void findHouseOfCardsStrings_v1()
{
foreach (var type in module.Types)
{
if (type.Methods.Count != 1)
{
continue;
}
foreach (var method in DotNetUtils.findMethods(type.Methods, "System.Void", new string[] { }))
{
if (checkDelegateCreatorMethod(type, method))
{
break;
}
}
}
}
bool findDecrypterMethod()
{
if (stringDecrypterMethod != null)
{
return(true);
}
var methods = new List <MethodDef>(DotNetUtils.findMethods(stringsEncodingClass.Methods, "System.String", new string[] { "System.Int32" }));
if (methods.Count != 1)
{
return(false);
}
stringDecrypterMethod = methods[0];
return(true);
}
void findStringDecrypterMethods(TypeDefinition type, ISimpleDeobfuscator simpleDeobfuscator)
{
foreach (var method in DotNetUtils.findMethods(type.Methods, "System.String", new string[] { "System.String", "System.Int32" }))
{
if (method.Body.HasExceptionHandlers)
{
continue;
}
var methodCalls = DotNetUtils.getMethodCallCounts(method);
if (methodCalls.count("System.Char[] System.String::ToCharArray()") != 1)
{
continue;
}
if (methodCalls.count("System.String System.String::Intern(System.String)") != 1)
{
continue;
}
simpleDeobfuscator.deobfuscate(method);
var instructions = method.Body.Instructions;
for (int i = 0; i <= instructions.Count - 3; i++)
{
var ldci4 = method.Body.Instructions[i];
if (!DotNetUtils.isLdcI4(ldci4))
{
continue;
}
if (instructions[i + 1].OpCode.Code != Code.Ldarg_1)
{
continue;
}
if (instructions[i + 2].OpCode.Code != Code.Add)
{
continue;
}
var info = new StringDecrypterInfo(method, DotNetUtils.getLdcI4Value(ldci4));
stringDecrypterMethods[info.method] = info;
Log.v("Found string decrypter method: {0}, magic: 0x{1:X8}", Utils.removeNewlines(info.method), info.magic);
break;
}
}
}
