Example #1
0
        void Deobfuscate(MethodDef method, BlocksCflowDeobfuscator cflowDeobfuscator, MethodPrinter methodPrinter, bool isVerbose, bool isVV)
        {
            if (!HasNonEmptyBody(method))
            {
                return;
            }

            var blocks             = new Blocks(method);
            int numRemovedLocals   = 0;
            int oldNumInstructions = method.Body.Instructions.Count;

            deob.DeobfuscateMethodBegin(blocks);
            if (options.ControlFlowDeobfuscation)
            {
                cflowDeobfuscator.Initialize(blocks);
                cflowDeobfuscator.Deobfuscate();
            }

            if (deob.DeobfuscateOther(blocks) && options.ControlFlowDeobfuscation)
            {
                cflowDeobfuscator.Deobfuscate();
            }

            if (options.ControlFlowDeobfuscation)
            {
                if (CanOptimizeLocals())
                {
                    numRemovedLocals = blocks.OptimizeLocals();
                }
                blocks.RepartitionBlocks();
            }

            DeobfuscateStrings(blocks);
            deob.DeobfuscateMethodEnd(blocks);

            IList <Instruction>      allInstructions;
            IList <ExceptionHandler> allExceptionHandlers;

            blocks.GetCode(out allInstructions, out allExceptionHandlers);
            DotNetUtils.RestoreBody(method, allInstructions, allExceptionHandlers);

            if (isVerbose && numRemovedLocals > 0)
            {
                Logger.v("Removed {0} unused local(s)", numRemovedLocals);
            }
            int numRemovedInstructions = oldNumInstructions - method.Body.Instructions.Count;

            if (isVerbose && numRemovedInstructions > 0)
            {
                Logger.v("Removed {0} dead instruction(s)", numRemovedInstructions);
            }

            if (isVV)
            {
                Logger.Log(LoggerEvent.VeryVerbose, "Deobfuscated code:");
                Logger.Instance.Indent();
                methodPrinter.Print(LoggerEvent.VeryVerbose, allInstructions, allExceptionHandlers);
                Logger.Instance.DeIndent();
            }
        }
 public static void Execute()
 {
     foreach (TypeDef type in Context.module.GetTypes())
     {
         foreach (MethodDef method in type.Methods)
         {
             bool flag = method.HasBody && ContainsControlFlow(method);
             if (flag)
             {
                 for (int i = 0; i < 1; i++)
                 {
                     CfDeob = new BlocksCflowDeobfuscator();
                     Blocks       blocks = new Blocks(method);
                     List <Block> test   = blocks.MethodBlocks.GetAllBlocks();
                     blocks.RemoveDeadBlocks();
                     blocks.RepartitionBlocks();
                     blocks.UpdateBlocks();
                     blocks.Method.Body.SimplifyBranches();
                     blocks.Method.Body.OptimizeBranches();
                     CfDeob.Initialize(blocks);
                     CfDeob.Add(new ControlFlow_BlockDeobfuscator());
                     CfDeob.Deobfuscate();
                     blocks.RepartitionBlocks();
                     IList <Instruction>      instructions;
                     IList <ExceptionHandler> exceptionHandlers;
                     blocks.GetCode(out instructions, out exceptionHandlers);
                     DotNetUtils.RestoreBody(method, instructions, exceptionHandlers);
                 }
             }
         }
     }
 }
Example #3
0
        public static void DeobfuscateCflow(MethodDef meth)
        {
            for (int i = 0; i < 1; i++)
            {
                CfDeob = new BlocksCflowDeobfuscator();
                Blocks       blocks = new Blocks(meth);
                List <Block> test   = blocks.MethodBlocks.GetAllBlocks();
                blocks.RemoveDeadBlocks();
                blocks.RepartitionBlocks();

                blocks.UpdateBlocks();
                blocks.Method.Body.SimplifyBranches();
                blocks.Method.Body.OptimizeBranches();
                CfDeob.Initialize(blocks);
                //CfDeob.Deobfuscate();
                CfDeob.Add(new Cflow());

                // CfDeob.Add(new Cflow());
                CfDeob.Deobfuscate();
                blocks.RepartitionBlocks();


