public void Find() {
var requiredFields = new string[] {
"System.Threading.ReaderWriterLock",
"System.Collections.Hashtable",
};
foreach (var type in module.GetTypes()) {
var fieldTypes = new FieldTypes(type);
if (!fieldTypes.All(requiredFields))
continue;
if (type.FindMethod("Finalize") == null)
continue;
var executeMethod = DotNetUtils.GetMethod(type, "System.Object", "(System.String,System.Object[])");
if (executeMethod == null || !executeMethod.IsStatic || executeMethod.Body == null)
continue;
var decrypterType = FindMethodsDecrypterType(type);
if (decrypterType == null)
continue;
resourceDecrypter.DecryptMethod = FindDecryptMethod(decrypterType);
methodsDecrypterCreator = type;
methodsDecrypter = decrypterType;
decryptExecuteMethod = executeMethod;
return;
}
}
bool InlineMethod(MethodDef methodToInline, int instrIndex, int const1, int const2) {
this.methodToInline = methodToInline = cflowDeobfuscator.Deobfuscate(methodToInline);
parameters = methodToInline.Parameters;
arg1 = parameters[parameters.Count - 2];
arg2 = parameters[parameters.Count - 1];
returnValue = null;
instructionEmulator.Initialize(methodToInline);
foreach (var arg in parameters) {
if (!arg.IsNormalMethodParameter)
continue;
if (arg.Type.ElementType >= ElementType.Boolean && arg.Type.ElementType <= ElementType.U4)
instructionEmulator.SetArg(arg, new Int32Value(0));
}
instructionEmulator.SetArg(arg1, new Int32Value(const1));
instructionEmulator.SetArg(arg2, new Int32Value(const2));
int index = 0;
if (!EmulateInstructions(ref index, false))
return false;
var patcher = TryInlineOtherMethod(instrIndex, methodToInline, methodToInline.Body.Instructions[index], index + 1, 2);
if (patcher == null)
return false;
if (!EmulateToReturn(patcher.afterIndex, patcher.lastInstr))
return false;
patcher.Patch(block);
block.Insert(instrIndex, OpCodes.Pop.ToInstruction());
block.Insert(instrIndex, OpCodes.Pop.ToInstruction());
return true;
}
protected override List<Instruction> ReadInstructions(MethodDef cilMethod, CsvmMethodData csvmMethod) {
var reader = new BinaryReader(new MemoryStream(csvmMethod.Instructions));
var instrs = new List<Instruction>();
var handlerInfoReader = new OpCodeHandlerInfoReader(module);
int numVmInstrs = reader.ReadInt32();
var vmInstrs = new ushort[numVmInstrs];
for (int i = 0; i < numVmInstrs; i++)
vmInstrs[i] = reader.ReadUInt16();
uint offset = 0;
for (int vmInstrIndex = 0; vmInstrIndex < numVmInstrs; vmInstrIndex++) {
var composite = opCodeDetector.Handlers[vmInstrs[vmInstrIndex]];
var handlerInfos = composite.OpCodeHandlerInfos;
if (handlerInfos.Count == 0)
handlerInfos = new List<OpCodeHandlerInfo>() { new OpCodeHandlerInfo(HandlerTypeCode.Nop, null) };
for (int hi = 0; hi < handlerInfos.Count; hi++) {
var instr = handlerInfoReader.Read(handlerInfos[hi].TypeCode, reader);
instr.Offset = offset;
offset += (uint)GetInstructionSize(instr);
SetCilToVmIndex(instr, vmInstrIndex);
if (hi == 0)
SetVmIndexToCil(instr, vmInstrIndex);
instrs.Add(instr);
}
}
return instrs;
}
bool Find(MethodDef methodToCheck) {
if (methodToCheck == null)
return false;
foreach (var method in DotNetUtils.GetCalledMethods(module, methodToCheck)) {
var type = method.DeclaringType;
if (!method.IsStatic || !DotNetUtils.IsMethod(method, "System.Void", "()"))
continue;
if (DotNetUtils.GetPInvokeMethod(type, "kernel32", "LoadLibrary") == null)
continue;
if (DotNetUtils.GetPInvokeMethod(type, "kernel32", "GetProcAddress") == null)
continue;
Deobfuscate(method);
if (!ContainsString(method, "debugger is activ") &&
!ContainsString(method, "debugger is running") &&
!ContainsString(method, "Debugger detected") &&
!ContainsString(method, "Debugger was detected") &&
!ContainsString(method, "{0} was detected") &&
!ContainsString(method, "run under") &&
!ContainsString(method, "run with") &&
!ContainsString(method, "started under") &&
!ContainsString(method, "{0} detected") &&
!ContainsString(method, "{0} found"))
continue;
antiDebuggerType = type;
antiDebuggerMethod = method;
return true;
}
return false;
}
protected override Instruction OnAfterLoadArg(MethodDef methodToInline, Instruction instr, ref int instrIndex) {
if (instr.OpCode.Code != Code.Box)
return instr;
if (methodToInline.MethodSig.GetGenParamCount() == 0)
return instr;
return DotNetUtils.GetInstruction(methodToInline.Body.Instructions, ref instrIndex);
}
bool IsEmptyClass(MethodDef emptyMethod) {
if (!DotNetUtils.IsEmptyObfuscated(emptyMethod))
return false;
var type = emptyMethod.DeclaringType;
if (type.HasEvents || type.HasProperties)
return false;
if (type.Fields.Count != 1)
return false;
if (type.Fields[0].FieldType.FullName != "System.Boolean")
return false;
if (type.IsPublic)
return false;
int otherMethods = 0;
foreach (var method in type.Methods) {
if (method.Name == ".ctor" || method.Name == ".cctor")
continue;
if (method == emptyMethod)
continue;
otherMethods++;
if (method.Body == null)
return false;
if (method.Body.Instructions.Count > 20)
return false;
}
if (otherMethods > 8)
return false;
return true;
}
bool CheckMethod(ISimpleDeobfuscator simpleDeobfuscator, MethodDef method) {
if (method == null || method.Body == null)
return false;
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode.Code != Code.Call)
continue;
var calledMethod = instr.Operand as MethodDef;
if (calledMethod == null)
continue;
if (calledMethod == null || !calledMethod.IsStatic)
continue;
if (!DotNetUtils.IsMethod(calledMethod, "System.Void", "()"))
continue;
var type = calledMethod.DeclaringType;
if (type.NestedTypes.Count > 0)
continue;
simpleDeobfuscator.Deobfuscate(calledMethod, SimpleDeobfuscatorFlags.Force | SimpleDeobfuscatorFlags.DisableConstantsFolderExtraInstrs);
if (CheckType(type, calledMethod)) {
initMethod = calledMethod;
return true;
}
}
return false;
}
static bool JumpToStatement(MethodDef method, uint ilOffset, DecompilerTextView textView) {
if (method == null)
return false;
var serMod = method.Module.ToSerializedDnSpyModule();
var key = new SerializedDnSpyToken(serMod, method.MDToken);
if (textView == null)
textView = MainWindow.Instance.SafeActiveTextView;
bool found = MainWindow.Instance.DnSpyFileListTreeNode.FindModuleNode(method.Module) != null;
if (found) {
return MainWindow.Instance.JumpToReference(textView, method, (success, hasMovedCaret) => {
if (success)
return MoveCaretTo(textView, key, ilOffset);
return false;
});
}
MainWindow.Instance.Dispatcher.BeginInvoke(DispatcherPriority.Background, new Action(() => {
MainWindow.Instance.JumpToReference(textView, method, (success, hasMovedCaret) => {
if (success)
return MoveCaretTo(textView, key, ilOffset);
return false;
});
}));
return true;
}
void Initialize() {
var callCounter = new CallCounter();
int count = 0;
foreach (var type in module.GetTypes()) {
if (count >= 40)
break;
foreach (var method in type.Methods) {
if (method.Name != ".ctor" && method.Name != ".cctor" && module.EntryPoint != method)
continue;
foreach (var calledMethod in DotNetUtils.GetCalledMethods(module, method)) {
if (!calledMethod.IsStatic || calledMethod.Body == null)
continue;
if (!DotNetUtils.IsMethod(calledMethod, "System.Void", "()"))
continue;
if (IsEmptyClass(calledMethod)) {
callCounter.Add(calledMethod);
count++;
}
}
}
}
int numCalls;
var theMethod = (MethodDef)callCounter.Most(out numCalls);
if (numCalls >= 10)
emptyMethod = theMethod;
}
void Check(MethodDef method) {
if (method.Body == null)
return;
if (possiblyUnusedMethods.ContainsKey(method))
return;
if (removedMethods.Exists(method))
return;
foreach (var instr in method.Body.Instructions) {
switch (instr.OpCode.Code) {
case Code.Call:
case Code.Calli:
case Code.Callvirt:
case Code.Newobj:
case Code.Ldtoken:
case Code.Ldftn:
case Code.Ldvirtftn:
break;
default:
continue;
}
var calledMethod = DotNetUtils.GetMethod2(module, instr.Operand as IMethod);
if (calledMethod == null)
continue;
if (possiblyUnusedMethods.ContainsKey(calledMethod))
notUnusedStack.Push(calledMethod);
}
}
public AnalyzedMethodUsesTreeNode(MethodDef analyzedMethod)
{
if (analyzedMethod == null)
throw new ArgumentNullException("analyzedMethod");
this.analyzedMethod = analyzedMethod;
}
public static bool CanShow(MethodDef method)
{
return method.IsVirtual &&
