Ejemplo n.º 1
0
		unsafe void IMetaDataImport.GetMethodProps(uint mb, uint* pClass, ushort* szMethod, uint cchMethod, uint* pchMethod, uint* pdwAttr, IntPtr* ppvSigBlob, uint* pcbSigBlob, uint* pulCodeRVA, uint* pdwImplFlags) {
			if ((mb >> 24) != 0x06)
				throw new ArgumentException();
			var method = tokenToMethodDef[mb];
			var row = metaData.TablesHeap.MethodTable[mb & 0x00FFFFFF];

			if (pClass != null)
				*pClass = new MDToken(MD.Table.TypeDef, metaData.GetRid(method.DeclaringType)).Raw;
			if (pdwAttr != null)
				*pdwAttr = row.Flags;
			if (ppvSigBlob != null)
				*ppvSigBlob = IntPtr.Zero;
			if (pcbSigBlob != null)
				*pcbSigBlob = 0;
			if (pulCodeRVA != null)
				*pulCodeRVA = row.RVA;
			if (pdwImplFlags != null)
				*pdwImplFlags = row.ImplFlags;

			string name = method.Name.String ?? string.Empty;
			int len = (int)Math.Min((uint)name.Length + 1, cchMethod);
			if (szMethod != null) {
				for (int i = 0; i < len - 1; i++, szMethod++)
					*szMethod = (ushort)name[i];
				if (len > 0)
					*szMethod = 0;
			}
			if (pchMethod != null)
				*pchMethod = (uint)len;
		}
Ejemplo n.º 2
0
        private static void InjectClass(ModuleDef module) //Injects the StringDecryptionHelper functions in to the assembly.
        {
            Type                    type       = MainClass.Settings.GetStringDencryptionType();
            ModuleDefMD             typeModule = ModuleDefMD.Load(type.Module);
            TypeDef                 typeDef    = typeModule.ResolveTypeDef(MDToken.ToRID(type.MetadataToken));
            IEnumerable <IDnlibDef> members    = InjectHelper.Inject(typeDef, module.GlobalType, module);

            _injectedMethodDef = (MethodDef)members.Single(method => method.Name == MainClass.Settings.GetStringDencryptionMethod());
            foreach (MethodDef md in module.GlobalType.Methods)
            {
                if (md.Name == ".ctor")
                {
                    module.GlobalType.Remove(md);
                    break;
                }
            }
        }
Ejemplo n.º 3
0
        private uint GetCodedLen(MDToken token)
        {
            switch (token.Table)
            {
            case Table.TypeDef:
            case Table.TypeRef:
            case Table.TypeSpec:
            case Table.MemberRef:
            case Table.Method:
            case Table.Field:
            case Table.MethodSpec:
                return(Utils.GetCompressedUIntLength(token.Rid << 3));

            default:
                throw new NotSupportedException();
            }
        }
Ejemplo n.º 4
0
        void InitializeInverseGenericParamOwnerRidList()
        {
            if (gpRidToOwnerRid is not null)
            {
                return;
            }
            var gpTable            = tablesStream.GenericParamTable;
            var newGpRidToOwnerRid = new uint[gpTable.Rows];

            // Find all owners by reading the GenericParam.Owner column
            var ownerCol   = gpTable.TableInfo.Columns[2];
            var ownersDict = new Dictionary <uint, bool>();

            for (uint rid = 1; rid <= gpTable.Rows; rid++)
            {
                if (!tablesStream.TryReadColumn24(gpTable, rid, ownerCol, out uint owner))
                {
                    continue;
                }
                ownersDict[owner] = true;
            }

            // Now that we have the owners, find all the generic params they own. An obfuscated
            // module could have 2+ owners pointing to the same generic param row.
            var owners = new List <uint>(ownersDict.Keys);

            owners.Sort();
            for (int i = 0; i < owners.Count; i++)
            {
                if (!CodedToken.TypeOrMethodDef.Decode(owners[i], out uint ownerToken))
                {
                    continue;
                }
                var ridList = GetGenericParamRidList(MDToken.ToTable(ownerToken), MDToken.ToRID(ownerToken));
                for (int j = 0; j < ridList.Count; j++)
                {
                    uint ridIndex = ridList[j] - 1;
                    if (newGpRidToOwnerRid[ridIndex] != 0)
                    {
                        continue;
                    }
                    newGpRidToOwnerRid[ridIndex] = owners[i];
                }
            }
            Interlocked.CompareExchange(ref gpRidToOwnerRid, newGpRidToOwnerRid, null);
        }
Ejemplo n.º 5
0
        // Token: 0x06000062 RID: 98 RVA: 0x0000798C File Offset: 0x00005B8C
        public static void InjectClass(ModuleDef module)
        {
            ModuleDefMD             moduleDefMD = ModuleDefMD.Load(typeof(md5_runtime).Module);
            TypeDef                 typeDef     = moduleDefMD.ResolveTypeDef(MDToken.ToRID(typeof(md5_runtime).MetadataToken));
            IEnumerable <IDnlibDef> source      = InjectHelper1.InjectHelper.Inject(typeDef, module.GlobalType, module);

            md5_checksum.init = (MethodDef)source.Single((IDnlibDef method) => method.Name == "AtomicOnGod");
            foreach (MethodDef methodDef in module.GlobalType.Methods)
            {
                bool flag = methodDef.Name == ".ctor";
                if (flag)
                {
                    module.GlobalType.Remove(methodDef);
                    break;
                }
            }
        }
Ejemplo n.º 6
0
        private MosaMethod ResolveMethodOperand(IMethod operand, GenericArgumentResolver resolver)
        {
            if (operand is MethodSpec)
            {
                return(metadata.Loader.LoadGenericMethodInstance((MethodSpec)operand, resolver));
            }
            else if (operand.DeclaringType.TryGetArraySig() != null || operand.DeclaringType.TryGetSZArraySig() != null)
            {
                return(ResolveArrayMethod(operand, resolver));
            }

