void deobfuscate(MethodDef method, BlocksCflowDeobfuscator cflowDeobfuscator, MethodPrinter methodPrinter, bool isVerbose, bool isVV)
        {
            if (!hasNonEmptyBody(method))
            {
                return;
            }

            var blocks             = new Blocks(method);
            int numRemovedLocals   = 0;
            int oldNumInstructions = method.Body.Instructions.Count;

            deob.deobfuscateMethodBegin(blocks);
            if (options.ControlFlowDeobfuscation)
            {
                cflowDeobfuscator.init(blocks);
                cflowDeobfuscator.deobfuscate();
            }

            if (deob.deobfuscateOther(blocks) && options.ControlFlowDeobfuscation)
            {
                cflowDeobfuscator.deobfuscate();
            }

            if (options.ControlFlowDeobfuscation)
            {
                if (CanOptimizeLocals())
                {
                    numRemovedLocals = blocks.optimizeLocals();
                }
                blocks.repartitionBlocks();
            }

            deobfuscateStrings(blocks);
            deob.deobfuscateMethodEnd(blocks);

            IList <Instruction>      allInstructions;
            IList <ExceptionHandler> allExceptionHandlers;

            blocks.getCode(out allInstructions, out allExceptionHandlers);
            DotNetUtils.restoreBody(method, allInstructions, allExceptionHandlers);

            if (isVerbose && numRemovedLocals > 0)
            {
                Logger.v("Removed {0} unused local(s)", numRemovedLocals);
            }
            int numRemovedInstructions = oldNumInstructions - method.Body.Instructions.Count;

            if (isVerbose && numRemovedInstructions > 0)
            {
                Logger.v("Removed {0} dead instruction(s)", numRemovedInstructions);
            }

            if (isVV)
            {
                Logger.log(LoggerEvent.VeryVerbose, "Deobfuscated code:");
                Logger.Instance.indent();
                methodPrinter.print(LoggerEvent.VeryVerbose, allInstructions, allExceptionHandlers);
                Logger.Instance.deIndent();
            }
        }
Example #2
0
        void deobfuscate(MethodDefinition method, BlocksCflowDeobfuscator cflowDeobfuscator, MethodPrinter methodPrinter)
        {
            if (!hasNonEmptyBody(method))
            {
                return;
            }

            var blocks             = new Blocks(method);
            int numRemovedLocals   = 0;
            int oldNumInstructions = method.Body.Instructions.Count;

            deob.deobfuscateMethodBegin(blocks);
            if (options.ControlFlowDeobfuscation)
            {
                cflowDeobfuscator.init(blocks);
                cflowDeobfuscator.deobfuscate();
            }

            if (deob.deobfuscateOther(blocks) && options.ControlFlowDeobfuscation)
            {
                cflowDeobfuscator.deobfuscate();
            }

            if (options.ControlFlowDeobfuscation)
            {
                numRemovedLocals = blocks.optimizeLocals();
                blocks.repartitionBlocks();
            }

            deobfuscateStrings(blocks);
            deob.deobfuscateMethodEnd(blocks);

            IList <Instruction>      allInstructions;
            IList <ExceptionHandler> allExceptionHandlers;

            blocks.getCode(out allInstructions, out allExceptionHandlers);
            DotNetUtils.restoreBody(method, allInstructions, allExceptionHandlers);

            if (numRemovedLocals > 0)
            {
                Log.v("Removed {0} unused local(s)", numRemovedLocals);
            }
            int numRemovedInstructions = oldNumInstructions - method.Body.Instructions.Count;

            if (numRemovedInstructions > 0)
            {
                Log.v("Removed {0} dead instruction(s)", numRemovedInstructions);
            }

            const Log.LogLevel dumpLogLevel = Log.LogLevel.veryverbose;

            if (Log.isAtLeast(dumpLogLevel))
            {
                Log.log(dumpLogLevel, "Deobfuscated code:");
                Log.indent();
                methodPrinter.print(dumpLogLevel, allInstructions, allExceptionHandlers);
                Log.deIndent();
            }
        }
        void ISimpleDeobfuscator.deobfuscate(MethodDef method, bool force)
        {
            if (!force && check(method, SimpleDeobFlags.HasDeobfuscated))
            {
                return;
            }

            deobfuscate(method, "Deobfuscating control flow", (blocks) => {
                var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators);
                cflowDeobfuscator.init(blocks);
                cflowDeobfuscator.deobfuscate();
            });
        }
Example #4
0
        void ISimpleDeobfuscator.deobfuscate(MethodDefinition method)
        {
            if (check(method, SimpleDeobFlags.HasDeobfuscated))
            {
                return;
            }

            deobfuscate(method, "Deobfuscating control flow", (blocks) => {
                var cflowDeobfuscator = new BlocksCflowDeobfuscator {
                    MethodCallInliner = deob.MethodCallInliner
                };
                cflowDeobfuscator.init(blocks);
                cflowDeobfuscator.deobfuscate();
            });
        }