                IList <Instruction>      instructions;
                IList <ExceptionHandler> exceptionHandlers;
                blocks.GetCode(out instructions, out exceptionHandlers);
                DotNetUtils.RestoreBody(meth, instructions, exceptionHandlers);
            }
        }
Example #4
0
        // All Cflow Remover Credits Go to : https://github.com/SychicBoy/.NetReactorCfCleaner
        public static void Execute(Context Ctx)
        {
            var CfDeob = new BlocksCflowDeobfuscator();

            ExecuteArithmetic(Ctx);
            foreach (var TypeDef in Ctx.DnModule.Types.ToArray())
            {
                foreach (var MethodDef in TypeDef.Methods.Where(x => x.HasBody && ContainsSwitch(x)).ToArray())
                {
                    try
                    {
                        Blocks       blocks = new Blocks(MethodDef);
                        List <Block> test   = blocks.MethodBlocks.GetAllBlocks();
                        blocks.RemoveDeadBlocks();
                        blocks.RepartitionBlocks();
                        blocks.UpdateBlocks();
                        blocks.Method.Body.SimplifyBranches();
                        blocks.Method.Body.OptimizeBranches();
                        CfDeob.Initialize(blocks);
                        CfDeob.Deobfuscate();
                        blocks.RepartitionBlocks();
                        IList <Instruction>      instructions;
                        IList <ExceptionHandler> exceptionHandlers;
                        blocks.GetCode(out instructions, out exceptionHandlers);
                        DotNetUtils.RestoreBody(MethodDef, instructions, exceptionHandlers);
                    }
                    catch
                    {
                    }
                }
            }
        }
Example #5
0
        void deobfuscate(MethodDefinition method, BlocksCflowDeobfuscator cflowDeobfuscator, MethodPrinter methodPrinter)
        {
            if (!hasNonEmptyBody(method))
            {
                return;
            }

            var blocks             = new Blocks(method);
            int numRemovedLocals   = 0;
            int oldNumInstructions = method.Body.Instructions.Count;

            deob.deobfuscateMethodBegin(blocks);
            if (options.ControlFlowDeobfuscation)
            {
                cflowDeobfuscator.init(blocks);
                cflowDeobfuscator.deobfuscate();
            }

            if (deob.deobfuscateOther(blocks) && options.ControlFlowDeobfuscation)
            {
                cflowDeobfuscator.deobfuscate();
            }

            if (options.ControlFlowDeobfuscation)
            {
                numRemovedLocals = blocks.optimizeLocals();
                blocks.repartitionBlocks();
            }

            deobfuscateStrings(blocks);
            deob.deobfuscateMethodEnd(blocks);

            IList <Instruction>      allInstructions;
            IList <ExceptionHandler> allExceptionHandlers;

            blocks.getCode(out allInstructions, out allExceptionHandlers);
            DotNetUtils.restoreBody(method, allInstructions, allExceptionHandlers);

            if (numRemovedLocals > 0)
            {
                Log.v("Removed {0} unused local(s)", numRemovedLocals);
            }
            int numRemovedInstructions = oldNumInstructions - method.Body.Instructions.Count;

            if (numRemovedInstructions > 0)
            {
                Log.v("Removed {0} dead instruction(s)", numRemovedInstructions);
            }

            const Log.LogLevel dumpLogLevel = Log.LogLevel.veryverbose;

            if (Log.isAtLeast(dumpLogLevel))
            {
                Log.log(dumpLogLevel, "Deobfuscated code:");
                Log.indent();
                methodPrinter.print(dumpLogLevel, allInstructions, allExceptionHandlers);
                Log.deIndent();
            }
        }
Example #6
0
        void deobfuscateMethods()
        {
            if (savedMethodBodies != null)
            {
                savedMethodBodies.restoreAll();
                savedMethodBodies = null;
            }
            deob.DeobfuscatedFile = null;

            if (!options.ControlFlowDeobfuscation)
            {
                // If it's the unknown type, we don't remove any types that could cause Mono.Cecil
                // to throw an exception.
                if (deob.Type == "un" || options.KeepObfuscatorTypes)
                {
                    return;
                }
            }