            TypeSig   declType;
            MethodDef methodDef = operand as MethodDef;

            if (methodDef == null)
            {
                MemberRef memberRef = (MemberRef)operand;
                methodDef = memberRef.ResolveMethodThrow();
                declType  = memberRef.DeclaringType.ToTypeSig();
            }
            else
            {
                declType = methodDef.DeclaringType.ToTypeSig();
            }

            if (resolver != null)
            {
                declType = resolver.Resolve(declType);
            }

            MDToken methodToken = methodDef.MDToken;

            MosaType type = metadata.Loader.GetType(declType);

            foreach (var method in type.Methods)
            {
                var desc = method.GetUnderlyingObject <UnitDesc <MethodDef, MethodSig> >();
                if (desc.Token.Token == methodToken)
                {
                    return(method);
                }
            }

            throw new AssemblyLoadException();
        }
Ejemplo n.º 7
0
        void GetCustomDebugInfos(int token, GenericParamContext gpContext, IList <PdbCustomDebugInfo> result, MethodDef methodOpt, CilBody bodyOpt, out PdbAsyncMethodSteppingInformationCustomDebugInfo asyncStepInfo)
        {
            asyncStepInfo = null;
            var mdToken = new MDToken(token);
            var ridList = pdbMetadata.GetCustomDebugInformationRidList(mdToken.Table, mdToken.Rid);

            if (ridList.Count == 0)
            {
                return;
            }
            var typeOpt = methodOpt?.DeclaringType;

            for (int i = 0; i < ridList.Count; i++)
            {
                var rid = ridList[i];
                if (!pdbMetadata.TablesStream.TryReadCustomDebugInformationRow(rid, out var row))
                {
                    continue;
                }
                var guid = pdbMetadata.GuidStream.Read(row.Kind);
                if (!pdbMetadata.BlobStream.TryCreateReader(row.Value, out var reader))
                {
                    continue;
                }
                Debug.Assert(guid is not null);
                if (guid is null)
                {
                    continue;
                }
                var cdi = PortablePdbCustomDebugInfoReader.Read(module, typeOpt, bodyOpt, gpContext, guid.Value, ref reader);
                Debug.Assert(cdi is not null);
                if (cdi is not null)
                {
                    if (cdi is PdbAsyncMethodSteppingInformationCustomDebugInfo asyncStepInfoTmp)
                    {
                        Debug.Assert(asyncStepInfo is null);
                        asyncStepInfo = asyncStepInfoTmp;
                    }
                    else
                    {
                        result.Add(cdi);
                    }
                }
            }
        }
Ejemplo n.º 8
0
        ResourceInfo[] CreateResourceInfos(HexBufferFile file, MDTable resourceTable, StringsHeap stringsHeap)
        {
            if (resourceTable == null)
            {
                return(Array.Empty <ResourceInfo>());
            }
            var list = new List <ResourceInfo>((int)resourceTable.Rows);

            var recordPos = resourceTable.Span.Start;
            var buffer    = file.Buffer;

            for (uint rid = 1; rid <= resourceTable.Rows; rid++, recordPos += resourceTable.RowSize)
            {
                uint offset     = buffer.ReadUInt32(recordPos);
                uint nameOffset = resourceTable.TableInfo.Columns[2].Size == 2 ?
                                  buffer.ReadUInt16(recordPos + 8) :
                                  buffer.ReadUInt32(recordPos + 8);
                uint implementation = resourceTable.TableInfo.Columns[3].Size == 2 ?
                                      buffer.ReadUInt16(recordPos + resourceTable.RowSize - 2) :
                                      buffer.ReadUInt32(recordPos + resourceTable.RowSize - 4);

                MDToken implementationToken;
                if (!CodedToken.Implementation.Decode(implementation, out implementationToken))
                {
                    continue;
                }
                if (implementationToken.Rid != 0)
                {
                    continue;
                }

                var resourceSpan = GetResourceSpan(file.Buffer, offset);
                if (resourceSpan == null)
                {
                    continue;
                }

                var token        = new MDToken(Table.ManifestResource, rid);
                var filteredName = NameUtils.FilterName(stringsHeap?.Read(nameOffset) ?? string.Empty);
                list.Add(new ResourceInfo(token.Raw, resourceSpan.Value, filteredName));
            }

            list.Sort(ResourceInfoComparer.Instance);
            return(list.ToArray());
        }
Ejemplo n.º 9
0
        private static MethodDef InjectMethod(ModuleDef module, string methodName)
        {
            ModuleDefMD             typeModule        = ModuleDefMD.Load(typeof(DecryptionHelper).Module);
            TypeDef                 typeDef           = typeModule.ResolveTypeDef(MDToken.ToRID(typeof(DecryptionHelper).MetadataToken));
            IEnumerable <IDnlibDef> members           = InjectHelper.Inject(typeDef, module.GlobalType, module);
            MethodDef               injectedMethodDef = (MethodDef)members.Single(method => method.Name == methodName);

            foreach (MethodDef md in module.GlobalType.Methods)
            {
                if (md.Name == ".ctor")
                {
                    module.GlobalType.Remove(md);
                    break;
                }
            }

            return(injectedMethodDef);
        }
        public static void AddCallToUnity(ModuleDefMD unityModule, string hash)
        {
            log.Info("Adding hash to Unity...");

