Ejemplo n.º 1
0
        public byte[] Unpack()
        {
            if (peImage.PEImage.Win32Resources == null)
            {
                return(null);
            }
            var dataEntry = peImage.PEImage.Win32Resources.Find(10, "__", 0);

            if (dataEntry == null)
            {
                return(null);
            }

            var encryptedData = dataEntry.CreateReader().ToArray();

            var keyData = GetKeyData();

            if (keyData == null)
            {
                return(null);
            }
            var decrypter = new NativeFileDecrypter(keyData);

            decrypter.Decrypt(encryptedData, 0, encryptedData.Length);

            byte[] inflatedData;
            if (isNet1x)
            {
                inflatedData = DeobUtils.Inflate(encryptedData, false);
            }
            else
            {
                int inflatedSize = BitConverter.ToInt32(encryptedData, 0);
                inflatedData = new byte[inflatedSize];
                var inflater = new Inflater(false);
                inflater.SetInput(encryptedData, 4, encryptedData.Length - 4);
                int count = inflater.Inflate(inflatedData);
                if (count != inflatedSize)
                {
                    return(null);
                }
            }

            // CLR 1.x or DNR v4.0 - v4.4
            if (BitConverter.ToInt16(inflatedData, 0) == 0x5A4D)
            {
                return(inflatedData);
            }

            // DNR v4.5
            if (BitConverter.ToInt16(inflatedData, loaderHeaderSizeV45) == 0x5A4D)
            {
                return(UnpackLoader(inflatedData));
            }

            return(null);
        }
		public byte[] Unpack() {
			if (peImage.PEImage.Win32Resources == null)
				return null;
			var dataEntry = peImage.PEImage.Win32Resources.Find(10, "__", 0);
			if (dataEntry == null)
				return null;

			var encryptedData = dataEntry.Data.ReadAllBytes();

			var keyData = GetKeyData();
			if (keyData == null)
				return null;
			var decrypter = new NativeFileDecrypter(keyData);
			decrypter.Decrypt(encryptedData, 0, encryptedData.Length);

			byte[] inflatedData;
			if (isNet1x)
				inflatedData = DeobUtils.Inflate(encryptedData, false);
			else {
				int inflatedSize = BitConverter.ToInt32(encryptedData, 0);
				inflatedData = new byte[inflatedSize];
				var inflater = new Inflater(false);
				inflater.SetInput(encryptedData, 4, encryptedData.Length - 4);
				int count = inflater.Inflate(inflatedData);
				if (count != inflatedSize)
					return null;
			}

			// CLR 1.x or DNR v4.0 - v4.4
			if (BitConverter.ToInt16(inflatedData, 0) == 0x5A4D)
				return inflatedData;

			// DNR v4.5
			if (BitConverter.ToInt16(inflatedData, loaderHeaderSizeV45) == 0x5A4D)
				return UnpackLoader(inflatedData);

			return null;
		}
Ejemplo n.º 3
0
        public byte[] unpack()
        {
            var resources = peImage.Resources;
            var dir = resources.getRoot();
            if ((dir = dir.getDirectory(10)) == null)
                return null;
            if ((dir = dir.getDirectory("__")) == null)
                return null;
            var dataEntry = dir.getData(0);
            if (dataEntry == null)
                return null;

            var encryptedData = peImage.readBytes(dataEntry.RVA, (int)dataEntry.Size);
            if (encryptedData.Length != dataEntry.Size)
                return null;

            var keyData = getKeyData();
            if (keyData == null)
                return null;
            var decrypter = new NativeFileDecrypter(keyData);
            decrypter.decrypt(encryptedData, 0, encryptedData.Length);

            byte[] inflatedData;
            if (isNet1x)
                inflatedData = DeobUtils.inflate(encryptedData, false);
            else {
                int inflatedSize = BitConverter.ToInt32(encryptedData, 0);
                inflatedData = new byte[inflatedSize];
                var inflater = new Inflater(false);
                inflater.SetInput(encryptedData, 4, encryptedData.Length - 4);
                int count = inflater.Inflate(inflatedData);
                if (count != inflatedSize)
                    return null;
            }

            if (BitConverter.ToInt16(inflatedData, 0) != 0x5A4D)
                return null;

            return inflatedData;
        }
Ejemplo n.º 4
0
        public byte[] unpack()
        {
            var resources = peImage.Resources;
            var dir       = resources.getRoot();

            if ((dir = dir.getDirectory(10)) == null)
            {
                return(null);
            }
            if ((dir = dir.getDirectory("__")) == null)
            {
                return(null);
            }
            var dataEntry = dir.getData(0);

            if (dataEntry == null)
            {
                return(null);
            }

            var encryptedData = peImage.readBytes(dataEntry.RVA, (int)dataEntry.Size);

            if (encryptedData.Length != dataEntry.Size)
            {
                return(null);
            }

            var keyData = getKeyData();

            if (keyData == null)
            {
                return(null);
            }
            var decrypter = new NativeFileDecrypter(keyData);

            decrypter.decrypt(encryptedData, 0, encryptedData.Length);

            byte[] inflatedData;
            if (isNet1x)
            {
                inflatedData = DeobUtils.inflate(encryptedData, false);
            }
            else
            {
                int inflatedSize = BitConverter.ToInt32(encryptedData, 0);
                inflatedData = new byte[inflatedSize];
                var inflater = new Inflater(false);
                inflater.SetInput(encryptedData, 4, encryptedData.Length - 4);
                int count = inflater.Inflate(inflatedData);
                if (count != inflatedSize)
                {
                    return(null);
                }
            }

            if (BitConverter.ToInt16(inflatedData, 0) != 0x5A4D)
            {
                return(null);
            }

            return(inflatedData);
        }