            Log.v("Deobfuscating methods");
            var methodPrinter     = new MethodPrinter();
            var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators);

            foreach (var method in getAllMethods())
            {
                Log.v("Deobfuscating {0} ({1:X8})", Utils.removeNewlines(method), method.MetadataToken.ToUInt32());
                Log.indent();

                int oldIndentLevel = Log.indentLevel;
                try {
                    deobfuscate(method, cflowDeobfuscator, methodPrinter);
                }
                catch (ApplicationException) {
                    throw;
                }
                catch (Exception ex) {
                    if (!canLoadMethodBody(method))
                    {
                        Log.v("Invalid method body. {0:X8}", method.MetadataToken.ToInt32());
                        method.Body = new MethodBody(method);
                    }
                    else
                    {
                        Log.w("Could not deobfuscate method {0:X8}. Hello, E.T.: {1}",                          // E.T. = exception type
                              method.MetadataToken.ToInt32(),
                              ex.GetType());
                    }
                }
                finally {
                    Log.indentLevel = oldIndentLevel;
                }
                removeNoInliningAttribute(method);

                Log.deIndent();
            }
        }
Example #7
0
        void ISimpleDeobfuscator.Deobfuscate(MethodDef method, bool force)
        {
            if (method == null || (!force && Check(method, SimpleDeobFlags.HasDeobfuscated)))
            {
                return;
            }

            Deobfuscate(method, "Deobfuscating control flow", (blocks) => {
                var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators);
                cflowDeobfuscator.Initialize(blocks);
                cflowDeobfuscator.Deobfuscate();
            });
        }
        void ISimpleDeobfuscator.deobfuscate(MethodDef method, bool force)
        {
            if (!force && check(method, SimpleDeobFlags.HasDeobfuscated))
            {
                return;
            }

            deobfuscate(method, "Deobfuscating control flow", (blocks) => {
                var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators);
                cflowDeobfuscator.init(blocks);
                cflowDeobfuscator.deobfuscate();
            });
        }
        private static void ControlFlowClean()
        {
            try
            {
                foreach (ModuleDef module in Globals.ASM.Modules)              //Go through all the modules in the assembly
                {
                    foreach (TypeDef type in module.GetTypes())                //Go through all the type  and nested types in the module
                    {
                        foreach (MethodDef method in type.Methods)             //Go through all the methods in the type
                        {
                            if (method.HasBody && ContainsControlFlow(method)) //Check to see if the method has a body and it contains a (Switch) opcode which is used in the Agile controlflow
                            {
                                for (int i = 0; i < 1; i++)
                                {
                                    CfDeob = new BlocksCflowDeobfuscator();
                                    Blocks       blocks = new Blocks(method);
                                    List <Block> test   = blocks.MethodBlocks.GetAllBlocks();
                                    blocks.RemoveDeadBlocks();
                                    blocks.RepartitionBlocks();

                                    blocks.UpdateBlocks();
                                    blocks.Method.Body.SimplifyBranches();
                                    blocks.Method.Body.OptimizeBranches();
                                    CfDeob.Initialize(blocks);
                                    //CfDeob.Deobfuscate();
                                    CfDeob.Add(new ControlFlow());

                                    // CfDeob.Add(new Cflow());
                                    CfDeob.Deobfuscate();
                                    blocks.RepartitionBlocks();


                                    IList <Instruction>      instructions;
                                    IList <ExceptionHandler> exceptionHandlers;
                                    blocks.GetCode(out instructions, out exceptionHandlers);
                                    DotNetUtils.RestoreBody(method, instructions, exceptionHandlers);
                                }
                                controlflowCleaned++;
                            }
                        }
                    }
                }
            }
            catch (Exception ex)
            {
                Console.ForegroundColor = ConsoleColor.Red;
                Console.WriteLine("[-] Looks like something bad happened in the controlflow phase, please contact me to fix this issue.");
            }
            Console.ForegroundColor = ConsoleColor.Green;
            Console.WriteLine(string.Format("[+] Controlflow cleaned in {0} methods", controlflowCleaned));
        }
Example #10
0
        //Removing Control Flow
        public static void Cleaner(MethodDef method)
        {
            BlocksCflowDeobfuscator blocksCflowDeobfuscator = new BlocksCflowDeobfuscator();
            Blocks blocks = new Blocks(method);

            blocksCflowDeobfuscator.Initialize(blocks);
            blocksCflowDeobfuscator.Deobfuscate();
            blocks.RepartitionBlocks();
            IList <Instruction>      list;
            IList <ExceptionHandler> exceptionHandlers;