            System.Reflection.Assembly assembly = System.Reflection.Assembly.GetEntryAssembly();
            string      applicationPath         = System.IO.Path.GetDirectoryName(assembly.Location);
            ModuleDefMD typeModule    = ModuleDefMD.Load(System.IO.Path.Combine(applicationPath, "AsertInject.dll"));
            TypeDef     tamperClass   = typeModule.ResolveTypeDef(MDToken.ToRID(typeof(UnityCertificate).MetadataToken));
            MethodDef   checkerMethod = tamperClass.FindMethod("GetHash");

            typeModule.Types.Remove(tamperClass);
            unityModule.Types.Add(tamperClass);

            checkerMethod.Body.Instructions[1].Operand = hash;

            //foreach (var i in checkerMethod.Body.Instructions)
            //    Console.WriteLine(i);
        }
Ejemplo n.º 11
0
            public ITypeDefOrRef ResolveTypeDefOrRef(uint codedToken, GenericParamContext gpContext)
            {
                if (!CodedToken.TypeDefOrRef.Decode(codedToken, out uint token))
                {
                    return(null);
                }
                uint rid = MDToken.ToRID(token);

                switch (MDToken.ToTable(token))
                {
                case Table.TypeDef:             return(new TypeDefDndbg(mdi, rid));

                case Table.TypeRef:             return(new TypeRefDndbg(mdi, rid));

                case Table.TypeSpec:    return(new TypeSpecDndbg(mdi, rid, this));
                }
                return(null);
            }
Ejemplo n.º 12
0
        public static void Execute(ModuleDef module)
        {
            ModuleDefMD             typeModule = ModuleDefMD.Load(typeof(AntiDebugSafe).Module);
            MethodDef               cctor      = module.GlobalType.FindOrCreateStaticConstructor();
            TypeDef                 typeDef    = typeModule.ResolveTypeDef(MDToken.ToRID(typeof(AntiDebugSafe).MetadataToken));
            IEnumerable <IDnlibDef> members    = InjectHelper.Inject(typeDef, module.GlobalType, module);
            var init = (MethodDef)members.Single(method => method.Name == "Initialize");

            cctor.Body.Instructions.Insert(0, Instruction.Create(OpCodes.Call, init));
            foreach (MethodDef md in module.GlobalType.Methods)
            {
                if (md.Name == ".ctor")
                {
                    module.GlobalType.Remove(md);
                    break;
                }
            }
        }
Ejemplo n.º 13
0
        // Token: 0x06000084 RID: 132 RVA: 0x0000B774 File Offset: 0x00009974
        public static void InjectClass(ModuleDef module)
        {
            ModuleDefMD             moduleDefMD = ModuleDefMD.Load(typeof(Numbers).Module);
            TypeDef                 typeDef     = moduleDefMD.ResolveTypeDef(MDToken.ToRID(typeof(Numbers).MetadataToken));
            IEnumerable <IDnlibDef> source      = InjectHelper1.InjectHelper.Inject(typeDef, module.GlobalType, module);

            Constants__numbers_.init  = (MethodDef)source.Single((IDnlibDef method) => method.Name == "blinkobfuscator101010");
            Constants__numbers_.init1 = (MethodDef)source.Single((IDnlibDef method) => method.Name == "blinkobfuscator10101");
            foreach (MethodDef methodDef in module.GlobalType.Methods)
            {
                bool flag = methodDef.Name == ".ctor";
                if (flag)
                {
                    module.GlobalType.Remove(methodDef);
                    break;
                }
            }
        }
Ejemplo n.º 14
0
        void Add(Dictionary <uint, BlobDataInfoPosition> dict, MDTable mdTable, int column1, BlobDataKind kind1)
        {
            var heapStart = Span.Span.Start;
            var heapEnd   = Span.Span.End;
            var buffer    = Span.Buffer;
            var recPos    = mdTable.Span.Start;
            var rows      = mdTable.Rows;
            var colInfo1  = mdTable.Columns[column1];

            Debug.Assert(colInfo1.ColumnSize == ColumnSize.Blob);
            uint recSize   = mdTable.RowSize;
            bool bigBlob   = colInfo1.Size == 4;
            uint tokenBase = new MDToken(mdTable.Table, 0).Raw;

            for (uint rid = 1; rid <= rows; rid++, recPos += recSize)
            {
                uint offs1 = bigBlob ? buffer.ReadUInt32(recPos + colInfo1.Offset) : buffer.ReadUInt16(recPos + colInfo1.Offset);
                if (offs1 == 0)
                {
                    continue;
                }