!method.IsFinal &&
!method.DeclaringType.IsSealed &&
!method.DeclaringType.IsInterface; // interface methods are definitions not implementations - cannot be overridden
}
static short[] FindKey(MethodDef initMethod, FieldDefAndDeclaringTypeDict<bool> fields) {
var instrs = initMethod.Body.Instructions;
for (int i = 0; i < instrs.Count - 2; i++) {
var ldci4 = instrs[i];
if (!ldci4.IsLdcI4())
continue;
var newarr = instrs[i + 1];
if (newarr.OpCode.Code != Code.Newarr)
continue;
if (newarr.Operand.ToString() != "System.Char")
continue;
var stloc = instrs[i + 2];
if (!stloc.IsStloc())
continue;
var local = stloc.GetLocal(initMethod.Body.Variables);
int startInitIndex = i;
i++;
var array = ArrayFinder.GetInitializedInt16Array(ldci4.GetLdcI4Value(), initMethod, ref i);
if (array == null)
continue;
var field = GetStoreField(initMethod, startInitIndex, local);
if (field == null)
continue;
if (fields.Find(field))
return array;
}
return null;
}
public static ITextOutput Write(ITextOutput output, MethodDef method, Language language) {
output.Write(UIUtils.CleanUpIdentifier(method.Name), TextTokenHelper.GetTextTokenType(method));
output.Write('(', TextTokenType.Operator);
for (int i = 0; i < method.Parameters.Count; i++) {
if (method.Parameters[i].IsHiddenThisParameter)
continue;
if (method.Parameters[i].MethodSigIndex > 0) {
output.Write(',', TextTokenType.Operator);
output.WriteSpace();
}
language.TypeToString(output, method.Parameters[i].Type.ToTypeDefOrRef(), false, method.Parameters[i].ParamDef);
}
if (method.CallingConvention == CallingConvention.VarArg || method.CallingConvention == CallingConvention.NativeVarArg) {
if (method.MethodSig.GetParamCount() > 0) {
output.Write(',', TextTokenType.Operator);
output.WriteSpace();
}
output.Write("...", TextTokenType.Operator);
}
output.Write(')', TextTokenType.Operator);
output.WriteSpace();
output.Write(':', TextTokenType.Operator);
output.WriteSpace();
language.TypeToString(output, method.ReturnType.ToTypeDefOrRef(), false, method.Parameters.ReturnParameter.ParamDef);
method.MDToken.WriteSuffixString(output);
return output;
}
public override void Decompile(MethodDef method, IDecompilerOutput output, DecompilationContext ctx) {
WriteCommentBegin(output, true);
output.Write("Method: ", BoxedTextColor.Comment);
output.Write(IdentifierEscaper.Escape(method.FullName), method, DecompilerReferenceFlags.Definition, BoxedTextColor.Comment);
WriteCommentEnd(output, true);
output.WriteLine();
if (!method.HasBody) {
return;
}
StartKeywordBlock(output, ".body", method);
ILAstBuilder astBuilder = new ILAstBuilder();
ILBlock ilMethod = new ILBlock();
DecompilerContext context = new DecompilerContext(method.Module, MetadataTextColorProvider) { CurrentType = method.DeclaringType, CurrentMethod = method };
ilMethod.Body = astBuilder.Build(method, inlineVariables, context);
if (abortBeforeStep != null) {
new ILAstOptimizer().Optimize(context, ilMethod, abortBeforeStep.Value);
}
if (context.CurrentMethodIsAsync) {
output.Write("async", BoxedTextColor.Keyword);
output.Write("/", BoxedTextColor.Punctuation);
output.WriteLine("await", BoxedTextColor.Keyword);
}
var allVariables = ilMethod.GetSelfAndChildrenRecursive<ILExpression>().Select(e => e.Operand as ILVariable)
.Where(v => v != null && !v.IsParameter).Distinct();
foreach (ILVariable v in allVariables) {
output.Write(IdentifierEscaper.Escape(v.Name), v, DecompilerReferenceFlags.Local | DecompilerReferenceFlags.Definition, v.IsParameter ? BoxedTextColor.Parameter : BoxedTextColor.Local);
if (v.Type != null) {
output.Write(" ", BoxedTextColor.Text);
output.Write(":", BoxedTextColor.Punctuation);
output.Write(" ", BoxedTextColor.Text);
if (v.IsPinned) {
output.Write("pinned", BoxedTextColor.Keyword);
output.Write(" ", BoxedTextColor.Text);
}
v.Type.WriteTo(output, ILNameSyntax.ShortTypeName);
}
if (v.GeneratedByDecompiler) {
output.Write(" ", BoxedTextColor.Text);
output.Write("[", BoxedTextColor.Punctuation);
output.Write("generated", BoxedTextColor.Keyword);
output.Write("]", BoxedTextColor.Punctuation);
}
output.WriteLine();
}
var builder = new MethodDebugInfoBuilder(method);
foreach (ILNode node in ilMethod.Body) {
node.WriteTo(output, builder);
if (!node.WritesNewLine)
output.WriteLine();
}
output.AddDebugInfo(builder.Create());
EndKeywordBlock(output);
}
public static bool findRegisterMethod(TypeDef type, out MethodDef regMethod, out MethodDef handler)
{
foreach (var method in type.Methods) {
if (!method.IsStatic || method.Body == null)
continue;
if (method.Body.ExceptionHandlers.Count != 1)
continue;
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode.Code != Code.Ldftn)
continue;
var handlerRef = instr.Operand as IMethod;
if (handlerRef == null)
continue;
if (!DotNetUtils.isMethod(handlerRef, "System.Reflection.Assembly", "(System.Object,System.ResolveEventArgs)"))
continue;
if (!new SigComparer().Equals(type, handlerRef.DeclaringType))
continue;
handler = DotNetUtils.getMethod(type, handlerRef);
if (handler == null)
continue;
if (handler.Body == null || handler.Body.ExceptionHandlers.Count != 1)
continue;
regMethod = method;
return true;
}
}
regMethod = null;
handler = null;
return false;
}
HashSet<ILVariable> localVariablesToDefine = new HashSet<ILVariable>(); // local variables that are missing a definition
/// <summary>
/// Creates the body for the method definition.
/// </summary>
/// <param name="methodDef">Method definition to decompile.</param>
/// <param name="context">Decompilation context.</param>
/// <param name="parameters">Parameter declarations of the method being decompiled.
/// These are used to update the parameter names when the decompiler generates names for the parameters.</param>
/// <returns>Block for the method body</returns>
public static BlockStatement CreateMethodBody(MethodDef methodDef,
DecompilerContext context,
IEnumerable<ParameterDeclaration> parameters,
out MemberMapping mm)
{
MethodDef oldCurrentMethod = context.CurrentMethod;
Debug.Assert(oldCurrentMethod == null || oldCurrentMethod == methodDef);
context.CurrentMethod = methodDef;
context.CurrentMethodIsAsync = false;
try {
AstMethodBodyBuilder builder = new AstMethodBodyBuilder();
builder.methodDef = methodDef;
builder.context = context;
builder.corLib = methodDef.Module.CorLibTypes;
if (Debugger.IsAttached) {
return builder.CreateMethodBody(parameters, out mm);
} else {
try {
return builder.CreateMethodBody(parameters, out mm);
} catch (OperationCanceledException) {
throw;
} catch (Exception ex) {
throw new ICSharpCode.Decompiler.DecompilerException(methodDef, ex);
}
}
} finally {
context.CurrentMethod = oldCurrentMethod;
}
}
public IEnumerable<Instruction> EmitDerivation(MethodDef method, ConfuserContext ctx, Local dst, Local src) {
var ret = new List<Instruction>();
var codeGen = new CodeGen(dst, src, method, ret);
codeGen.GenerateCIL(derivation);
codeGen.Commit(method.Body);
return ret;
}
public void Find() {
var requiredTypes = new string[] {
"System.Reflection.Assembly",
"System.Object",
"System.Int32",
"System.String[]",
};
foreach (var type in module.Types) {
if (type.HasEvents)
continue;
if (!new FieldTypes(type).All(requiredTypes))
continue;
MethodDef regMethod, handler;
if (!BabelUtils.FindRegisterMethod(type, out regMethod, out handler))
continue;
var resource = BabelUtils.FindEmbeddedResource(module, type);
if (resource == null)
continue;
var decryptMethod = FindDecryptMethod(type);
if (decryptMethod == null)
throw new ApplicationException("Couldn't find resource type decrypt method");
resourceDecrypter.DecryptMethod = ResourceDecrypter.FindDecrypterMethod(decryptMethod);
InitXorKeys(decryptMethod);
resolverType = type;
registerMethod = regMethod;
encryptedResource = resource;
return;
}
}
public AnalyzedInterfacePropertyImplementedByTreeNode(PropertyDef analyzedProperty) {
if (analyzedProperty == null)
throw new ArgumentNullException("analyzedProperty");
this.analyzedProperty = analyzedProperty;
this.analyzedMethod = this.analyzedProperty.GetMethod ?? this.analyzedProperty.SetMethod;
}
protected override bool CheckHandlerMethod(MethodDef method) {
if (!method.IsStatic || !method.HasBody)
return false;
EmbeddedAssemblyInfo info = null;
