Example #1
0
 static uint getStructSize(McHeader mcHeader)
 {
     uint magicLo = mcHeader.readUInt32(0x8C0);
     uint magicHi = mcHeader.readUInt32(0x8C4);
     foreach (var info in encryptionInfos_McHeader8C0h) {
         if (magicLo == info.MagicLo && magicHi == info.MagicHi)
             return 0xC + 6 * ENCRYPTED_DATA_INFO_SIZE;
     }
     return 0xC + 3 * ENCRYPTED_DATA_INFO_SIZE;
 }
Example #2
0
            public MethodInfos(MainType mainType, PeImage peImage, PeHeader peHeader, McHeader mcHeader)
            {
                this.mainType = mainType;
                this.peImage = peImage;
                this.peHeader = peHeader;
                this.mcHeader = mcHeader;

                structSize = getStructSize(mcHeader);

                uint methodInfosRva = peHeader.getRva2(0x0FF8, mcHeader.readUInt32(0x005A));
                uint encryptedDataRva = peHeader.getRva2(0x0FF0, mcHeader.readUInt32(0x0046));

                methodInfosOffset = peImage.rvaToOffset(methodInfosRva);
                encryptedDataOffset = peImage.rvaToOffset(encryptedDataRva);
            }
Example #3
0
        DumpedMethods decryptMethods(PeImage peImage, PeHeader peHeader, McHeader mcHeader)
        {
            var dumpedMethods = new DumpedMethods();

            var methodInfos = new MethodInfos(mainType, peImage, peHeader, mcHeader);
            methodInfos.initializeInfos();

            var metadataTables = peImage.Cor20Header.createMetadataTables();
            var methodDef = metadataTables.getMetadataType(MetadataIndex.iMethodDef);
            uint methodDefOffset = methodDef.fileOffset;
            for (int i = 0; i < methodDef.rows; i++, methodDefOffset += methodDef.totalSize) {
                uint bodyRva = peImage.offsetReadUInt32(methodDefOffset);
                if (bodyRva == 0)
                    continue;

                var info = methodInfos.lookup(bodyRva);
                if (info == null)
                    continue;

                uint bodyOffset = peImage.rvaToOffset(bodyRva);
                ushort magic = peImage.offsetReadUInt16(bodyOffset);
                if (magic != 0xFFF3)
                    continue;

                var dm = new DumpedMethod();
                dm.token = (uint)(0x06000001 + i);
                dm.mdImplFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[1].offset);
                dm.mdFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[2].offset);
                dm.mdName = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size);
                dm.mdSignature = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[4].offset, methodDef.fields[4].size);
                dm.mdParamList = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[5].offset, methodDef.fields[5].size);

                var reader = new BinaryReader(new MemoryStream(info.body));
                byte b = reader.ReadByte();
                if ((b & 3) == 2) {
                    dm.mhFlags = 2;
                    dm.mhMaxStack = 8;
                    dm.mhCodeSize = (uint)(b >> 2);
                    dm.mhLocalVarSigTok = 0;
                }
                else {
                    reader.BaseStream.Position--;
                    dm.mhFlags = reader.ReadUInt16();
                    dm.mhMaxStack = reader.ReadUInt16();
                    dm.mhCodeSize = reader.ReadUInt32();
                    dm.mhLocalVarSigTok = reader.ReadUInt32();
                    uint codeOffset = (uint)(dm.mhFlags >> 12) * 4;
                    reader.BaseStream.Position += codeOffset - 12;
                }

                dm.code = reader.ReadBytes((int)dm.mhCodeSize);
                if ((dm.mhFlags & 8) != 0) {
                    reader.BaseStream.Position = (reader.BaseStream.Position + 3) & ~3;
                    dm.extraSections = reader.ReadBytes((int)(reader.BaseStream.Length - reader.BaseStream.Position));
                }

                dumpedMethods.add(dm);
            }

            return dumpedMethods;
        }
Example #4
0
        void decryptResources(byte[] fileData, PeImage peImage, PeHeader peHeader, McHeader mcHeader)
        {
            uint resourceRva = peHeader.getRva1(0x0E10, mcHeader.readUInt32(0x00A0));
            uint resourceSize = peHeader.readUInt32(0x0E14) ^ mcHeader.readUInt32(0x00AA);
            if (resourceRva == 0 || resourceSize == 0)
                return;
            if (resourceRva != peImage.Cor20Header.resources.virtualAddress ||
                resourceSize != peImage.Cor20Header.resources.size) {
                Log.w("Invalid resource RVA and size found");
            }

            Log.v("Decrypting resources @ RVA {0:X8}, {1} bytes", resourceRva, resourceSize);

            int resourceOffset = (int)peImage.rvaToOffset(resourceRva);
            for (int i = 0; i < resourceSize; i++)
                fileData[resourceOffset + i] ^= mcHeader[i % 0x2000];
        }
Example #5
0
        public bool decrypt(byte[] fileData, ref DumpedMethods dumpedMethods)
        {
            var peImage = new PeImage(fileData);
            var peHeader = new PeHeader(mainType, peImage);
            var mcHeader = new McHeader(peImage, peHeader);

            dumpedMethods = decryptMethods(peImage, peHeader, mcHeader);
            if (dumpedMethods == null)
                return false;

            decryptResources(fileData, peImage, peHeader, mcHeader);

            return true;
        }