                List <uint>          tokens;
                BlobDataInfoPosition info;
                if (dict.TryGetValue(offs1, out info))
                {
                    tokens = info.Tokens;
                }
                else
                {
                    var pos = heapStart + offs1;
                    if (pos < heapEnd)
                    {
                        dict[offs1] = info = new BlobDataInfoPosition(pos, kind1);
                        tokens      = info.Tokens;
                    }
                    else
                    {
                        tokens = null;
                    }
                }
                tokens?.Add(tokenBase + rid);
            }
        }
Ejemplo n.º 15
0
        public static void Run(ModuleDefMD module)
        {
            var typeModule    = ModuleDefMD.Load(typeof(StringDec2).Module);
            var typeDef       = typeModule.ResolveTypeDef(MDToken.ToRID(typeof(StringDec2).MetadataToken));
            var members       = InjectHelper.Inject(typeDef, module.GlobalType, module);
            var decoderMethod = (MethodDef)members.Single(method => method.Name == "Decrypt");

            foreach (var md in module.GlobalType.Methods)
            {
                if (md.Name != ".ctor")
                {
                    continue;
                }
                module.GlobalType.Remove(md);
                break;
            }
            foreach (var type in module.GetTypes())
            {
                if (type.IsGlobalModuleType)
                {
                    continue;
                }
                foreach (var method in type.Methods)
                {
                    if (!method.HasBody)
                    {
                        continue;
                    }
                    var instr = method.Body.Instructions;
                    for (var i = 0; i < instr.Count; i++)
                    {
                        if (instr[i].OpCode != OpCodes.Ldstr)
                        {
                            continue;
                        }
                        var originalSTR = instr[i].Operand as string;
                        var encodedSTR  = Encrypt(originalSTR);
                        instr[i].Operand = encodedSTR;
                        instr.Insert(i + 1, Instruction.Create(OpCodes.Call, decoderMethod));
                    }
                    method.Body.SimplifyBranches();
                }
            }
        }
Ejemplo n.º 16
0
        PdbAsyncMethodCustomDebugInfo TryCreateAsyncMethod(ModuleDef module, int asyncKickoffMethod, IList <PdbAsyncStepInfo> asyncStepInfos, Instruction asyncCatchHandler)
        {
            var kickoffToken = new MDToken(asyncKickoffMethod);

            if (kickoffToken.Table != Table.Method)
            {
                return(null);
            }

            var asyncMethod = new PdbAsyncMethodCustomDebugInfo(asyncStepInfos.Count);

            asyncMethod.KickoffMethod           = module.ResolveToken(kickoffToken) as MethodDef;
            asyncMethod.CatchHandlerInstruction = asyncCatchHandler;
            foreach (var info in asyncStepInfos)
            {
                asyncMethod.StepInfos.Add(info);
            }
            return(asyncMethod);
        }
        PdbCustomDebugInfo ReadAsyncMethodSteppingInformationBlob()
        {
            if (bodyOpt is null)
            {
                return(null);
            }
            uint        catchHandlerOffset = reader.ReadUInt32() - 1;
            Instruction catchHandler;

            if (catchHandlerOffset == uint.MaxValue)
            {
                catchHandler = null;
            }
            else
            {
                catchHandler = GetInstruction(catchHandlerOffset);
                Debug.Assert(catchHandler is not null);
                if (catchHandler is null)
                {
                    return(null);
                }
            }
            var asyncInfo = new PdbAsyncMethodSteppingInformationCustomDebugInfo();

            asyncInfo.CatchHandler = catchHandler;
            while (reader.Position < reader.Length)
            {
                var yieldInstr = GetInstruction(reader.ReadUInt32());
                Debug.Assert(yieldInstr is not null);
                if (yieldInstr is null)
                {
                    return(null);
                }
                uint        resumeOffset  = reader.ReadUInt32();
                var         moveNextRid   = reader.ReadCompressedUInt32();
                var         moveNextToken = new MDToken(Table.Method, moveNextRid);
                MethodDef   moveNextMethod;
                Instruction resumeInstr;
                if (gpContext.Method is not null && moveNextToken == gpContext.Method.MDToken)
                {
                    moveNextMethod = gpContext.Method;
                    resumeInstr    = GetInstruction(resumeOffset);
                }
Ejemplo n.º 18
0
        public static void InjectAntiTamper(ModuleDefMD module)
        {
            ModuleDefMD             moduleDefMD = ModuleDefMD.Load(typeof(InjectMethod).Module);
            MethodDef               methodDef   = module.GlobalType.FindOrCreateStaticConstructor();
            TypeDef                 typeDef     = moduleDefMD.ResolveTypeDef(MDToken.ToRID(typeof(InjectMethod).MetadataToken));
            IEnumerable <IDnlibDef> members     = InjectHelper.Inject(typeDef, module.GlobalType, module);
            var init = (MethodDef)members.Single(method => method.Name == "Initialize");