var instructions = method.Body.Instructions;
for (int i = 0; i < instructions.Count; i++) {
var instrs = DotNetUtils.GetInstructions(instructions, i, OpCodes.Ldstr, OpCodes.Call);
if (instrs == null)
continue;
var s = instrs[0].Operand as string;
var calledMethod = instrs[1].Operand as IMethod;
if (s == null || calledMethod == null)
continue;
info = assemblyResolverInfo.Find(Utils.GetAssemblySimpleName(s));
if (info != null)
break;
}
if (info == null)
return false;
resourceInfo = info;
Logger.v("Found embedded assemblies resource {0}", Utils.ToCsharpString(info.resourceName));
return true;
}
public void Find() {
if (decrypterInfo == null)
return;
decryptMethod = FindDecryptMethod(decrypterInfo.mainType.Type);
if (decryptMethod == null)
return;
}
public void Initialize(MethodDef method, bool emulateFromFirstInstruction) {
this.parameterDefs = method.Parameters;
this.localDefs = method.Body.Variables;
valueStack.Initialize();
protectedStackValues.Clear();
if (method != prev_method) {
prev_method = method;
cached_args.Clear();
for (int i = 0; i < parameterDefs.Count; i++)
cached_args.Add(GetUnknownValue(parameterDefs[i].Type));
cached_locals.Clear();
cached_zeroed_locals.Clear();
for (int i = 0; i < localDefs.Count; i++) {
cached_locals.Add(GetUnknownValue(localDefs[i].Type));
cached_zeroed_locals.Add(GetDefaultValue(localDefs[i].Type));
}
}
args.Clear();
args.AddRange(cached_args);
locals.Clear();
locals.AddRange(method.Body.InitLocals && emulateFromFirstInstruction ? cached_zeroed_locals : cached_locals);
}
public static bool canInline(MethodDef method)
{
if (method == null || method.Body == null)
return false;
if (method.Attributes != (MethodAttributes.Assembly | MethodAttributes.Static))
return false;
if (method.Body.ExceptionHandlers.Count > 0)
return false;
var parameters = method.MethodSig.GetParams();
int paramCount = parameters.Count;
if (paramCount < 2)
return false;
if (method.GenericParameters.Count > 0) {
foreach (var gp in method.GenericParameters) {
if (gp.GenericParamConstraints.Count == 0)
return false;
}
}
var param1 = parameters[paramCount - 1];
var param2 = parameters[paramCount - 2];
if (!isIntType(param1.ElementType))
return false;
if (!isIntType(param2.ElementType))
return false;
return true;
}
bool CheckMethod(MethodDef cctor) {
if (cctor == null || cctor.Body == null)
return false;
var localTypes = new LocalTypes(cctor);
if (!localTypes.Exactly(ilpLocalsV1x) &&
!localTypes.Exactly(ilpLocalsV2x))
return false;
var type = cctor.DeclaringType;
var methods = GetPinvokeMethods(type, "Protect");
if (methods.Count == 0)
methods = GetPinvokeMethods(type, "P0");
if (methods.Count != 2)
return false;
if (type.Fields.Count < 1 || type.Fields.Count > 2)
return false;
if (!GetDelegate(type, out invokerInstanceField, out invokerDelegate))
return false;
runtimeFileInfos = new List<RuntimeFileInfo>(methods.Count);
foreach (var method in methods)
runtimeFileInfos.Add(new RuntimeFileInfo(method));
return true;
}
public override void SetParameter(MethodDef.Param param, object obj, bool bReadonly)
{
base.SetParameter(param, obj, bReadonly);
_resetProperties = false;
string selectionName = string.Empty;
VariableDef variable = param.Value as VariableDef;
if (variable != null) {
_valueOwner = variable.ValueClass;
selectionName = (variable.Property != null) ? variable.Property.DisplayName : variable.DisplayName;
} else {
RightValueDef variableRV = param.Value as RightValueDef;
if (variableRV != null)
{
_valueOwner = variableRV.ValueClassReal;
selectionName = variableRV.DisplayName;
}
}
Nodes.Behavior behavior = GetBehavior();
_agentType = (behavior != null) ? behavior.AgentType : null;
if (_valueOwner != VariableDef.kSelf)
{
_agentType = Plugin.GetInstanceAgentType(_valueOwner, behavior, _agentType);
}
setComboBox(selectionName);
}
/// <summary>
/// Injects the specified MethodDef to another module.
/// </summary>
/// <param name="methodDef">The source MethodDef.</param>
/// <param name="target">The target module.</param>
/// <returns>The injected MethodDef.</returns>
public static MethodDef Inject(MethodDef methodDef, ModuleDef target)
{
var ctx = new InjectContext(methodDef.Module, target);
ctx.Map[methodDef] = Clone(methodDef);
CopyMethodDef(methodDef, ctx);
return (MethodDef)ctx.Map[methodDef];
}
public ILAST(MethodDef method)
{
Method = method;
Elements = new List<Element>();
ProcessMethod();
}
public static void WriteTo(this ExceptionHandler exceptionHandler, ITextOutput writer, MethodDef method)
{
writer.Write("Try", TextTokenType.Keyword);
writer.WriteSpace();
WriteOffsetReference(writer, exceptionHandler.TryStart, method);
writer.Write('-', TextTokenType.Operator);
WriteOffsetReference(writer, exceptionHandler.TryEnd, method);
writer.WriteSpace();
writer.Write(exceptionHandler.HandlerType.ToString(), TextTokenType.Keyword);
if (exceptionHandler.FilterStart != null) {
writer.WriteSpace();
WriteOffsetReference(writer, exceptionHandler.FilterStart, method);
writer.WriteSpace();
writer.Write("handler", TextTokenType.Keyword);
writer.WriteSpace();
}
if (exceptionHandler.CatchType != null) {
writer.WriteSpace();
exceptionHandler.CatchType.WriteTo(writer);
}
writer.WriteSpace();
WriteOffsetReference(writer, exceptionHandler.HandlerStart, method);
writer.Write('-', TextTokenType.Operator);
WriteOffsetReference(writer, exceptionHandler.HandlerEnd, method);
}
public InterfaceEventImplementedByNode(EventDef analyzedEvent) {
if (analyzedEvent == null)
throw new ArgumentNullException("analyzedEvent");
this.analyzedEvent = analyzedEvent;
this.analyzedMethod = this.analyzedEvent.AddMethod ?? this.analyzedEvent.RemoveMethod;
}
public override void DecompileMethod(MethodDef method, ITextOutput output, DecompilationOptions options)
{
WriteComment(output, "Method: ");
output.WriteDefinition(IdentifierEscaper.Escape(method.FullName), method, TextTokenType.Comment, false);
output.WriteLine();
if (!method.HasBody)
{
return;
}
StartKeywordBlock(output, ".body", method);
ILAstBuilder astBuilder = new ILAstBuilder();
ILBlock ilMethod = new ILBlock();
DecompilerContext context = new DecompilerContext(method.Module)
{
CurrentType = method.DeclaringType, CurrentMethod = method
};
ilMethod.Body = astBuilder.Build(method, inlineVariables, context);
if (abortBeforeStep != null)
{
new ILAstOptimizer().Optimize(context, ilMethod, abortBeforeStep.Value);
}
if (context.CurrentMethodIsAsync)
{
output.Write("async", TextTokenType.Keyword);
output.Write('/', TextTokenType.Operator);
output.WriteLine("await", TextTokenType.Keyword);
}
var allVariables = ilMethod.GetSelfAndChildrenRecursive <ILExpression>().Select(e => e.Operand as ILVariable)
.Where(v => v != null && !v.IsParameter).Distinct();
foreach (ILVariable v in allVariables)
{
output.WriteDefinition(IdentifierEscaper.Escape(v.Name), v, v.IsParameter ? TextTokenType.Parameter : TextTokenType.Local);
if (v.Type != null)
{
output.WriteSpace();
output.Write(':', TextTokenType.Operator);
output.WriteSpace();
if (v.IsPinned)
{
output.Write("pinned", TextTokenType.Keyword);
output.WriteSpace();
}
v.Type.WriteTo(output, ILNameSyntax.ShortTypeName);
}
if (v.IsGenerated)
{
output.WriteSpace();
output.Write('[', TextTokenType.Operator);
output.Write("generated", TextTokenType.Keyword);
output.Write(']', TextTokenType.Operator);
}
output.WriteLine();
}
var memberMapping = new MemberMapping(method);
foreach (ILNode node in ilMethod.Body)
{
node.WriteTo(output, memberMapping);
if (!node.WritesNewLine)
{
output.WriteLine();
}
}
output.AddDebugSymbols(memberMapping);
EndKeywordBlock(output);
}
public static bool IsPublicOrInternal(this MethodDef methodDef) => methodDef?.IsPublic == true || methodDef?.IsAssembly == true;
public string detect()
{
var decryptStringType = stringDecrypter.Type;
var decryptStringMethod = stringDecrypter.Method;
if (decryptStringType == null || decryptStringMethod == null)
{
return(null);
}
var otherMethods = new List <MethodDef>();
MethodDef cctor = null;
foreach (var method in decryptStringType.Methods)
{
if (method == decryptStringMethod)
{
continue;
}
if (method.Name == ".cctor")
{
cctor = method;
}
else
{
otherMethods.Add(method);
}
}
if (cctor == null)
{
return(null);
}
