Example #1
0
 void DumpEmbeddedAssemblies()
 {
     foreach (var info in assemblyResolver.AssemblyInfos)
     {
         DeobfuscatedFile.CreateAssemblyFile(info.Data, info.SimpleName, info.Extension);
         AddResourceToBeRemoved(info.Resource, string.Format("Embedded assembly: {0}", info.AssemblyFullName));
     }
 }
Example #2
0
 void DumpUnpackedFiles()
 {
     foreach (var unpackedFile in unpackedFiles)
     {
         DeobfuscatedFile.CreateAssemblyFile(unpackedFile.data,
                                             Win32Path.GetFileNameWithoutExtension(unpackedFile.filename),
                                             Win32Path.GetExtension(unpackedFile.filename));
     }
 }
Example #3
0
 void DumpEmbeddedAssemblies()
 {
     assemblyResolver.ResolveResources();
     foreach (var tuple in assemblyResolver.GetDecryptedResources())
     {
         DeobfuscatedFile.CreateAssemblyFile(tuple.Item2, tuple.Item1.simpleName, null);
         AddResourceToBeRemoved(tuple.Item1.resource, $"Embedded assembly: {tuple.Item1.assemblyName}");
     }
 }
Example #4
0
 void DumpEmbeddedAssemblies()
 {
     foreach (var info in assemblyResolver.AssemblyInfos)
     {
         DeobfuscatedFile.CreateAssemblyFile(info.data, info.simpleName, info.extension);
     }
     AddResourceToBeRemoved(assemblyResolver.BundleDataResource, "Embedded assemblies resource");
     AddResourceToBeRemoved(assemblyResolver.BundleXmlFileResource, "Embedded assemblies XML file resource");
     AddTypesToBeRemoved(assemblyResolver.BundleTypes, "Obfuscator assembly bundle types");
 }
Example #5
0
 void DumpEmbeddedAssemblies()
 {
     if (!options.DumpEmbeddedAssemblies)
     {
         return;
     }
     foreach (var info in assemblyResolver.GetEmbeddedAssemblies(DeobfuscatedFile, this))
     {
         var simpleName = Utils.GetAssemblySimpleName(info.name);
         DeobfuscatedFile.CreateAssemblyFile(info.resource.GetResourceData(), simpleName, null);
         AddResourceToBeRemoved(info.resource, string.Format("Embedded assembly: {0}", info.name));
     }
 }
Example #6
0
 void DumpEmbeddedAssemblies()
 {
     if (!options.DumpEmbeddedAssemblies)
     {
         return;
     }
     foreach (var info in assemblyResolver.GetEmbeddedAssemblies(DeobfuscatedFile, this))
     {
         var simpleName = Utils.GetAssemblySimpleName(info.name);
         DeobfuscatedFile.CreateAssemblyFile(info.resource.CreateReader().ToArray(), simpleName, null);
         AddResourceToBeRemoved(info.resource, $"Embedded assembly: {info.name}");
     }
 }
Example #7
0
 void DumpEmbeddedAssemblies()
 {
     if (!options.DumpEmbeddedAssemblies)
     {
         return;
     }
     foreach (var info in assemblyResolver.EmbeddedAssemblyInfos)
     {
         DeobfuscatedFile.CreateAssemblyFile(info.data, Utils.GetAssemblySimpleName(info.fullname), info.extension);
     }
     AddTypeToBeRemoved(assemblyResolver.Type, "Assembly resolver type");
     AddCctorInitCallToBeRemoved(assemblyResolver.InitMethod);
     AddResourceToBeRemoved(assemblyResolver.EncryptedResource, "Embedded encrypted assemblies");
 }
Example #8
0
 void DumpResourceFiles()
 {
     foreach (var resource in libAssemblyResolver.Resources)
     {
         var mod = ModuleDefMD.Load(resource.Data.ReadAllBytes());
         AddResourceToBeRemoved(resource, string.Format("Embedded assembly: {0}", mod.Assembly.FullName));
         DeobfuscatedFile.CreateAssemblyFile(resource.GetResourceData(),
                                             Utils.GetAssemblySimpleName(mod.Assembly.FullName),