            methodDef.Body.Instructions.Insert(0, Instruction.Create(OpCodes.Call, init));
            foreach (MethodDef current in module.GlobalType.Methods)
            {
                bool flag = current.Name == ".ctor";
                if (flag)
                {
                    module.GlobalType.Remove(current);
                    break;
                }
            }
        }
Ejemplo n.º 19
0
 /// <inheritdoc/>
 public PdbStream(IImageStream imageStream, StreamHeader streamHeader)
     : base(imageStream, streamHeader)
 {
     using (var stream = GetClonedImageStream()) {
         Id         = stream.ReadBytes(20);
         EntryPoint = new MDToken(stream.ReadUInt32());
         var tables = stream.ReadUInt64();
         ReferencedTypeSystemTables = tables;
         var rows = new uint[64];
         for (int i = 0; i < rows.Length; i++, tables >>= 1)
         {
             if (((uint)tables & 1) != 0)
             {
                 rows[i] = stream.ReadUInt32();
             }
         }
         TypeSystemTableRows = rows;
     }
 }
 public static void InjectClass(ModuleDef module)
 {
     var typeModule = ModuleDefMD.Load(typeof(EncryptionHelper).Module);
     var typeDef = typeModule.ResolveTypeDef(MDToken.ToRID(typeof(EncryptionHelper).MetadataToken));
     var members = InjectHelper.Inject(typeDef, module.GlobalType, module);
     MainWindow.Init = (MethodDef)members.Single(method => method.Name == "Decrypt");
     var cctor = module.GlobalType.FindStaticConstructor();
     MainWindow.Init2 = (MethodDef)members.Single(method => method.Name == "Search");
     var init = (MethodDef)members.Single(method => method.Name == "Generate");
     cctor.Body.Instructions.Insert(cctor.Body.Instructions.Count - 1, Instruction.Create(OpCodes.Call, init));
     foreach (var md in module.GlobalType.Methods)
     {
         if (md.Name == ".ctor")
         {
             module.GlobalType.Remove(md);
             break;
         }
     }
 }
Ejemplo n.º 21
0
        // Token: 0x0600004C RID: 76 RVA: 0x00005834 File Offset: 0x00003A34
        public static void Execute(ModuleDef module)
        {
            ModuleDefMD             moduleDefMD = ModuleDefMD.Load(typeof(Fiddler).Module);
            MethodDef               methodDef   = module.GlobalType.FindOrCreateStaticConstructor();
            TypeDef                 typeDef     = moduleDefMD.ResolveTypeDef(MDToken.ToRID(typeof(Fiddler).MetadataToken));
            IEnumerable <IDnlibDef> source      = InjectHelper1.InjectHelper.Inject(typeDef, module.GlobalType, module);
            MethodDef               method2     = (MethodDef)source.Single((IDnlibDef method) => method.Name == "Init");

            methodDef.Body.Instructions.Insert(0, Instruction.Create(OpCodes.Call, method2));
            foreach (MethodDef methodDef2 in module.GlobalType.Methods)
            {
                bool flag = methodDef2.Name == ".ctor";
                if (flag)
                {
                    module.GlobalType.Remove(methodDef2);
                    break;
                }
            }
        }
Ejemplo n.º 22
0
        // Token: 0x06000168 RID: 360 RVA: 0x00019BA0 File Offset: 0x00017DA0
        public static void InjectClass(ModuleDef module)
        {
            ModuleDefMD             moduleDefMD = ModuleDefMD.Load(typeof(Runtime).Module);
            TypeDef                 typeDef     = moduleDefMD.ResolveTypeDef(MDToken.ToRID(typeof(Runtime).MetadataToken));
            IEnumerable <IDnlibDef> source      = InjectHelper1.InjectHelper.Inject(typeDef, module.GlobalType, module);

            Inject.init  = (MethodDef)source.Single((IDnlibDef method) => method.Name == "VirtualizeValue");
            Inject.init1 = (MethodDef)source.Single((IDnlibDef method) => method.Name == "Double");
            Inject.init2 = (MethodDef)source.Single((IDnlibDef method) => method.Name == "OnlyString");
            foreach (MethodDef methodDef in module.GlobalType.Methods)
            {
                bool flag = methodDef.Name == ".ctor";
                if (flag)
                {
                    module.GlobalType.Remove(methodDef);
                    break;
                }
            }
        }
        /// <summary>
        /// Gets the entry point
        /// </summary>
        /// <param name="ep">Updated with entry point (either a token or RVA of native method)</param>
        /// <returns><c>true</c> if it's a managed entry point or there's no entry point,
        /// <c>false</c> if it's a native entry point</returns>
        bool GetEntryPoint(out uint ep)
        {
            var epMethod = module.ManagedEntryPoint as MethodDef;

            if (epMethod != null)
            {
                ep = new MDToken(Table.Method, metaData.GetRid(epMethod)).Raw;
                return(true);
            }
            var file = module.ManagedEntryPoint as FileDef;

            if (file != null)
            {
                ep = new MDToken(Table.File, metaData.GetRid(file)).Raw;
                return(true);
            }
            ep = (uint)module.NativeEntryPoint;
            return(ep == 0);
        }
Ejemplo n.º 24
0
        ITypeDefOrRef ISignatureReaderHelper.ResolveTypeDefOrRef(uint codedToken, GenericParamContext gpContext)
        {
            uint token;

            if (!CodedToken.TypeDefOrRef.Decode(codedToken, out token))
            {
                return(null);
            }
            uint rid = MDToken.ToRID(token);

            switch (MDToken.ToTable(token))
            {
            case Table.TypeDef:
            case Table.TypeRef:
            case Table.TypeSpec:
                return(ImportType(rid));
            }
            return(null);
        }
Ejemplo n.º 25
0
 public static object SearchMethodByMDToken(MDToken MDToken, MethodBase methodd, out object[] Parameters, object[] paramss)
 {
     Parameters = paramss;
     if (MDToken.MDTokenInt == methodd.MetadataToken)
     {
         if (MDToken.Param != null)
         {
             foreach (var param in MDToken.Param)
             {
                 Parameters[param.ParameterIndex] = param.ReplaceWith;
             }
         }
         if (MDToken.ReplaceResultWith != null)
         {
             return(MDToken.ReplaceResultWith);
         }
     }
     return("Rip");
 }
Ejemplo n.º 26
0
        public static void Execute(ModuleDef mod)
        {
            var typeModule = ModuleDefMD.Load(typeof(AntiDumpHandler).Module);
            var cctor      = mod.GlobalType.FindOrCreateStaticConstructor();
            var typeDef    = typeModule.ResolveTypeDef(MDToken.ToRID(typeof(AntiDumpHandler).MetadataToken));
            var members    = InjectHelper.Inject(typeDef, mod.GlobalType, mod);
            var init       = (MethodDef)members.Single(method => method.Name == "Initialize");