bool hasConstantM2 = DeobUtils.hasInteger(decryptStringMethod, -2);
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
var fields11 = new string[] {
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
"System.IO.BinaryReader",
"System.Byte[]",
"System.Int16",
"System.Boolean",
};
var locals11 = createLocalsArray(
"System.Boolean",
"System.Byte[]",
"System.Char[]",
"System.Int16",
"System.Int32",
"System.Reflection.Assembly",
"System.String"
);
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
!decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsPublic &&
decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStack >= 35 &&
decryptStringMethod.Body.MaxStack <= 50 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 0 &&
new LocalTypes(decryptStringMethod).exactly(locals11) &&
checkTypeFields(fields11))
{
return("1.1 - 1.2");
}
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
var fields13 = new string[] {
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
"System.IO.BinaryReader",
"System.Byte[]",
"System.Int16",
"System.Boolean",
"System.Byte[]",
};
var locals13 = createLocalsArray(
"System.Boolean",
"System.Byte",
"System.Byte[]",
"System.Char[]",
"System.Int16",
"System.Int32",
"System.Reflection.Assembly",
"System.String"
);
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
!decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsPublic &&
decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStack >= 35 &&
decryptStringMethod.Body.MaxStack <= 50 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 0 &&
new LocalTypes(decryptStringMethod).exactly(locals13) &&
checkTypeFields(fields13))
{
return("1.3");
}
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
var fields14 = new string[] {
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
"System.IO.BinaryReader",
"System.Byte[]",
"System.Int16",
"System.Boolean",
"System.Byte[]",
};
var locals14 = createLocalsArray(
"System.Boolean",
"System.Byte",
"System.Byte[]",
"System.Char[]",
"System.Int16",
"System.Int32",
"System.Reflection.Assembly",
"System.String"
);
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
!decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsPublic &&
decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStack >= 150 &&
decryptStringMethod.Body.MaxStack <= 200 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 0 &&
new LocalTypes(decryptStringMethod).exactly(locals14) &&
checkTypeFields(fields14))
{
return("1.4 - 2.3");
}
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
var fields24 = new string[] {
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
"System.IO.BinaryReader",
"System.Byte[]",
"System.Int16",
"System.Boolean",
"System.Byte[]",
};
var locals24 = createLocalsArray(
"System.Boolean",
"System.Byte",
"System.Byte[]",
"System.Char[]",
"System.Int16",
"System.Int32",
"System.Reflection.Assembly",
"System.Reflection.AssemblyName",
"System.String"
);
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
!decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsPublic &&
decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 0 &&
new LocalTypes(decryptStringMethod).exactly(locals24) &&
checkTypeFields(fields24))
{
return("2.4 - 2.5");
}
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
var fields26 = new string[] {
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
"System.IO.BinaryReader",
"System.Byte[]",
"System.Int16",
"System.Boolean",
"System.Byte[]",
};
var locals26 = createLocalsArray(
"System.Boolean",
"System.Byte",
"System.Byte[]",
"System.Char[]",
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
"System.Int16",
"System.Int32",
"System.Reflection.Assembly",
"System.Reflection.AssemblyName",
"System.String"
);
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
!decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsPublic &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 1 &&
new LocalTypes(decryptStringMethod).exactly(locals26) &&
checkTypeFields(fields26))
{
return("2.6");
}
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
var fields27 = new string[] {
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
"System.IO.BinaryReader",
"System.Byte[]",
"System.Int16",
"System.Boolean",
"System.Byte[]",
};
var locals27 = createLocalsArray(
"System.Boolean",
"System.Byte",
"System.Byte[]",
"System.Char[]",
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
"System.Int16",
"System.Int32",
"System.Reflection.Assembly",
"System.Reflection.AssemblyName",
"System.String"
);
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsPublic &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 1 &&
new LocalTypes(decryptStringMethod).exactly(locals27) &&
checkTypeFields(fields27))
{
return("2.7");
}
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
var fields28 = new string[] {
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
"System.IO.BinaryReader",
"System.Byte[]",
"System.Int16",
"System.Boolean",
"System.Byte[]",
"System.Boolean",
};
var locals28 = createLocalsArray(
"System.Boolean",
"System.Byte",
"System.Byte[]",
"System.Char[]",
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
"System.Int16",
"System.Int32",
"System.Reflection.Assembly",
"System.Reflection.AssemblyName",
"System.String"
);
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 1 &&
new LocalTypes(decryptStringMethod).exactly(locals28) &&
checkTypeFields(fields28))
{
return("2.8");
}
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
var fields29 = new string[] {
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
"System.IO.BinaryReader",
"System.Byte[]",
"System.Int16",
"System.Int32",
"System.Byte[]",
};
var locals29 = createLocalsArray(
"System.Boolean",
"System.Byte",
"System.Byte[]",
"System.Char[]",
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
"System.Diagnostics.StackFrame",
"System.Diagnostics.StackTrace",
"System.Int16",
"System.Int32",
"System.IO.Stream",
"System.Reflection.Assembly",
"System.Reflection.AssemblyName",
"System.Reflection.MethodBase",
"System.String",
"System.Type"
);
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals29) &&
checkTypeFields(fields29))
{
return("2.9");
}
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
var fields30 = new string[] {
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
"System.IO.BinaryReader",
"System.Byte[]",
"System.Int16",
"System.Int32",
"System.Byte[]",
};
var locals30 = createLocalsArray(
"System.Boolean",
"System.Byte",
"System.Byte[]",
"System.Char[]",
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
"System.Diagnostics.StackFrame",
"System.Diagnostics.StackTrace",
"System.Int16",
"System.Int32",
"System.IO.Stream",
"System.Reflection.Assembly",
"System.Reflection.AssemblyName",
"System.Reflection.MethodBase",
"System.String",
"System.Type"
);
var olocals30 = createLocalsArray(
"System.Int32"
);
if (otherMethods.Count == 1 &&
decryptStringType.NestedTypes.Count == 0 &&
DotNetUtils.isMethod(otherMethods[0], "System.Int32", "(System.Byte[],System.Int32,System.Byte[])") &&
otherMethods[0].IsPrivate &&
otherMethods[0].IsStatic &&
new LocalTypes(otherMethods[0]).exactly(olocals30) &&
!hasConstantM2 &&
decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals30) &&
checkTypeFields(fields30))
{
return("3.0");
}
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
var fields31 = new string[] {
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
"System.IO.BinaryReader",
"System.Byte[]",
"System.Int16",
"System.Int32",
"System.Byte[]",
};
var locals31 = createLocalsArray(
"System.Boolean",
"System.Byte",
"System.Byte[]",
"System.Char[]",
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
"System.Diagnostics.StackFrame",
"System.Diagnostics.StackTrace",
"System.Int16",
"System.Int32",
"System.IO.Stream",
"System.Reflection.Assembly",
"System.Reflection.AssemblyName",
"System.Reflection.MethodBase",
"System.String",
"System.Type"
);
var olocals31 = createLocalsArray(
"System.Int32"
);
if (otherMethods.Count == 1 &&
decryptStringType.NestedTypes.Count == 0 &&
DotNetUtils.isMethod(otherMethods[0], "System.Int32", "(System.Byte[],System.Int32,System.Byte[])") &&
otherMethods[0].IsPrivate &&
otherMethods[0].IsStatic &&
