodes.Stloc_1,
OpCodes.Ldc_I4_0,
OpCodes.Stloc_2
}
};
if (mDef.HasBody)
{
if (SignatureFinder.IsMatch(mDef, signature))
{
return(mDef);
}
}
}
}
}
return(null);
}
private static List <MethodDefinition> FindDecryptors(AssemblyDefinition asmDef)
{
var signature = new ILSignature
{
Start = 0,
StartOpCode = OpCodes.Ldsfld,
Instructions = new List <OpCode>
{
OpCodes.Ldsfld,
OpCodes.Dup,
OpCodes.Stloc_S,
OpCodes.Call,
OpCodes.Ldarg_0,
OpCodes.Ldc_I4
}
};
var decryptors = new List <MethodDefinition>();
foreach (var modDef in asmDef.Modules)
{
foreach (var typeDef in modDef.Types)
{
foreach (var mDef in typeDef.Methods)
{
if (SignatureFinder.IsMatch(mDef, signature))
{
decryptors.Add(mDef);
}
}
}
}
return(decryptors);
}
private static ISignature IdentifySixxpack(AssemblyDefinition asmDef, out bool found)
{
var signature = new ILSignature
{
StartIndex = 0,
StartOpCode = OpCodes.Nop,
Instructions = new List<OpCode>
{
OpCodes.Stloc_0,
OpCodes.Ldloc_0,
OpCodes.Ldnull,
OpCodes.Ldftn,
OpCodes.Newobj,
OpCodes.Callvirt,
OpCodes.Leave_S,
OpCodes.Pop,
OpCodes.Leave_S,
OpCodes.Ldc_I4_1
}
};
if (SignatureFinder.IsMatch(asmDef.EntryPoint, signature))
{
found = true;
return new Signatures.SixxpackSignature();
}
found = false;
return new Signatures.UnidentifiedSignature();
}
private static ISignature IdentifyRpx(AssemblyDefinition asmDef, out bool found)
{
var signature = new ILSignature
{
StartIndex = 0,
StartOpCode = OpCodes.Nop,
Instructions = new List<OpCode>
{
OpCodes.Call,
OpCodes.Callvirt,
OpCodes.Ldstr,
OpCodes.Callvirt,
OpCodes.Stloc_0,
OpCodes.Ldloc_0,
OpCodes.Ldc_I4_3,
OpCodes.Ldc_I4_1,
OpCodes.Call,
OpCodes.Stloc_1,
OpCodes.Ldloc_1,
OpCodes.Ldstr
}
};
if(SignatureFinder.IsMatch(asmDef.EntryPoint, signature))
{
found = true;
return new Signatures.RpxSignature();
}
found = false;
return new Signatures.UnidentifiedSignature();
}
private static ISignature IdentifyExePack(AssemblyDefinition asmDef, out bool found)
{
//Lets just do the whole method lol
var signature = new ILSignature
{
StartIndex = 0,
StartOpCode = OpCodes.Nop,
Instructions = new List<OpCode>
{
OpCodes.Dup,
OpCodes.Ldnull,
OpCodes.Ldftn,
OpCodes.Newobj,
OpCodes.Callvirt,
OpCodes.Ldstr,
OpCodes.Newobj,
OpCodes.Ldnull,
OpCodes.Ldarg_0,
OpCodes.Callvirt,
OpCodes.Ret
}
};
if (SignatureFinder.IsMatch(asmDef.EntryPoint, signature))
{
found = true;
return new Signatures.ExePackSignature();
}
found = false;
return new Signatures.UnidentifiedSignature();
}