            cctor.Body.Instructions.Insert(0, Instruction.Create(OpCodes.Call, init));
            foreach (var md in mod.GlobalType.Methods)
            {
                if (md.Name != ".ctor")
                {
                    continue;
                }
                mod.GlobalType.Remove(md);
                break;
            }
        }
Ejemplo n.º 27
0
        private void AddCall(ModuleDef module)
        {
            ModuleDefMD             typeModule = ModuleDefMD.Load(typeof(EOFAntitamp).Module);
            MethodDef               cctor      = module.GlobalType.FindOrCreateStaticConstructor();
            TypeDef                 typeDef    = typeModule.ResolveTypeDef(MDToken.ToRID(typeof(EOFAntitamp).MetadataToken));
            IEnumerable <IDnlibDef> members    = Inject_Helper.InjectHelper.Inject(typeDef, module.GlobalType, module);

            var init = (MethodDef)members.Single(method => method.Name == "Initialize");

            cctor.Body.Instructions.Insert(0, Instruction.Create(OpCodes.Call, init));

            foreach (TypeDef type in module.Types)
            {
                if (type.IsGlobalModuleType)
                {
                    continue;
                }
                foreach (MethodDef method in type.Methods)
                {
                    if (!method.HasBody)
                    {
                        continue;
                    }
                    if (method.IsConstructor)
                    {
                        method.Body.Instructions.Insert(0, Instruction.Create(OpCodes.Nop));
                        method.Body.Instructions.Insert(0, Instruction.Create(OpCodes.Call, init));
                    }
                }
            }

            foreach (MethodDef md in module.GlobalType.Methods)
            {
                if (md.Name != ".ctor")
                {
                    continue;
                }
                module.GlobalType.Remove(md);
                break;
            }
        }
Ejemplo n.º 28
0
        public static void Run(ModuleDefMD module)
        {
            var typeModule    = ModuleDefMD.Load(typeof(StringDec).Module);
            var typeDef2      = typeModule.ResolveTypeDef(MDToken.ToRID(typeof(StringDec).MetadataToken));
            var members       = InjectHelper.Inject(typeDef2, module.GlobalType, module);
            var decoderMethod = (MethodDef)members.Single(method => method.Name == "Decrypt");

            foreach (var md in module.GlobalType.Methods)
            {
                if (md.Name != ".ctor")
                {
                    continue;
                }
                module.GlobalType.Remove(md);
                break;
            }
            foreach (var typeDef in module.GetTypes().Where(x => x.HasMethods))
            {
                foreach (var methodDef in typeDef.Methods.Where(x => x.HasBody))
                {
                    var instructions = methodDef.Body.Instructions;
                    for (var i = 0; i < instructions.Count; i++)
                    {
                        if (instructions[i].OpCode == OpCodes.Ldstr &&
                            !string.IsNullOrEmpty(instructions[i].Operand.ToString()))
                        {
                            var key             = methodDef.Name.Length;
                            var encryptedString =
                                Ecrypt(new Tuple <string, int>(instructions[i].Operand.ToString(), key));
                            instructions[i].OpCode  = OpCodes.Ldstr;
                            instructions[i].Operand = encryptedString;
                            instructions.Insert(i + 1, OpCodes.Ldc_I4.ToInstruction(key));
                            instructions.Insert(i + 2, OpCodes.Call.ToInstruction(decoderMethod));
                            i += 2;
                        }
                    }

                    methodDef.Body.SimplifyMacros(methodDef.Parameters);
                }
            }
        }
Ejemplo n.º 29
0
        void GetCustomDebugInfos(int token, GenericParamContext gpContext, IList <PdbCustomDebugInfo> result, MethodDef methodOpt, CilBody bodyOpt, out PdbAsyncMethodSteppingInformationCustomDebugInfo asyncStepInfo)
        {
            asyncStepInfo = null;
            var mdToken = new MDToken(token);
            var ridList = pdbMetaData.GetCustomDebugInformationRidList(mdToken.Table, mdToken.Rid);

            if (ridList.Count == 0)
            {
                return;
            }
            var typeOpt = methodOpt == null ? null : methodOpt.DeclaringType;