new LocalTypes(otherMethods[0]).exactly(olocals31) &&
hasConstantM2 &&
decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals31) &&
checkTypeFields(fields31))
{
return("3.1");
}
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
var fields32 = new string[] {
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
"System.IO.BinaryReader",
"System.Byte[]",
"System.Int16",
"System.Int32",
"System.Byte[]",
"System.Int32",
};
var locals32 = createLocalsArray(
"System.Boolean",
"System.Byte",
"System.Byte[]",
"System.Char[]",
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
"System.Diagnostics.StackFrame",
"System.Diagnostics.StackTrace",
"System.Int16",
"System.Int32",
"System.Int64",
"System.IO.Stream",
"System.Reflection.Assembly",
"System.Reflection.AssemblyName",
"System.Reflection.MethodBase",
"System.String",
"System.Type"
);
var olocals32 = createLocalsArray(
"System.Int32"
);
if (otherMethods.Count == 1 &&
decryptStringType.NestedTypes.Count == 0 &&
DotNetUtils.isMethod(otherMethods[0], "System.Void", "(System.Byte[],System.Int32,System.Byte[])") &&
otherMethods[0].IsPrivate &&
otherMethods[0].IsStatic &&
new LocalTypes(otherMethods[0]).exactly(olocals32) &&
hasConstantM2 &&
decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals32) &&
checkTypeFields(fields32))
{
return("3.2");
}
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
if (decryptStringType.NestedTypes.Count == 1)
{
var fields33 = new string[] {
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
"System.IO.BinaryReader",
"System.Byte[]",
"System.Int16",
"System.Int32",
"System.Byte[]",
"System.Int32",
"System.Int32",
decryptStringType.NestedTypes[0].FullName,
};
var locals33 = createLocalsArray(
"System.Boolean",
"System.Byte",
"System.Byte[]",
"System.Char[]",
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
"System.Diagnostics.StackFrame",
"System.Diagnostics.StackTrace",
"System.Int16",
"System.Int32",
"System.Int64",
"System.IO.Stream",
"System.Reflection.Assembly",
"System.Reflection.AssemblyName",
"System.Reflection.MethodBase",
"System.String",
"System.Type"
);
var olocals33 = createLocalsArray(
"System.Int32"
);
if (otherMethods.Count == 1 &&
decryptStringType.NestedTypes.Count == 1 &&
DotNetUtils.isMethod(otherMethods[0], "System.Void", "(System.Byte[],System.Int32,System.Byte[])") &&
otherMethods[0].IsPrivate &&
otherMethods[0].IsStatic &&
new LocalTypes(otherMethods[0]).exactly(olocals33) &&
hasConstantM2 &&
decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals33) &&
checkTypeFields(fields33))
{
return("3.3.29 - 3.3.57 (BETA)");
}
}
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
if (decryptStringType.NestedTypes.Count == 3)
{
var fields33 = new string[] {
getNestedTypeName(0),
getNestedTypeName(1),
"System.Byte[]",
"System.Int16",
"System.Int32",
"System.Byte[]",
"System.Int32",
"System.Int32",
getNestedTypeName(2),
};
var locals33 = createLocalsArray(
"System.Boolean",
"System.Byte",
"System.Byte[]",
"System.Char[]",
getNestedTypeName(0),
"System.Diagnostics.StackFrame",
"System.Diagnostics.StackTrace",
"System.Int16",
"System.Int32",
"System.Int64",
"System.IO.Stream",
"System.Reflection.Assembly",
"System.Reflection.AssemblyName",
"System.Reflection.MethodBase",
"System.String",
"System.Type"
);
var olocals33 = createLocalsArray(
"System.Int32"
);
if (otherMethods.Count == 1 &&
decryptStringType.NestedTypes.Count == 3 &&
DotNetUtils.isMethod(otherMethods[0], "System.Void", "(System.Byte[],System.Int32,System.Byte[])") &&
otherMethods[0].IsPrivate &&
otherMethods[0].IsStatic &&
new LocalTypes(otherMethods[0]).exactly(olocals33) &&
decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals33) &&
checkTypeFields(fields33))
{
return("3.3");
}
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
var fields33_149 = new string[] {
getNestedTypeName(0),
getNestedTypeName(1),
"System.Byte[]",
"System.Int16",
"System.Int32",
"System.Byte[]",
"System.Int32",
"System.Int32",
getNestedTypeName(2),
};
var locals33_149 = createLocalsArray(
"System.Boolean",
"System.Byte",
"System.Byte[]",
"System.Char[]",
getNestedTypeName(0),
"System.Diagnostics.StackFrame",
"System.Diagnostics.StackTrace",
"System.Int16",
"System.Int32",
"System.Int64",
"System.IO.Stream",
"System.Reflection.Assembly",
"System.Reflection.AssemblyName",
"System.Reflection.MethodBase",
"System.String",
"System.Text.StringBuilder",
"System.Type"
);
var olocals33_149 = createLocalsArray(
"System.Int32"
);
if (otherMethods.Count == 1 &&
decryptStringType.NestedTypes.Count == 3 &&
DotNetUtils.isMethod(otherMethods[0], "System.Void", "(System.Byte[],System.Int32,System.Byte[])") &&
otherMethods[0].IsPrivate &&
otherMethods[0].IsStatic &&
new LocalTypes(otherMethods[0]).exactly(olocals33_149) &&
decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals33_149) &&
checkTypeFields2(fields33_149))
{
return("3.3.149 - 3.4"); // 3.3.149+ (but not SL or CF)
}
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
var fields35 = new string[] {
getNestedTypeName(0),
getNestedTypeName(1),
"System.Byte[]",
"System.Int16",
"System.Int32",
"System.Byte[]",
"System.Int32",
"System.Int32",
getNestedTypeName(2),
};
var locals35 = createLocalsArray(
"System.Boolean",
"System.Byte",
"System.Byte[]",
"System.Char[]",
"System.Collections.Generic.IEnumerator`1<System.Int32>",
getNestedTypeName(0),
"System.Diagnostics.StackFrame",
"System.Diagnostics.StackTrace",
"System.Int16",
"System.Int32",
"System.Int64",
"System.IO.Stream",
"System.Reflection.Assembly",
"System.Reflection.AssemblyName",
"System.Reflection.MethodBase",
"System.String",
"System.Text.StringBuilder",
"System.Type"
);
var olocals35 = createLocalsArray(
"System.Int32"
);
if (otherMethods.Count == 1 &&
decryptStringType.NestedTypes.Count == 3 &&
DotNetUtils.isMethod(otherMethods[0], "System.Void", "(System.Byte[],System.Int32,System.Byte[])") &&
otherMethods[0].IsPrivate &&
otherMethods[0].IsStatic &&
new LocalTypes(otherMethods[0]).exactly(olocals35) &&
decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
decryptStringMethod.Body.ExceptionHandlers.Count >= 2 &&
new LocalTypes(decryptStringMethod).all(locals35) &&
checkTypeFields2(fields35))
{
return("3.5 - 3.6");
}
}
return(null);
}
public StringEncrypterInfo(MethodDef method)
{
this.method = method;
}
public string Decrypt(MethodDef method, int magic1, int magic2, int magic3)
{
var info = stringEncrypterInfos.Find(method);
return(info.Decrypt(magic1, magic2, magic3));
}
EmbeddedResource FindResource(MethodDef method)
{
return(DotNetUtils.GetResource(module, DotNetUtils.GetCodeStrings(method)) as EmbeddedResource);
}
public abstract void ProcessInstruction(TypeService service, MethodDef method, IList <Instruction> body, ref int index, Instruction i);
public CodeGen(Instruction[] arg, MethodDef method, IList <Instruction> instrs) : base(method, instrs)
{
this.arg = arg;
}
public override IMethod Map(MethodDef methodDef)
{
return(map.ContainsKey(methodDef) ? (MethodDef)map[methodDef] : null);
}
public int Encode(MethodDef init, RPContext ctx, int value) => this.GetKey(ctx, init).Item2(value);
public Lshow(MethodDef md, int show)
{
method = md;
showindex = show;
InitializeComponent();
}
private static void CopyMethodDef(MethodDef methodDef, InjectContext ctx)
{
var newMethodDef = (MethodDef)ctx.map[methodDef];
newMethodDef.Signature = ctx.Importer.Import(methodDef.Signature);
newMethodDef.Parameters.UpdateParameterTypes();
if (methodDef.ImplMap != null)
{
newMethodDef.ImplMap = new ImplMapUser(new ModuleRefUser(ctx.TargetModule, methodDef.ImplMap.Module.Name), methodDef.ImplMap.Name, methodDef.ImplMap.Attributes);
}
foreach (var ca in methodDef.CustomAttributes)
{
newMethodDef.CustomAttributes.Add(new CustomAttribute((ICustomAttributeType)ctx.Importer.Import(ca.Constructor)));
}
if (!methodDef.HasBody)
{
return;
}
newMethodDef.Body = new CilBody(methodDef.Body.InitLocals, new List <Instruction>(),
new List <ExceptionHandler>(), new List <Local>())
{
MaxStack = methodDef.Body.MaxStack
};
var bodyMap = new Dictionary <object, object>();
foreach (var local in methodDef.Body.Variables)
{
var newLocal = new Local(ctx.Importer.Import(local.Type));
