Ejemplo n.º 1
0
        public override void DeobfuscateBegin()
        {
            base.DeobfuscateBegin();

            AddTypeToBeRemoved(killType, "KILL type");

            mainType.Initialize();
            foreach (var initMethod in mainType.OtherInitMethods)
            {
                AddCctorInitCallToBeRemoved(initMethod);
                AddCtorInitCallToBeRemoved(initMethod);
            }

            if (Operations.DecryptStrings != OpDecryptString.None)
            {
                stringDecrypter.Initialize();
                staticStringInliner.Add(stringDecrypter.DecryptMethod, (method, gim, args) => {
                    return(stringDecrypter.Decrypt((int)args[0]));
                });
                DeobfuscatedFile.StringDecryptersAdded();
                AddModuleCctorInitCallToBeRemoved(stringDecrypter.InitMethod);
                AddCallToBeRemoved(mainType.GetInitStringDecrypterMethod(stringDecrypter.InitMethod), stringDecrypter.InitMethod);
            }

            assemblyResolver = new AssemblyResolver(module);
            assemblyResolver.Initialize();
            DumpEmbeddedAssemblies();

            RemoveTamperDetection();

            proxyCallFixer.Initialize();
            proxyCallFixer.Find();

            resourceDecrypter = new ResourceDecrypter(module);
            resourceDecrypter.Initialize();
            resourceDecrypter.Decrypt();
            if (resourceDecrypter.CanRemoveTypes)
            {
                AddTypeToBeRemoved(resourceDecrypter.ResourceFlagsType, "Obfuscator ResourceFlags type");
                AddTypeToBeRemoved(resourceDecrypter.ResType, "Obfuscator Res type");
                AddTypeToBeRemoved(resourceDecrypter.ResourceEnumeratorType, "Obfuscator ResourceEnumerator type");
                AddTypeToBeRemoved(resourceDecrypter.EncryptedResourceReaderType, "Obfuscator EncryptedResourceReader type");
                AddTypeToBeRemoved(resourceDecrypter.EncryptedResourceSetType, "Obfuscator EncryptedResourceSet type");
                AddTypeToBeRemoved(resourceDecrypter.EncryptedResourceStreamType, "Obfuscator EncryptedResourceStream type");
            }
        }