            blocks.GetCode(out list, out exceptionHandlers);
            DotNetUtils.RestoreBody(method, list, exceptionHandlers);
        }
Example #11
0
        void ISimpleDeobfuscator.deobfuscate(MethodDefinition method)
        {
            if (check(method, SimpleDeobFlags.HasDeobfuscated))
            {
                return;
            }

            deobfuscate(method, "Deobfuscating control flow", (blocks) => {
                var cflowDeobfuscator = new BlocksCflowDeobfuscator {
                    MethodCallInliner = deob.MethodCallInliner
                };
                cflowDeobfuscator.init(blocks);
                cflowDeobfuscator.deobfuscate();
            });
        }
Example #12
0
        void ISimpleDeobfuscator.Deobfuscate(MethodDef method, SimpleDeobfuscatorFlags flags)
        {
            bool force = (flags & SimpleDeobfuscatorFlags.Force) != 0;

            if (method == null || (!force && Check(method, SimpleDeobFlags.HasDeobfuscated)))
            {
                return;
            }

            Deobfuscate(method, "Deobfuscating control flow", (blocks) => {
                bool disableNewCFCode = (flags & SimpleDeobfuscatorFlags.DisableConstantsFolderExtraInstrs) != 0;
                var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators, disableNewCFCode);
                cflowDeobfuscator.Initialize(blocks);
                cflowDeobfuscator.Deobfuscate();
            });
        }
Example #13
0
        public static (int, int) RemoveCF(ModuleDef moduleDef)
        {
            int success = 0;
            int failed  = 0;

            foreach (TypeDef type in moduleDef.GetTypes())
            {
                foreach (MethodDef method in type.Methods)
                {
                    if (method.HasBody && HasCF(method))
                    {
                        try
                        {
                            var          cflowDeobfuscator = new BlocksCflowDeobfuscator();
                            Blocks       blocks            = new Blocks(method);
                            List <Block> test = blocks.MethodBlocks.GetAllBlocks();
                            blocks.RemoveDeadBlocks();
                            blocks.RepartitionBlocks();
                            blocks.UpdateBlocks();
                            blocks.Method.Body.OptimizeBranches();
                            blocks.UpdateBlocks();
                            blocks.Method.Body.SimplifyBranches();
                            blocks.UpdateBlocks();
                            cflowDeobfuscator.Initialize(blocks);
                            cflowDeobfuscator.Add(new ControlFlow_BlockDeobfuscator());
                            cflowDeobfuscator.Deobfuscate();
                            blocks.RepartitionBlocks();
                            IList <Instruction>      instructions;
                            IList <ExceptionHandler> exceptionHandlers;
                            blocks.GetCode(out instructions, out exceptionHandlers);
                            DotNetUtils.RestoreBody(method, instructions, exceptionHandlers);
                            success++;
                        }
                        catch (Exception e)
                        {
                            Console.WriteLine($"Failed to deobfuscate {method.DeclaringType.Name}:{method.Name} with exception: {e.Message}");
                            failed++;
                        }
                    }
                }
            }
            return(success, failed);
        }
Example #14
0
        public static void BlockDeobfuscator(MethodDef methodDef)
        {
            var cfDeob = new BlocksCflowDeobfuscator();
            var blocks = new Blocks(methodDef);

            blocks.RemoveDeadBlocks();
            blocks.RepartitionBlocks();
            blocks.UpdateBlocks();
            blocks.Method.Body.SimplifyBranches();
            blocks.Method.Body.OptimizeBranches();
            cfDeob.Initialize(blocks);
            cfDeob.Deobfuscate();
            blocks.RepartitionBlocks();
            blocks.RemoveDeadBlocks();
            blocks.OptimizeLocals();
            blocks.Method.Body.SimplifyBranches();
            blocks.Method.Body.OptimizeBranches();
            blocks.GetCode(out var instructions, out var exceptionHandlers);
            DotNetUtils.RestoreBody(methodDef, instructions, exceptionHandlers);
        }
 public static void CFLow()
 {
     foreach (TypeDef type in module.Types)
     {
         foreach (MethodDef method in type.Methods)
         {
             if (method.HasBody == false)
             {
                 continue;
             }
             BlocksCflowDeobfuscator blocksCflowDeobfuscator = new BlocksCflowDeobfuscator();
             Blocks blocks = new Blocks(method);
             blocksCflowDeobfuscator.Initialize(blocks);
             blocksCflowDeobfuscator.Deobfuscate();
             blocks.RepartitionBlocks();
             IList <Instruction>      list;
             IList <ExceptionHandler> exceptionHandlers;
             blocks.GetCode(out list, out exceptionHandlers);
             DotNetUtils.RestoreBody(method, list, exceptionHandlers);
         }
     }
 }
Example #16
0
        void DeobfuscateMethods()
        {
            if (savedMethodBodies != null)
            {
                savedMethodBodies.RestoreAll();
                savedMethodBodies = null;
            }
            deob.DeobfuscatedFile = null;