newMethodDef.Body.Variables.Add(newLocal);
newLocal.Name = local.Name;
newLocal.Attributes = local.Attributes;
bodyMap[local] = newLocal;
}
foreach (var instr in methodDef.Body.Instructions)
{
var newInstr = new Instruction(instr.OpCode, instr.Operand)
{
SequencePoint = instr.SequencePoint
};
switch (newInstr.Operand)
{
case IType type:
newInstr.Operand = ctx.Importer.Import(type);
break;
case IMethod method:
newInstr.Operand = ctx.Importer.Import(method);
break;
case IField field:
newInstr.Operand = ctx.Importer.Import(field);
break;
}
newMethodDef.Body.Instructions.Add(newInstr);
bodyMap[instr] = newInstr;
}
foreach (var instr in newMethodDef.Body.Instructions)
{
if (instr.Operand != null && bodyMap.ContainsKey(instr.Operand))
{
instr.Operand = bodyMap[instr.Operand];
}
else if (instr.Operand is Instruction[] v)
{
instr.Operand = v.Select(target => (Instruction)bodyMap[target]).ToArray();
}
}
foreach (var eh in methodDef.Body.ExceptionHandlers)
{
newMethodDef.Body.ExceptionHandlers.Add(new ExceptionHandler(eh.HandlerType)
{
CatchType = eh.CatchType == null ? null : ctx.Importer.Import(eh.CatchType),
TryStart = (Instruction)bodyMap[eh.TryStart],
TryEnd = (Instruction)bodyMap[eh.TryEnd],
HandlerStart = (Instruction)bodyMap[eh.HandlerStart],
HandlerEnd = (Instruction)bodyMap[eh.HandlerEnd],
FilterStart = eh.FilterStart == null ? null : (Instruction)bodyMap[eh.FilterStart]
});
}
newMethodDef.Body.SimplifyMacros(newMethodDef.Parameters);
}
static string GetFullName(MethodDef md) => md == null ? "null" : md.FullName;
public override void SetProperty(DesignerPropertyInfo property, object obj)
{
base.SetProperty(property, obj);
_resetProperties = false;
Type enumtype = null;
DesignerPropertyEnum enumAtt = property.Attribute as DesignerPropertyEnum;
if (enumAtt != null)
{
enumtype = property.Property.PropertyType;
}
if (enumtype == null)
{
throw new Exception(string.Format(Resources.ExceptionDesignerAttributeExpectedEnum, property.Property.Name));
}
Behaviac.Design.Attachments.Attach evt = obj as Behaviac.Design.Attachments.Attach;
Behaviac.Design.Nodes.BaseNode baseNode = (evt != null) ? evt.Node : obj as Behaviac.Design.Nodes.BaseNode;
Behaviac.Design.Nodes.Behavior behavior = (baseNode != null) ? baseNode.Behavior as Behaviac.Design.Nodes.Behavior : null;
if (behavior == null && this._root != null)
{
behavior = this._root.Behavior as Behaviac.Design.Nodes.Behavior;
}
_agentType = null;
if (behavior != null)
{
_agentType = behavior.AgentType;
if (_agentType == null)
{
return;
}
}
object propertyMember = property.Property.GetValue(obj, null);
VariableDef variable = propertyMember as VariableDef;
RightValueDef variableRV = propertyMember as RightValueDef;
if (variable != null && variable.ValueClass != VariableDef.kSelf)
{
_agentType = Plugin.GetInstanceAgentType(variable.ValueClass);
}
if (variableRV != null && variableRV.ValueClassReal != VariableDef.kSelf)
{
string gloablClass = variableRV.ValueClassReal;
_agentType = Plugin.GetInstanceAgentType(gloablClass);
}
string selectionName = string.Empty;
if (variable != null && variable.Property != null)
{
selectionName = variable.Property.DisplayName;
}
else if (variableRV != null && variableRV.Var != null && variableRV.Var.Property != null)
{
selectionName = variableRV.Var.Property.DisplayName;
}
this.FilterType = null;
if (enumAtt != null)
{
if (enumAtt.DependedProperty != "")
{
Type objType = _object.GetType();
PropertyInfo pi = objType.GetProperty(enumAtt.DependedProperty);
object propMember = pi.GetValue(obj, null);
VariableDef var = propMember as VariableDef;
if (var != null)
{
this.FilterType = var.GetValueType();
}
else
{
MethodDef method = propMember as MethodDef;
if (method != null)
{
this.FilterType = method.ReturnType;
}
else
{
RightValueDef varRV = propMember as RightValueDef;
if (varRV != null)
{
this.FilterType = varRV.ValueType;
}
}
}
}
else
{
this.FilterType = enumAtt.FilterType;
}
}
setComboBox(selectionName);
//after the left is changed, the right might need to be invalidated
if (this.comboBox.Text != selectionName)
{
property.Property.SetValue(_object, null, null);
}
}
public void Process(IAssemblyHelper asmHelper)
{
asm = asmHelper;
Logger.Log(this, string.Format("Processing"));
// Set regex/bool
foreach (PluginValue ps in asm.Settings)
{
switch (ps.Name)
{
case "OpCodeRegex": OpCodeRegex = (List <string>)ps.Value; break;
case "OperandRegex": OperandRegex = (List <string>)ps.Value; break;
case "AttributeRegex": AttributeRegex = (List <string>)ps.Value; break;
case "MethodNameRegex": MethodNameRegex = (List <string>)ps.Value; break;
case "MethodTokenRegex": MethodTokenRegex = (List <string>)ps.Value; break;
case "MatchAll": MatchAll = (bool)ps.Value; break;
case "RemoveInlined": RemoveInlined = (bool)ps.Value; break;
case "UseHexToken": UseHexToken = (bool)ps.Value; break;
case "UseFullName": UseFullName = (bool)ps.Value; break;
}
}
Logger.Log(this, string.Format("Loaded {0} OpCodeRegex", OpCodeRegex.Count));
Logger.Log(this, string.Format("Loaded {0} OperandRegex", OperandRegex.Count));
Logger.Log(this, string.Format("Loaded {0} AttributeRegex", AttributeRegex.Count));
Logger.Log(this, string.Format("Loaded {0} TokenRegex", MethodTokenRegex.Count));
Logger.Log(this, string.Format("Loaded {0} NameRegex", MethodNameRegex.Count));
List <CallInfo> toPatch = new List <CallInfo>();
foreach (TypeDef td in asm.Module.GetTypes())
{
foreach (MethodDef md in td.Methods)
{
if (!md.HasBody)
{
continue;
}
md.Body.SimplifyMacros(md.Parameters);
}
}
List <MethodDef> allMatches = new List <MethodDef>();
foreach (TypeDef td in asm.Module.GetTypes())
{
List <MethodDef> methodMatches = GetMatching(td).Distinct().ToList();
Logger.Log(this, string.Format("Found {0} Matches for {1}", methodMatches.Count, td.Name));
allMatches.AddRange(methodMatches);
}
Logger.Log(this, string.Format("Found {0} Matches Total", allMatches.Count));
foreach (TypeDef td in asm.Module.GetTypes())
{
foreach (MethodDef md in td.Methods)
{
if (!md.HasBody)
{
continue;
}
for (int i = 0; i < md.Body.Instructions.Count; i++)
{
Instruction inst = md.Body.Instructions[i];
if ((inst.OpCode == OpCodes.Call || inst.OpCode == OpCodes.Callvirt) && inst.Operand is MethodDef)
{
// MethodDef
MethodDef mDef = inst.Operand as MethodDef;
if (allMatches.Any(x => x.MDToken == mDef.MDToken))
{
// Patch this call
toPatch.Add(new CallInfo()
{
CallingInst = inst, ParentMethod = md, TargetMethod = mDef
});
}
}
}
}
}
Logger.Log(this, string.Format("Found {0} calls to inline", toPatch.Count));
List <CallInfo> toPatch2 = new List <CallInfo>(toPatch);
// Have to do priority, if a method is already in the topatch and another has it as a target method then there needs to be priority for the latter.
List <CallInfo> cInfos = new List <CallInfo>();
foreach (CallInfo cInfo in toPatch)
{
if (cInfos.Any(x => x.TargetMethod == cInfo.ParentMethod))
{
// if it already exists in the list, insert it before
CallInfo cMatch = cInfos.Where(x => x.TargetMethod == cInfo.ParentMethod).FirstOrDefault();
if (cMatch == null)
{
// what the f**k
cInfos.Add(cInfo);
continue;
}
int index = cInfos.IndexOf(cMatch);
if (index >= 0)
{
Logger.Log(this, string.Format("Prioritizing {0} over {1}", cInfo.TargetMethod.Name, cMatch.TargetMethod.Name));
cInfos.Insert(index != 0 ? index - 1 : index, cInfo);
}
else
{
cInfos.Add(cInfo);
}
}
else
{
cInfos.Add(cInfo);
}
}
foreach (CallInfo cInfo in cInfos)
{
if (cInfo.CallingInst == null || cInfo.ParentMethod == null || cInfo.ParentMethod.Body == null)
{
continue;
}
int instIndex = cInfo.ParentMethod.Body.Instructions.IndexOf(cInfo.CallingInst);
if (!cInfo.TargetMethod.IsStatic)
{
if (cInfo.ParentMethod.Body.Instructions[instIndex - 1].OpCode == OpCodes.Ldarg)
{
cInfo.ParentMethod.Body.Instructions[instIndex - 1].OpCode = OpCodes.Nop;
cInfo.ParentMethod.Body.Instructions[instIndex - 1].Operand = null;
}
}
List <Instruction> toCopy = cInfo.TargetMethod.Body.Instructions.Where(x =>
x.OpCode != OpCodes.Ldarg &&
x.OpCode != OpCodes.Starg &&
x.OpCode != OpCodes.Nop &&
x.OpCode != OpCodes.Ret &&
x.OpCode != OpCodes.Br &&
x.OpCode != OpCodes.Switch
).ToList();
for (int i = 0; i < toCopy.Count; i++)
{
toCopy[i] = toCopy[i].Clone();
}
