bool checkInitMethod(MethodDef method)
        {
            if (method == null || !method.IsStatic || method.Body == null)
            {
                return(false);
            }
            if (!DotNetUtils.isMethod(method, "System.Void", "()"))
            {
                return(false);
            }
            var type = method.DeclaringType;

            if (type.NestedTypes.Count != 1)
            {
                return(false);
            }
            if (DotNetUtils.getField(type, "System.Reflection.Assembly") == null)
            {
                return(false);
            }

            var resolveHandler = DeobUtils.getResolveMethod(method);

            if (resolveHandler == null)
            {
                return(false);
            }

            initMethod    = method;
            resolverType  = type;
            handlerMethod = resolveHandler;
            return(true);
        }
        bool checkInitMethod(MethodDef checkMethod, ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
        {
            var requiredFields = new string[] {
                "System.Collections.Hashtable",
                "System.Boolean",
            };

            foreach (var method in DotNetUtils.getCalledMethods(module, checkMethod))
            {
                if (method.Body == null)
                {
                    continue;
                }
                if (!method.IsStatic)
                {
                    continue;
                }
                if (!DotNetUtils.isMethod(method, "System.Void", "()"))
                {
                    continue;
                }

                var type = method.DeclaringType;
                if (!new FieldTypes(type).exactly(requiredFields))
                {
                    continue;
                }
                var ctor = type.FindMethod(".ctor");
                if (ctor == null)
                {
                    continue;
                }
                var handler = DeobUtils.getResolveMethod(ctor);
                if (handler == null)
                {
                    continue;
                }
                simpleDeobfuscator.decryptStrings(handler, deob);
                var resourcePrefix = getResourcePrefix(handler);
                if (resourcePrefix == null)
                {
                    continue;
                }

                for (int i = 0; ; i++)
                {
                    var resource = DotNetUtils.getResource(module, resourcePrefix + i.ToString("D5")) as EmbeddedResource;
                    if (resource == null)
                    {
                        break;
                    }
                    resources.Add(resource);
                }

                initMethod = method;
                return(true);
            }

            return(false);
        }
Example #3
0
        bool checkInitMethod(MethodDefinition method)
        {
            var type = method.DeclaringType;

            if (type.NestedTypes.Count < 2 || type.NestedTypes.Count > 6)
            {
                return(false);
            }
            if (DotNetUtils.getPInvokeMethod(type, "kernel32", "MoveFileEx") == null)
            {
                return(false);
            }

            var resolveHandler = DeobUtils.getResolveMethod(method);

            if (resolveHandler == null)
            {
                return(false);
            }
            if (!DeobUtils.hasInteger(resolveHandler, ',') ||
                !DeobUtils.hasInteger(resolveHandler, '|'))
            {
                return(false);
            }

            initMethod    = method;
            resolverType  = type;
            handlerMethod = resolveHandler;
            return(true);
        }
        MethodDef checkInitMethod(MethodDef method)
        {
            if (method == null || !method.IsStatic || method.Body == null)
            {
                return(null);
            }
            if (!DotNetUtils.isMethod(method, "System.Void", "()"))
            {
                return(null);
            }

            var resolver = DeobUtils.getResolveMethod(method);

            if (resolver == null || resolver.DeclaringType != method.DeclaringType)
            {
                return(null);
            }

            return(resolver);
        }