            if (!options.ControlFlowDeobfuscation)
            {
                if (options.KeepObfuscatorTypes || deob.Type == "un")
                {
                    return;
                }
            }

            bool isVerbose = !Logger.Instance.IgnoresEvent(LoggerEvent.Verbose);
            bool isVV      = !Logger.Instance.IgnoresEvent(LoggerEvent.VeryVerbose);

            if (isVerbose)
            {
                Logger.v("Deobfuscating methods");
            }
            var methodPrinter     = new MethodPrinter();
            var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators);

            foreach (var method in GetAllMethods())
            {
                if (isVerbose)
                {
                    Logger.v("Deobfuscating {0} ({1:X8})", Utils.RemoveNewlines(method), method.MDToken.ToUInt32());
                    Logger.Instance.Indent();
                }

                int oldIndentLevel = Logger.Instance.IndentLevel;
                try {
                    Deobfuscate(method, cflowDeobfuscator, methodPrinter, isVerbose, isVV);
                }
                catch (Exception ex) {
                    if (!CanLoadMethodBody(method))
                    {
                        if (isVerbose)
                        {
                            Logger.v("Invalid method body. {0:X8}", method.MDToken.ToInt32());
                        }
                        method.Body = new CilBody();
                    }
                    else
                    {
                        Logger.w("Could not deobfuscate method {0:X8}. Hello, E.T.: {1}",                               // E.T. = exception type
                                 method.MDToken.ToInt32(),
                                 ex.GetType());
                    }
                }
                finally {
                    Logger.Instance.IndentLevel = oldIndentLevel;
                }
                RemoveNoInliningAttribute(method);

                if (isVerbose)
                {
                    Logger.Instance.DeIndent();
                }
            }
        }
Example #17
0
        private void unpack(ModuleDef module)
        {
            this.methods = new List <MethodDef>();
            if (module.HasTypes)
            {
                foreach (TypeDef type in module.Types)
                {
                    this.AddMethods(type);
                }
            }
            BlocksCflowDeobfuscator blocksCflowDeobfuscator = new BlocksCflowDeobfuscator();