Dictionary <int, Local> OldLocals = new Dictionary <int, Local>();
if (cInfo.TargetMethod.Body.HasVariables)
{
foreach (var loc in cInfo.TargetMethod.Body.Variables)
{
Local l = new Local(loc.Type)
{
Name = loc.Name, PdbAttributes = loc.PdbAttributes
};
l = cInfo.ParentMethod.Body.Variables.Add(l);
OldLocals.Add(loc.Index, l);
}
Logger.Log(this, string.Format("Copied {0} Locals", OldLocals.Count));
}
for (int i = 0; i < toCopy.Count; i++)
{
if (toCopy[i].OpCode == OpCodes.Stloc || toCopy[i].OpCode == OpCodes.Ldloc)
{
if (OldLocals.ContainsKey((toCopy[i].Operand as Local).Index))
{
toCopy[i].Operand = OldLocals[(toCopy[i].Operand as Local).Index];
}
}
Instruction tReplace = toCopy[i].Clone();
if (i == 0)
{
cInfo.ParentMethod.Body.Instructions[instIndex].OpCode = tReplace.OpCode;
cInfo.ParentMethod.Body.Instructions[instIndex].Operand = tReplace.Operand;
}
else
{
cInfo.ParentMethod.Body.Instructions.Insert(instIndex + i, tReplace);
cInfo.ParentMethod.Body.UpdateInstructionOffsets();
}
}
Logger.Log(this, string.Format("Inlined {0} Instructions", toCopy.Count));
toPatch2.Remove(cInfo);
if (RemoveInlined && !toPatch2.Any(x => x.TargetMethod == cInfo.TargetMethod))
{
cInfo.TargetMethod.Body.Variables.Clear();
cInfo.TargetMethod.Body.Instructions.Clear();
cInfo.TargetMethod.Body = null;
cInfo.TargetMethod.DeclaringType.Methods.Remove(cInfo.TargetMethod);
Logger.Log(this, string.Format("Removed Method {0}", cInfo.TargetMethod.Name));
}
}
Logger.Log(this, string.Format("Processing has finished"));
}
private bool IsUsedInMethodDefinition(MethodDef method)
{
return(IsUsedInMethodReference(method) ||
IsUsedInMethodBody(method));
}
/*
* loc_8D86:
* ldc.i4 0xF967D444 ; switchStartIndex
* loc_8D8B:
* ldc.i4 0xE36F2C9D
* xor
* dup
* stloc 0x13
* ldc.i4 5
* rem.un
* switch loc_8DED, loc_8E55, loc_8E2A, loc_8D86, loc_8DBA
* br loc_8E55
*/
private void DeobfuscateSwitch(MethodDef method, int switchStartIndex)
{
IList <Instruction> insns = method.Body.Instructions;
uint initialState = (uint)(int)insns[switchStartIndex].Operand;
uint stateConstant = (uint)(int)insns[switchStartIndex + 1].Operand;
Instruction defaultBranch = (Instruction)insns[switchStartIndex + 8].Operand;
int switchEndIndex = OffsetToIndex(insns, defaultBranch.Offset);
List <int> switchTargets = ExtractTargetIndexes(insns, (IList <Instruction>)insns[switchStartIndex + 7].Operand);
List <SwitchTargetInfo> switchTargetInfos = AnalyzeSwitchTargets(insns, switchStartIndex, switchEndIndex, switchTargets);
Dictionary <int, List <int> > cfg = AnalyzeControlFlowGraph(initialState, stateConstant, switchStartIndex, switchEndIndex, switchTargetInfos);
foreach (KeyValuePair <int, List <int> > item in cfg)
{
if (item.Key < 0)
{
continue;
}
SwitchTargetInfo info = switchTargetInfos[item.Key];
switch (info.Type)
{
case SwitchTargetType.Type1:
case SwitchTargetType.Type2:
for (int i = info.PatternIndex; i <= info.EndIndex; i++)
{
insns[i].OpCode = OpCodes.Nop;
}
insns[info.PatternIndex].OpCode = OpCodes.Br;
insns[info.PatternIndex].Operand = insns[switchTargetInfos[item.Value[0]].StartIndex];
break;
case SwitchTargetType.Type3:
case SwitchTargetType.Type4:
for (int i = info.PatternIndex; i <= info.EndIndex; i++)
{
insns[i].OpCode = OpCodes.Nop;
}
insns[info.PatternIndex - 1].Operand = insns[switchTargetInfos[item.Value[0]].StartIndex];
insns[info.PatternIndex].OpCode = OpCodes.Br;
insns[info.PatternIndex].Operand = insns[switchTargetInfos[item.Value[1]].StartIndex];
break;
default:
throw new InvalidMethodException();
}
}
for (int i = switchStartIndex; i < switchStartIndex + SwitchProloguePattern.Length; i++)
{
insns[i].OpCode = OpCodes.Nop;
}
int entryIndex = switchTargetInfos[cfg[-1][0]].StartIndex;
insns[switchStartIndex].OpCode = OpCodes.Br;
insns[switchStartIndex].Operand = insns[entryIndex];
}
void RemoveMethods()
{
if (methodsDecrypter.Method != null)
{
AddEntryPointCallToBeRemoved(methodsDecrypter.Method);
}
MethodDef antiTamper = null;
MethodDef antiDebug = null;
foreach (var type in module.GetTypes())
{
foreach (var method in type.Methods)
{
if (!method.HasBody)
{
continue;
}
foreach (var str in DotNetUtils.GetCodeStrings(method))
{
if (str == " is tampered.")
{
antiTamper = method;
AddMethodToBeRemoved(antiTamper, "Anti tamper method");
break;
}
if (str == "Debugger Detected")
{
antiDebug = method;
AddMethodToBeRemoved(antiDebug, "Anti debug method");
break;
}
}
}
}
foreach (var type in module.GetTypes())
{
foreach (var method in type.Methods)
{
if (!method.HasBody)
{
continue;
}
if (emptyClass?.Method != null)
{
AddCallToBeRemoved(method, emptyClass.Method);
}
if (antiTamper != null)
{
AddCallToBeRemoved(method, antiTamper);
}
if (antiDebug != null)
{
AddCallToBeRemoved(method, antiDebug);
}
if (methodsDecrypter.Method != null)
{
AddCallToBeRemoved(method, methodsDecrypter.Method);
}
// AntiILDASM
var instr = method.Body.Instructions;
for (int i = 0; i < instr.Count; i++)
{
if (instr[i].OpCode == OpCodes.Call && instr[i].Operand is null && instr[i + 1].IsStloc() && instr[i + 2].IsLdloc())
{
instr[i].OpCode = OpCodes.Nop; // v6.0.0.0
instr[i + 2].OpCode = OpCodes.Nop;
}
if (instr[i].OpCode == OpCodes.Call && instr[i].Operand is null)
{
instr[i].OpCode = OpCodes.Nop;
}
}
}
}
}
void InjectStub(DotProtectContext context, CompressorContext compCtx, ProtectionParameters parameters, ModuleDef stubModule)
{
var rt = context.Registry.GetService <IRuntimeService>();
RandomGenerator random = context.Registry.GetService <IRandomService>().GetRandomGenerator(Id);
var comp = context.Registry.GetService <ICompressionService>();
var rtType = rt.GetRuntimeType(compCtx.CompatMode ? "DotProtect.Runtime.CompressorCompat" : "DotProtect.Runtime.Compressor");
IEnumerable <IDnlibDef> defs = InjectHelper.Inject(rtType, stubModule.GlobalType, stubModule);
switch (parameters.GetParameter(context, context.CurrentModule, "key", Mode.Normal))
{
case Mode.Normal:
compCtx.Deriver = new NormalDeriver();
break;
case Mode.Dynamic:
compCtx.Deriver = new DynamicDeriver();
break;
default:
throw new UnreachableException();
}
compCtx.Deriver.Init(context, random);
context.Logger.Debug("Encrypting modules...");
// Main
MethodDef entryPoint = defs.OfType <MethodDef>().Single(method => method.Name == "Main");
stubModule.EntryPoint = entryPoint;
if (compCtx.EntryPoint.HasAttribute("System.STAThreadAttribute"))
{
var attrType = stubModule.CorLibTypes.GetTypeRef("System", "STAThreadAttribute");
var ctorSig = MethodSig.CreateInstance(stubModule.CorLibTypes.Void);
entryPoint.CustomAttributes.Add(new CustomAttribute(
new MemberRefUser(stubModule, ".ctor", ctorSig, attrType)));
}
else if (compCtx.EntryPoint.HasAttribute("System.MTAThreadAttribute"))
{
var attrType = stubModule.CorLibTypes.GetTypeRef("System", "MTAThreadAttribute");
var ctorSig = MethodSig.CreateInstance(stubModule.CorLibTypes.Void);
entryPoint.CustomAttributes.Add(new CustomAttribute(
new MemberRefUser(stubModule, ".ctor", ctorSig, attrType)));
}
uint seed = random.NextUInt32();
compCtx.OriginModule = context.OutputModules[compCtx.ModuleIndex];
byte[] encryptedModule = compCtx.Encrypt(comp, compCtx.OriginModule, seed,
progress => context.Logger.Progress((int)(progress * 10000), 10000));
context.Logger.EndProgress();
context.CheckCancellation();
compCtx.EncryptedModule = encryptedModule;
MutationHelper.InjectKeys(entryPoint,
new[] { 0, 1 },
new[] { encryptedModule.Length >> 2, (int)seed });
InjectData(stubModule, entryPoint, encryptedModule);
// Decrypt
MethodDef decrypter = defs.OfType <MethodDef>().Single(method => method.Name == "Decrypt");
decrypter.Body.SimplifyMacros(decrypter.Parameters);
List <Instruction> instrs = decrypter.Body.Instructions.ToList();
for (int i = 0; i < instrs.Count; i++)
{
Instruction instr = instrs[i];
if (instr.OpCode == OpCodes.Call)
{
var method = (IMethod)instr.Operand;
if (method.DeclaringType.Name == "Mutation" &&
method.Name == "Crypt")
{
Instruction ldDst = instrs[i - 2];
Instruction ldSrc = instrs[i - 1];
Debug.Assert(ldDst.OpCode == OpCodes.Ldloc && ldSrc.OpCode == OpCodes.Ldloc);
instrs.RemoveAt(i);
instrs.RemoveAt(i - 1);
instrs.RemoveAt(i - 2);
instrs.InsertRange(i - 2, compCtx.Deriver.EmitDerivation(decrypter, context, (Local)ldDst.Operand, (Local)ldSrc.Operand));