                                             DeobUtils.GetExtension(mod.Kind));
     }
     RemoveInitCall(libAssemblyResolver.InitMethod);
     AddCallToBeRemoved(module.EntryPoint, libAssemblyResolver.InitMethod);
     AddTypeToBeRemoved(libAssemblyResolver.Type, "Assembly resolver type (library mode)");
 }
Example #9
0
 void DumpEmbeddedAssemblies()
 {
     if (assemblyDecrypter.MainAssemblyHasAssemblyResolver && !options.DumpEmbeddedAssemblies)
     {
         return;
     }
     foreach (var info in assemblyDecrypter.GetAssemblyInfos(DeobfuscatedFile, this))
     {
         DeobfuscatedFile.CreateAssemblyFile(info.data, info.asmSimpleName, info.extension);
         AddResourceToBeRemoved(info.resource, string.Format("Embedded assembly: {0}", info.asmFullName));
     }
     AddCctorInitCallToBeRemoved(assemblyDecrypter.InitMethod);
     AddCallToBeRemoved(module.EntryPoint, assemblyDecrypter.InitMethod);
     AddTypeToBeRemoved(assemblyDecrypter.Type, "Assembly resolver type");
 }
Example #10
0
 void DumpEmbeddedAssemblies()
 {
     if (assemblyDecrypter == null)
     {
         return;
     }
     foreach (var info in assemblyDecrypter.AssemblyInfos)
     {
         var asmName = info.assemblySimpleName;
         if (info.isEntryPointAssembly)
         {
             asmName += "_real";
         }
         DeobfuscatedFile.CreateAssemblyFile(info.data, asmName, info.extension);
     }
 }
Example #11
0
 void DumpEmbeddedAssemblies()
 {
     if (mainAsmInfo != null)
     {
         var asm  = Module.Assembly;
         var name = (asm == null ? Module.Name : asm.Name).String;
         DeobfuscatedFile.CreateAssemblyFile(mainAsmInfo.data, name + "_real", mainAsmInfo.extension);
         AddResourceToBeRemoved(mainAsmInfo.resource, string.Format("Embedded assembly: {0}", mainAsmInfo.asmFullName));
     }
     foreach (var info in embeddedAssemblyInfos)
     {
         if (Module.Assembly == null || info.asmFullName != Module.Assembly.FullName)
         {
             DeobfuscatedFile.CreateAssemblyFile(info.data, info.asmSimpleName, info.extension);
         }
         AddResourceToBeRemoved(info.resource, string.Format("Embedded assembly: {0}", info.asmFullName));
     }
     embeddedAssemblyInfos.Clear();
 }
Example #12
0
 void DumpEmbeddedAssemblies()
 {
     if (!options.DumpEmbeddedAssemblies)
     {
         return;
     }
     foreach (var info in assemblyResolver.GetAssemblyInfos())
     {
         if (info.resource != null && info.resource == resourceResolver.Resource)
         {
             continue;
         }
         DeobfuscatedFile.CreateAssemblyFile(info.data, info.simpleName, info.extension);
         AddResourceToBeRemoved(info.resource, $"Embedded assembly: {info.fullName}");
     }
     AddCctorInitCallToBeRemoved(assemblyResolver.InitMethod);
     AddCallToBeRemoved(module.EntryPoint, assemblyResolver.InitMethod);
     AddMethodToBeRemoved(assemblyResolver.InitMethod, "Assembly resolver init method");
     AddMethodToBeRemoved(assemblyResolver.HandlerMethod, "Assembly resolver handler method");
     AddMethodToBeRemoved(assemblyResolver.DecryptMethod, "Assembly resolver decrypt method");
 }
 void DumpEmbeddedFile(EmbeddedResource resource, string assemblyName, string extension, string reason)
 {
     DeobfuscatedFile.CreateAssemblyFile(resourceDecrypter.Decrypt(resource.GetResourceStream()), Utils.GetAssemblySimpleName(assemblyName), extension);
     AddResourceToBeRemoved(resource, reason);
 }