            for (int i = 0; i < this.methods.Count; i++)
            {
                Blocks blocks = new Blocks(this.methods[i]);
                blocksCflowDeobfuscator.Initialize(blocks);
                blocksCflowDeobfuscator.Deobfuscate();
                blocks.RepartitionBlocks();
                IList <Instruction>      list;
                IList <ExceptionHandler> exceptionHandlers;
                blocks.GetCode(out list, out exceptionHandlers);
                DotNetUtils.RestoreBody(this.methods[i], list, exceptionHandlers);
            }
            for (int i = 0; i < this.methods.Count; i++)
            {
                for (int j = 0; j < this.methods[i].Body.Instructions.Count; j++)
                {
                    if (this.methods[i].Body.Instructions[j].IsLdcI4() && j + 1 < this.methods[i].Body.Instructions.Count && this.methods[i].Body.Instructions[j + 1].OpCode == OpCodes.Pop)
                    {
                        this.methods[i].Body.Instructions[j].OpCode     = OpCodes.Nop;
                        this.methods[i].Body.Instructions[j + 1].OpCode = OpCodes.Nop;
                        for (int k = 0; k < this.methods[i].Body.Instructions.Count; k++)
                        {
                            if (this.methods[i].Body.Instructions[k].OpCode == OpCodes.Br || this.methods[i].Body.Instructions[k].OpCode == OpCodes.Br_S)
                            {
                                if (this.methods[i].Body.Instructions[k].Operand is Instruction)
                                {
                                    Instruction instruction = this.methods[i].Body.Instructions[k].Operand as Instruction;
                                    if (instruction == this.methods[i].Body.Instructions[j + 1])
                                    {
                                        if (k - 1 >= 0 && this.methods[i].Body.Instructions[k - 1].IsLdcI4())
                                        {
                                            this.methods[i].Body.Instructions[k - 1].OpCode = OpCodes.Nop;
                                        }
                                    }
                                }
                            }
                        }
                    }
                    if (this.methods[i].Body.Instructions[j].OpCode == OpCodes.Dup && j + 1 < this.methods[i].Body.Instructions.Count && this.methods[i].Body.Instructions[j + 1].OpCode == OpCodes.Pop)
                    {
                        this.methods[i].Body.Instructions[j].OpCode     = OpCodes.Nop;
                        this.methods[i].Body.Instructions[j + 1].OpCode = OpCodes.Nop;
                        for (int k = 0; k < this.methods[i].Body.Instructions.Count; k++)
                        {
                            if (this.methods[i].Body.Instructions[k].OpCode == OpCodes.Br || this.methods[i].Body.Instructions[k].OpCode == OpCodes.Br_S)
                            {
                                if (this.methods[i].Body.Instructions[k].Operand is Instruction)
                                {
                                    Instruction instruction = this.methods[i].Body.Instructions[k].Operand as Instruction;
                                    if (instruction == this.methods[i].Body.Instructions[j + 1])
                                    {
                                        if (k - 1 >= 0 && this.methods[i].Body.Instructions[k - 1].OpCode == OpCodes.Dup)
                                        {
                                            this.methods[i].Body.Instructions[k - 1].OpCode = OpCodes.Nop;
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }
            for (int i = 0; i < this.methods.Count; i++)
            {
                Blocks blocks = new Blocks(this.methods[i]);
                blocksCflowDeobfuscator.Initialize(blocks);
                blocksCflowDeobfuscator.Deobfuscate();
                blocks.RepartitionBlocks();
                IList <Instruction>      list;
                IList <ExceptionHandler> exceptionHandlers;
                blocks.GetCode(out list, out exceptionHandlers);
                DotNetUtils.RestoreBody(this.methods[i], list, exceptionHandlers);
            }
            for (int i = 0; i < this.methods.Count; i++)
            {
                Dictionary <Instruction, Instruction> dictionary = new Dictionary <Instruction, Instruction>();
                for (int j = 0; j < this.methods[i].Body.Instructions.Count; j++)
                {
                    if (this.methods[i].Body.Instructions[j].IsConditionalBranch())
                    {
                        Instruction instruction2 = this.methods[i].Body.Instructions[j];
                        for (int k = 0; k < this.methods[i].Body.Instructions.Count; k++)
                        {
                            if (this.methods[i].Body.Instructions[k].IsBr())
                            {
                                Instruction instruction3 = this.methods[i].Body.Instructions[k];
                                Instruction instruction4 = this.methods[i].Body.Instructions[k].Operand as Instruction;
                                if (instruction4 == instruction2)
                                {
                                    if (!dictionary.ContainsKey(instruction4))
                                    {
                                        this.methods[i].Body.Instructions[k].OpCode  = instruction2.GetOpCode();
                                        this.methods[i].Body.Instructions[k].Operand = instruction2.GetOperand();
                                        this.methods[i].Body.Instructions.Insert(k + 1, OpCodes.Br.ToInstruction(this.methods[i].Body.Instructions[j + 1]));
                                        k++;
                                        dictionary.Add(instruction4, this.methods[i].Body.Instructions[k]);
                                    }
                                }
                            }
                        }
                    }
                }
                this.methods[i].Body.SimplifyBranches();
                this.methods[i].Body.OptimizeBranches();
            }
            for (int i = 0; i < this.methods.Count; i++)
            {
                Blocks blocks = new Blocks(this.methods[i]);
                blocksCflowDeobfuscator.Initialize(blocks);
                blocksCflowDeobfuscator.Deobfuscate();
                blocks.RepartitionBlocks();
                IList <Instruction>      list;
                IList <ExceptionHandler> exceptionHandlers;
                blocks.GetCode(out list, out exceptionHandlers);
                DotNetUtils.RestoreBody(this.methods[i], list, exceptionHandlers);
            }
            int num = 0;

