public byte[] Unpack()
{
if (peImage.PEImage.Win32Resources == null)
{
return(null);
}
var dataEntry = peImage.PEImage.Win32Resources.Find(10, "__", 0);
if (dataEntry == null)
{
return(null);
}
var encryptedData = dataEntry.CreateReader().ToArray();
var keyData = GetKeyData();
if (keyData == null)
{
return(null);
}
var decrypter = new NativeFileDecrypter(keyData);
decrypter.Decrypt(encryptedData, 0, encryptedData.Length);
byte[] inflatedData;
if (isNet1x)
{
inflatedData = DeobUtils.Inflate(encryptedData, false);
}
else
{
int inflatedSize = BitConverter.ToInt32(encryptedData, 0);
inflatedData = new byte[inflatedSize];
var inflater = new Inflater(false);
inflater.SetInput(encryptedData, 4, encryptedData.Length - 4);
int count = inflater.Inflate(inflatedData);
if (count != inflatedSize)
{
return(null);
}
}
// CLR 1.x or DNR v4.0 - v4.4
if (BitConverter.ToInt16(inflatedData, 0) == 0x5A4D)
{
return(inflatedData);
}
// DNR v4.5
if (BitConverter.ToInt16(inflatedData, loaderHeaderSizeV45) == 0x5A4D)
{
return(UnpackLoader(inflatedData));
}
return(null);
}
public byte[] Unpack() {
if (peImage.PEImage.Win32Resources == null)
return null;
var dataEntry = peImage.PEImage.Win32Resources.Find(10, "__", 0);
if (dataEntry == null)
return null;
var encryptedData = dataEntry.Data.ReadAllBytes();
var keyData = GetKeyData();
if (keyData == null)
return null;
var decrypter = new NativeFileDecrypter(keyData);
decrypter.Decrypt(encryptedData, 0, encryptedData.Length);
byte[] inflatedData;
if (isNet1x)
inflatedData = DeobUtils.Inflate(encryptedData, false);
else {
int inflatedSize = BitConverter.ToInt32(encryptedData, 0);
inflatedData = new byte[inflatedSize];
var inflater = new Inflater(false);
inflater.SetInput(encryptedData, 4, encryptedData.Length - 4);
int count = inflater.Inflate(inflatedData);
if (count != inflatedSize)
return null;
}
// CLR 1.x or DNR v4.0 - v4.4
if (BitConverter.ToInt16(inflatedData, 0) == 0x5A4D)
return inflatedData;
// DNR v4.5
if (BitConverter.ToInt16(inflatedData, loaderHeaderSizeV45) == 0x5A4D)
return UnpackLoader(inflatedData);
return null;
}
public byte[] unpack()
{
var resources = peImage.Resources;
var dir = resources.getRoot();
if ((dir = dir.getDirectory(10)) == null)
return null;
if ((dir = dir.getDirectory("__")) == null)
return null;
var dataEntry = dir.getData(0);
if (dataEntry == null)
return null;
var encryptedData = peImage.readBytes(dataEntry.RVA, (int)dataEntry.Size);
if (encryptedData.Length != dataEntry.Size)
return null;
var keyData = getKeyData();
if (keyData == null)
return null;
var decrypter = new NativeFileDecrypter(keyData);
decrypter.decrypt(encryptedData, 0, encryptedData.Length);
byte[] inflatedData;
if (isNet1x)
inflatedData = DeobUtils.inflate(encryptedData, false);
else {
int inflatedSize = BitConverter.ToInt32(encryptedData, 0);
inflatedData = new byte[inflatedSize];
var inflater = new Inflater(false);
inflater.SetInput(encryptedData, 4, encryptedData.Length - 4);
int count = inflater.Inflate(inflatedData);
if (count != inflatedSize)
return null;
}
if (BitConverter.ToInt16(inflatedData, 0) != 0x5A4D)
return null;
return inflatedData;
}
public byte[] unpack()
{
var resources = peImage.Resources;
var dir = resources.getRoot();
if ((dir = dir.getDirectory(10)) == null)
{
return(null);
}
if ((dir = dir.getDirectory("__")) == null)
{
return(null);
}
var dataEntry = dir.getData(0);
if (dataEntry == null)
{
return(null);
}
var encryptedData = peImage.readBytes(dataEntry.RVA, (int)dataEntry.Size);
if (encryptedData.Length != dataEntry.Size)
{
return(null);
}
var keyData = getKeyData();
if (keyData == null)
{
return(null);
}
var decrypter = new NativeFileDecrypter(keyData);
decrypter.decrypt(encryptedData, 0, encryptedData.Length);
byte[] inflatedData;
if (isNet1x)
{
inflatedData = DeobUtils.inflate(encryptedData, false);
}
else
{
int inflatedSize = BitConverter.ToInt32(encryptedData, 0);
inflatedData = new byte[inflatedSize];
var inflater = new Inflater(false);
inflater.SetInput(encryptedData, 4, encryptedData.Length - 4);
int count = inflater.Inflate(inflatedData);
if (count != inflatedSize)
{
return(null);
}
}
if (BitConverter.ToInt16(inflatedData, 0) != 0x5A4D)
{
return(null);
}
return(inflatedData);
}