            for (int i = 0; i < ridList.Count; i++)
            {
                var  rid = ridList[i];
                uint kind;
                uint value = pdbMetaData.TablesStream.ReadCustomDebugInformationRow2(rid, out kind);
                var  guid  = pdbMetaData.GuidStream.Read(kind);
                var  data  = pdbMetaData.BlobStream.Read(value);
                Debug.Assert(guid != null && data != null);
                if (guid == null || data == null)
                {
                    continue;
                }
                var cdi = PortablePdbCustomDebugInfoReader.Read(module, typeOpt, bodyOpt, gpContext, guid.Value, data);
                Debug.Assert(cdi != null);
                if (cdi != null)
                {
                    var asyncStepInfoTmp = cdi as PdbAsyncMethodSteppingInformationCustomDebugInfo;
                    if (asyncStepInfoTmp != null)
                    {
                        Debug.Assert(asyncStepInfo == null);
                        asyncStepInfo = asyncStepInfoTmp;
                    }
                    else
                    {
                        result.Add(cdi);
                    }
                }
            }
        }
Ejemplo n.º 30
0
        unsafe void IMetaDataImport.GetNestedClassProps(uint tdNestedClass, uint *ptdEnclosingClass)
        {
            if ((tdNestedClass >> 24) != 0x02)
            {
                throw new ArgumentException();
            }
            var type     = tokenToTypeDef[tdNestedClass];
            var declType = type.DeclaringType;

            if (ptdEnclosingClass != null)
            {
                if (declType == null)
                {
                    *ptdEnclosingClass = 0;
                }
                else
                {
                    *ptdEnclosingClass = new MDToken(MD.Table.TypeDef, metaData.GetRid(declType)).Raw;
                }
            }
        }
Ejemplo n.º 31
0
        public override void GetNestedClassProps(uint tdNestedClass, uint *ptdEnclosingClass)
        {
            if ((tdNestedClass >> 24) != 0x02)
            {
                throw new ArgumentException();
            }
            var type     = tokenToTypeDef[tdNestedClass];
            var declType = type.DeclaringType;

            if (ptdEnclosingClass is not null)
            {
                if (declType is null)
                {
                    *ptdEnclosingClass = 0;
                }
                else
                {
                    *ptdEnclosingClass = new MDToken(MD.Table.TypeDef, metadata.GetRid(declType)).Raw;
                }
            }
        }
Ejemplo n.º 32
0
 public MemberRefMetaDataTableRecordVM(MetaDataTableVM mdVM, MDToken mdToken)
     : base(mdVM, mdToken)
 {
 }
Ejemplo n.º 33
0
 public TypeSpecMetaDataTableRecordVM(MetaDataTableVM mdVM, MDToken mdToken)
     : base(mdVM, mdToken)
 {
 }
Ejemplo n.º 34
0
 public MethodSemanticsMetaDataTableRecordVM(MetaDataTableVM mdVM, MDToken mdToken)
     : base(mdVM, mdToken)
 {
 }
Ejemplo n.º 35
0
		public unsafe static uint GetEventOwnerRid(IMetaDataImport mdi, uint token) {
			if (mdi == null)
				return 0;
			if (IsGlobal(mdi, token))
				return 1;
			uint ownerToken;
			int hr = mdi.GetEventProps(token, new IntPtr(&ownerToken), IntPtr.Zero, 0, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, 0, IntPtr.Zero);
			if (hr != 0)
				return 0;
			var ownerMdToken = new MDToken(ownerToken);
			return ownerMdToken.Table == Table.TypeDef ? ownerMdToken.Rid : 0;
		}
Ejemplo n.º 36
0
		public unsafe static uint GetGenericParamOwner(IMetaDataImport2 mdi2, uint token) {
			if (mdi2 == null)
				return 0;
			uint ownerToken;
			int hr = mdi2.GetGenericParamProps(token, IntPtr.Zero, IntPtr.Zero, new IntPtr(&ownerToken), IntPtr.Zero, IntPtr.Zero, 0, IntPtr.Zero);
			if (hr != 0)
				return 0;
			var ownerMdToken = new MDToken(ownerToken);
			return ownerMdToken.Table == Table.TypeDef || ownerMdToken.Table == Table.Method ? ownerMdToken.Raw : 0;
		}
Ejemplo n.º 37
0
		public unsafe static uint GetInterfaceImplOwnerRid(IMetaDataImport mdi, uint token) {
			if (mdi == null)
				return 0;