            for (int i = 0; i < this.methods.Count; i++)
            {
                this.toberemoved        = new List <int>();
                this.integer_values_1   = new List <int>();
                this.tobenooped_start   = new List <int>();
                this.tobenooped_len     = new List <int>();
                this.for_rem            = new List <int>();
                this.switchinstructions = new List <Instruction>();
                this.wheretojump        = new List <Instruction>();
                for (int j = 0; j < this.methods[i].Body.Instructions.Count; j++)
                {
                    if (j + 2 < this.methods[i].Body.Instructions.Count && this.methods[i].Body.Instructions[j].IsStloc() && (this.methods[i].Body.Instructions[j + 1].IsLdloc() || this.methods[i].Body.Instructions[j + 1].IsLdcI4()) && (this.methods[i].Body.Instructions[j + 2].IsLdcI4() || this.methods[i].Body.Instructions[j + 2].IsLdloc() || this.methods[i].Body.Instructions[j + 2].OpCode == OpCodes.Neg || this.methods[i].Body.Instructions[j + 2].OpCode == OpCodes.Not))
                    {
                        int stlocInsIndex = GetStlocInsIndex(this.methods[i].Body.Instructions, j);
                        if (stlocInsIndex != -1)
                        {
                            Instruction instruction5 = this.methods[i].Body.Instructions[stlocInsIndex - 1];
                            if ((stlocInsIndex - 1 >= 0 && this.methods[i].Body.Instructions[stlocInsIndex - 1].IsBr()) || this.methods[i].Body.Instructions[stlocInsIndex - 1].IsLdloc() || this.methods[i].Body.Instructions[stlocInsIndex - 1].IsLdcI4() || this.methods[i].Body.Instructions[stlocInsIndex - 1].OpCode == OpCodes.Xor)
                            {
                                int stlocInsIndex2 = GetStlocInsIndex(this.methods[i].Body.Instructions, stlocInsIndex + 1);
                                if (stlocInsIndex2 != -1)
                                {
                                    int switchInsIndex = GetSwitchInsIndex(this.methods[i].Body.Instructions, stlocInsIndex2 + 1);
                                    if (switchInsIndex != -1)
                                    {
                                        this.local_variable1 = this.methods[i].Body.Instructions[stlocInsIndex].GetLocal(this.methods[i].Body.Variables);
                                        this.local_variable2 = this.methods[i].Body.Instructions[stlocInsIndex2].GetLocal(this.methods[i].Body.Variables);
                                        if (this.local_variable1.Type != null && (this.local_variable1.Type.FullName == "System.Int32" || this.local_variable1.Type.FullName == "System.UInt32") && this.local_variable2.Type != null && (this.local_variable2.Type.FullName == "System.Int32" || this.local_variable2.Type.FullName == "System.UInt32"))
                                        {
                                            int num2 = switchInsIndex - j;
                                            this.wheretojump.Add(this.methods[i].Body.Instructions[j]);
                                            this.switchinstructions.Add(this.methods[i].Body.Instructions[switchInsIndex]);
                                            this.tobenooped_start.Add(j);
                                            this.tobenooped_len.Add(num2);
                                            j += num2;
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
                if (this.switchinstructions.Count > 0)
                {
                    this.placeintindexes         = new List <int>();
                    this.intvalues               = new List <int>();
                    this.conditionalinstructions = new List <Instruction>();
                    this.brinstructions          = new List <Instruction>();
                    this.realbrinstructions      = new List <Instruction>();
                    this.instructions            = this.methods[i].Body.Instructions;
                    this.method = this.methods[i];
                    this.InstructionParse2(0, 0, 0);
                    num += this.placeintindexes.Count;
                    for (int k = 0; k < this.placeintindexes.Count; k++)
                    {
                        this.methods[i].Body.Instructions[this.placeintindexes[k]].OpCode  = OpCodes.Ldc_I4;
                        this.methods[i].Body.Instructions[this.placeintindexes[k]].Operand = this.intvalues[k];
                    }
                    for (int k = 0; k < this.tobenooped_start.Count; k++)
                    {
                        for (int l = 0; l < this.tobenooped_len[k]; l++)
                        {
                            this.methods[i].Body.Instructions[this.tobenooped_start[k] + l].OpCode = OpCodes.Nop;
                        }
                    }
                }
                this.toberemoved        = new List <int>();