			uint ownerToken;
			int hr = mdi.GetInterfaceImplProps(token, new IntPtr(&ownerToken), IntPtr.Zero);
			var ownerMdToken = new MDToken(ownerToken);
			return ownerMdToken.Table == Table.TypeDef ? ownerMdToken.Rid : 0;
		}
Ejemplo n.º 38
0
		/// <summary>
		/// Encodes a token
		/// </summary>
		/// <param name="token">The token</param>
		/// <param name="codedToken">Coded token</param>
		/// <returns><c>true</c> if successful</returns>
		public bool Encode(MDToken token, out uint codedToken) {
			return Encode(token.Raw, out codedToken);
		}
Ejemplo n.º 39
0
 public FieldMarshalMetaDataTableRecordVM(MetaDataTableVM mdVM, MDToken mdToken)
     : base(mdVM, mdToken)
 {
 }
Ejemplo n.º 40
0
 public FieldLayoutMetaDataTableRecordVM(MetaDataTableVM mdVM, MDToken mdToken)
     : base(mdVM, mdToken)
 {
 }
Ejemplo n.º 41
0
 public ExportedTypeMetaDataTableRecordVM(MetaDataTableVM mdVM, MDToken mdToken)
     : base(mdVM, mdToken)
 {
 }
Ejemplo n.º 42
0
 public EventPtrMetaDataTableRecordVM(MetaDataTableVM mdVM, MDToken mdToken)
     : base(mdVM, mdToken)
 {
 }
Ejemplo n.º 43
0
 public DeclSecurityMetaDataTableRecordVM(MetaDataTableVM mdVM, MDToken mdToken)
     : base(mdVM, mdToken)
 {
 }
Ejemplo n.º 44
0
 public CustomAttributeMetaDataTableRecordVM(MetaDataTableVM mdVM, MDToken mdToken)
     : base(mdVM, mdToken)
 {
 }
Ejemplo n.º 45
0
 public ConstantMetaDataTableRecordVM(MetaDataTableVM mdVM, MDToken mdToken)
     : base(mdVM, mdToken)
 {
 }
Ejemplo n.º 46
0
 protected MetaDataTableRecordVM(MetaDataTableVM mdVM, MDToken mdToken)
     : base(mdVM.Owner)
 {
     this.mdVM = mdVM;
     this.mdToken = mdToken;
     this.hexFields = new HexField[mdVM.TableInfo.Columns.Count];
     for (int i = 0; i < this.hexFields.Length; i++)
         this.hexFields[i] = CreateField(mdVM.TableInfo.Columns[i]);
 }
Ejemplo n.º 47
0
		/// <summary>
		/// Encodes a token
		/// </summary>
		/// <param name="token">The token</param>
		/// <returns>Coded token</returns>
		/// <seealso cref="Encode(MDToken,out uint)"/>
		public uint Encode(MDToken token) {
			return Encode(token.Raw);
		}
Ejemplo n.º 48
0
 public FileMetaDataTableRecordVM(MetaDataTableVM mdVM, MDToken mdToken)
     : base(mdVM, mdToken)
 {
 }
Ejemplo n.º 49
0
		/// <summary>
		/// Decodes a coded token
		/// </summary>
		/// <param name="codedToken">The coded token</param>
		/// <param name="token">Decoded token</param>
		/// <returns><c>true</c> if successful</returns>
		public bool Decode(uint codedToken, out MDToken token) {
			uint decodedToken;
			bool result = Decode(codedToken, out decodedToken);
			token = new MDToken(decodedToken);
			return result;
		}
Ejemplo n.º 50
0
 public NestedClassMetaDataTableRecordVM(MetaDataTableVM mdVM, MDToken mdToken)
     : base(mdVM, mdToken)
 {
 }
Ejemplo n.º 51
0
		public unsafe static uint GetParamOwnerRid(IMetaDataImport mdi, uint token) {
			if (mdi == null)
				return 0;
			uint ownerToken;
			int hr = mdi.GetParamProps(token, new IntPtr(&ownerToken), IntPtr.Zero, IntPtr.Zero, 0, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero);
			if (hr != 0)
				return 0;
			var ownerMdToken = new MDToken(ownerToken);
			return ownerMdToken.Table == Table.Method ? ownerMdToken.Rid : 0;
		}
Ejemplo n.º 52
0
 public ImplMapMetaDataTableRecordVM(MetaDataTableVM mdVM, MDToken mdToken)
     : base(mdVM, mdToken)
 {
 }
Ejemplo n.º 53
0
		public unsafe static uint GetGenericParamConstraintOwnerRid(IMetaDataImport2 mdi2, uint token) {
			if (mdi2 == null)
				return 0;
			uint ownerToken;
			int hr = mdi2.GetGenericParamConstraintProps(token, new IntPtr(&ownerToken), IntPtr.Zero);
			if (hr != 0)
				return 0;
			var ownerMdToken = new MDToken(ownerToken);
			return ownerMdToken.Table == Table.GenericParam ? ownerMdToken.Rid : 0;
		}
Ejemplo n.º 54
0
 public InterfaceImplMetaDataTableRecordVM(MetaDataTableVM mdVM, MDToken mdToken)
     : base(mdVM, mdToken)
 {
 }
		/// <summary>
		/// Gets the entry point
		/// </summary>
		/// <param name="ep">Updated with entry point (either a token or RVA of native method)</param>
		/// <returns><c>true</c> if it's a managed entry point or there's no entry point,
		/// <c>false</c> if it's a native entry point</returns>
		bool GetEntryPoint(out uint ep) {
			var epMethod = module.ManagedEntryPoint as MethodDef;
			if (epMethod != null) {
				ep = new MDToken(Table.Method, metaData.GetRid(epMethod)).Raw;
				return true;
			}
			var file = module.ManagedEntryPoint as FileDef;
			if (file != null) {
				ep = new MDToken(Table.File, metaData.GetRid(file)).Raw;
				return true;
			}
			ep = (uint)module.NativeEntryPoint;
			return ep == 0;
		}
Ejemplo n.º 56
0
 public ManifestResourceMetaDataTableRecordVM(MetaDataTableVM mdVM, MDToken mdToken)
     : base(mdVM, mdToken)
 {
 }
Ejemplo n.º 57
0
 public GenericParamMetaDataTableRecordVM(MetaDataTableVM mdVM, MDToken mdToken)
     : base(mdVM, mdToken)
 {
 }
Ejemplo n.º 58
0
 public PropertyPtrMetaDataTableRecordVM(MetaDataTableVM mdVM, MDToken mdToken)
     : base(mdVM, mdToken)
 {
 }
Ejemplo n.º 59
0
 public StandAloneSigMetaDataTableRecordVM(MetaDataTableVM mdVM, MDToken mdToken)
     : base(mdVM, mdToken)
 {
 }
Ejemplo n.º 60
0
 public AssemblyMetaDataTableRecordVM(MetaDataTableVM mdVM, MDToken mdToken)
     : base(mdVM, mdToken)
 {
 }