                this.integer_values_1   = new List <int>();
                this.for_rem            = new List <int>();
                this.switchinstructions = new List <Instruction>();
                for (int j = 0; j < this.methods[i].Body.Instructions.Count; j++)
                {
                    if (j + 6 < this.methods[i].Body.Instructions.Count && this.methods[i].Body.Instructions[j].IsLdcI4())
                    {
                        if (this.methods[i].Body.Instructions[j + 1].OpCode == OpCodes.Xor)
                        {
                            if (this.methods[i].Body.Instructions[j + 2].IsLdcI4())
                            {
                                if (this.methods[i].Body.Instructions[j + 3].OpCode == OpCodes.Rem_Un)
                                {
                                    if (this.methods[i].Body.Instructions[j + 4].OpCode == OpCodes.Switch)
                                    {
                                        this.toberemoved.Add(j);
                                        this.integer_values_1.Add(this.methods[i].Body.Instructions[j].GetLdcI4Value());
                                        this.for_rem.Add(this.methods[i].Body.Instructions[j + 2].GetLdcI4Value());
                                        this.switchinstructions.Add(this.methods[i].Body.Instructions[j + 4]);
                                    }
                                }
                            }
                        }
                    }
                }
                if (this.switchinstructions.Count > 0)
                {
                    this.toberemovedindex        = new List <int>();
                    this.toberemovedvalues       = new List <int>();
                    this.conditionalinstructions = new List <Instruction>();
                    this.brinstructions          = new List <Instruction>();
                    this.realbrinstructions      = new List <Instruction>();
                    this.instructions            = this.methods[i].Body.Instructions;
                    this.method = this.methods[i];
                    this.InstructionParseNoLocal(0);
                    num += this.toberemovedindex.Count;
                    if (this.toberemovedindex.Count > 0)
                    {
                        for (int m = 0; m < this.toberemoved.Count; m++)
                        {
                            for (int j = 0; j < 4; j++)
                            {
                                this.methods[i].Body.Instructions[j + this.toberemoved[m]].OpCode  = OpCodes.Nop;
                                this.methods[i].Body.Instructions[j + this.toberemoved[m]].Operand = null;
                            }
                        }
                        for (int j = 0; j < this.toberemovedindex.Count; j++)
                        {
                            this.methods[i].Body.Instructions[this.toberemovedindex[j]].OpCode  = OpCodes.Ldc_I4;
                            this.methods[i].Body.Instructions[this.toberemovedindex[j]].Operand = this.toberemovedvalues[j];
                            if (!this.methods[i].Body.Instructions[this.toberemovedindex[j] + 1].IsBr())
                            {
                                for (int k = 0; k < 4; k++)
                                {
                                    this.methods[i].Body.Instructions[this.toberemovedindex[j] + k + 1].OpCode  = OpCodes.Nop;
                                    this.methods[i].Body.Instructions[this.toberemovedindex[j] + k + 1].Operand = null;
                                }
                            }
                        }
                    }
                }
                Blocks blocks = new Blocks(this.methods[i]);
                blocksCflowDeobfuscator.Initialize(blocks);
                blocksCflowDeobfuscator.Deobfuscate();
                blocks.RepartitionBlocks();
                IList <Instruction>      list;
                IList <ExceptionHandler> exceptionHandlers;
                blocks.GetCode(out list, out exceptionHandlers);
                DotNetUtils.RestoreBody(this.methods[i], list, exceptionHandlers);
                this.methods[i].Body.SimplifyBranches();
                this.methods[i].Body.OptimizeBranches();
            }
            for (int i = 0; i < this.methods.Count; i++)
            {
                Blocks blocks = new Blocks(this.methods[i]);
                blocksCflowDeobfuscator.Initialize(blocks);
                blocksCflowDeobfuscator.Deobfuscate();
                blocks.RepartitionBlocks();
                IList <Instruction>      list;
                IList <ExceptionHandler> exceptionHandlers;
                blocks.GetCode(out list, out exceptionHandlers);
                DotNetUtils.RestoreBody(this.methods[i], list, exceptionHandlers);
            }
        }