}
else if (method.DeclaringType.Name == "Lzma" &&
method.Name == "Decompress")
{
MethodDef decomp = comp.GetRuntimeDecompressor(stubModule, member => { });
instr.Operand = decomp;
}
}
}
decrypter.Body.Instructions.Clear();
foreach (Instruction instr in instrs)
{
decrypter.Body.Instructions.Add(instr);
}
// Pack modules
PackModules(context, compCtx, stubModule, comp, random);
}
public bool Restore(MethodDef method)
{
this.method = method;
bool atLeastOneFailed = false;
if (method == null || method.Body == null)
{
return(!atLeastOneFailed);
}
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count; i++)
{
var instr = instrs[i];
if (instr.Operand != null)
{
continue;
}
TypeSig operandType = null, operandTypeTmp;
OpCode newOpCode = null;
SZArraySig arrayType;
switch (instr.OpCode.Code)
{
case Code.Ldelem:
arrayType = MethodStack.GetLoadedType(method, instrs, i, 1) as SZArraySig;
if (arrayType == null)
{
break;
}
operandTypeTmp = arrayType.Next;
if (operandTypeTmp == null)
{
newOpCode = OpCodes.Ldelem_Ref;
}
else
{
switch (operandTypeTmp.ElementType)
{
case ElementType.Boolean: newOpCode = OpCodes.Ldelem_I1; break;
case ElementType.Char: newOpCode = OpCodes.Ldelem_U2; break;
case ElementType.I: newOpCode = OpCodes.Ldelem_I; break;
case ElementType.I1: newOpCode = OpCodes.Ldelem_I1; break;
case ElementType.I2: newOpCode = OpCodes.Ldelem_I2; break;
case ElementType.I4: newOpCode = OpCodes.Ldelem_I4; break;
case ElementType.I8: newOpCode = OpCodes.Ldelem_I8; break;
case ElementType.U: newOpCode = OpCodes.Ldelem_I; break;
case ElementType.U1: newOpCode = OpCodes.Ldelem_U1; break;
case ElementType.U2: newOpCode = OpCodes.Ldelem_U2; break;
case ElementType.U4: newOpCode = OpCodes.Ldelem_U4; break;
case ElementType.U8: newOpCode = OpCodes.Ldelem_I8; break;
case ElementType.R4: newOpCode = OpCodes.Ldelem_R4; break;
case ElementType.R8: newOpCode = OpCodes.Ldelem_R8; break;
default: newOpCode = OpCodes.Ldelem_Ref; break;
//TODO: Ldelem
}
}
break;
case Code.Stelem:
arrayType = MethodStack.GetLoadedType(method, instrs, i, 2) as SZArraySig;
if (arrayType == null)
{
break;
}
operandTypeTmp = arrayType.Next;
if (operandTypeTmp == null)
{
newOpCode = OpCodes.Stelem_Ref;
}
else
{
switch (operandTypeTmp.ElementType)
{
case ElementType.U:
case ElementType.I: newOpCode = OpCodes.Stelem_I; break;
case ElementType.Boolean:
case ElementType.U1:
case ElementType.I1: newOpCode = OpCodes.Stelem_I1; break;
case ElementType.Char:
case ElementType.U2:
case ElementType.I2: newOpCode = OpCodes.Stelem_I2; break;
case ElementType.U4:
case ElementType.I4: newOpCode = OpCodes.Stelem_I4; break;
case ElementType.U8:
case ElementType.I8: newOpCode = OpCodes.Stelem_I8; break;
case ElementType.R4: newOpCode = OpCodes.Stelem_R4; break;
case ElementType.R8: newOpCode = OpCodes.Stelem_R8; break;
default: newOpCode = OpCodes.Stelem_Ref; break;
//TODO: Stelem
}
}
break;
case Code.Ldelema:
arrayType = MethodStack.GetLoadedType(method, instrs, i, 1) as SZArraySig;
if (arrayType == null)
{
break;
}
operandType = arrayType.Next;
if (!operandType.IsValueType)
{
newOpCode = OpCodes.Ldelem_Ref;
operandType = null;
}
break;
case Code.Ldobj:
operandType = GetPtrElementType(MethodStack.GetLoadedType(method, instrs, i, 0));
break;
case Code.Stobj:
operandType = MethodStack.GetLoadedType(method, instrs, i, 0);
if (!IsValidType(operandType))
{
operandType = GetPtrElementType(MethodStack.GetLoadedType(method, instrs, i, 1));
}
break;
default:
continue;
}
if (newOpCode == null && !IsValidType(operandType))
{
atLeastOneFailed = true;
continue;
}
instr.Operand = operandType.ToTypeDefOrRef();
if (newOpCode != null)
{
instr.OpCode = newOpCode;
}
}
return(!atLeastOneFailed);
}
private MosaInstruction ResolveInstruction(MethodDef methodDef, CilBody body, int index, GenericArgumentResolver resolver)
{
Instruction instruction = body.Instructions[index];
int? prev = index == 0 ? null : (int?)body.Instructions[index - 1].Offset;
int? next = index == body.Instructions.Count - 1 ? null : (int?)body.Instructions[index + 1].Offset;
object operand = instruction.Operand;
// Special case: newarr instructions need to have their operand changed now so that the type is a SZArray
if (instruction.OpCode == OpCodes.Newarr)
{
var typeSig = resolver.Resolve(((ITypeDefOrRef)instruction.Operand).ToTypeSig());
var szArraySig = new SZArraySig(typeSig);
operand = metadata.Loader.GetType(szArraySig);
}
else if (instruction.Operand is ITypeDefOrRef)
{
operand = ResolveTypeOperand((ITypeDefOrRef)instruction.Operand, resolver);
}
else if (instruction.Operand is MemberRef)
{
MemberRef memberRef = (MemberRef)instruction.Operand;
if (memberRef.IsFieldRef)
{
operand = ResolveFieldOperand(memberRef, resolver);
}
else
{
operand = ResolveMethodOperand(memberRef, resolver);
}
}
else if (instruction.Operand is IField)
{
operand = ResolveFieldOperand((IField)instruction.Operand, resolver);
}
else if (instruction.Operand is IMethod)
{
operand = ResolveMethodOperand((IMethod)instruction.Operand, resolver);
}
else if (instruction.Operand is Local)
{
operand = ((Local)instruction.Operand).Index;
}
else if (instruction.Operand is Parameter)
{
operand = ((Parameter)instruction.Operand).Index;
}
else if (instruction.Operand is Instruction)
{
operand = (int)((Instruction)instruction.Operand).Offset;
}
else if (instruction.Operand is Instruction[])
{
Instruction[] targets = (Instruction[])instruction.Operand;
int[] offsets = new int[targets.Length];
for (int i = 0; i < offsets.Length; i++)
{
offsets[i] = (int)targets[i].Offset;
}
operand = offsets;
}
else if (instruction.Operand is string)
{
operand = metadata.Cache.GetStringId((string)instruction.Operand);
}
ushort code = (ushort)instruction.OpCode.Code;
if (code > 0xff) // To match compiler's opcode values
{
code = (ushort)(0x100 + (code & 0xff));
}
return(new MosaInstruction((int)instruction.Offset, code, operand, prev, next));
}
public void ExcludeMethod(ConfuserContext context, MethodDef method)
{
ProtectionParameters.GetParameters(context, method).Remove(this);
}
public SelectCtorTransform(MethodDef ctorDef) => this.ctorDef = ctorDef;
public override bool ResetMembers(bool check, AgentType agentType, bool clear, MethodDef method = null, PropertyDef property = null)
{
bool bReset = false;
if (this._time != null)
{
bReset |= this._time.ResetMembers(check, agentType, clear, property);
}
bReset |= base.ResetMembers(check, agentType, clear, method, property);
return(bReset);
}
public abstract void AfterInjectionCallback(MethodDef injectedMethodDef, object obj);
public OriginalInstructionBytesReader(MethodDef method)
{
//TODO: This fails and returns null if it's a CorMethodDef!
stream = GetImageStream(method.Module, (uint)method.RVA + method.Body.HeaderSize);
}
async Task <CompilerMetadataReference[]> DecompileAndGetRefsAsync(MethodDef method, MethodSourceStatement?methodSourceStatement)
{
await DecompileAsync(method, methodSourceStatement).ConfigureAwait(false);
return(await CreateCompilerMetadataReferencesAsync(method, assemblyReferenceResolver, languageCompiler.RequiredAssemblyReferences, decompileCodeState.CancellationToken).ConfigureAwait(false));
}
public virtual void DecompileMethod(MethodDef method, ITextOutput output, DecompilationOptions options)
{
WriteCommentLine(output, TypeToString(method.DeclaringType, true) + "." + method.Name);
}
async Task StartDecompileAsync(MethodDef method, MethodSourceStatement?methodSourceStatement)
{
bool canCompile = false, canceled = false;
var assemblyReferences = Array.Empty <CompilerMetadataReference>();
string mainCode, hiddenCode;
var refSpan = new Span(0, 0);
try {
assemblyReferences = await DecompileAndGetRefsAsync(method, methodSourceStatement);
mainCode = decompileCodeState.MainOutput.ToString();
hiddenCode = decompileCodeState.HiddenOutput.ToString();
canCompile = true;
var span = decompileCodeState.MainOutput.Span;
if (span != null)
{
refSpan = span.Value;
}
}
catch (OperationCanceledException) {
canceled = true;
mainCode = string.Empty;
hiddenCode = string.Empty;
}
catch (Exception ex) {
mainCode = ex.ToString();
hiddenCode = string.Empty;
}
const string MAIN_CODE_NAME = "main";
var codeDocs = Array.Empty <ICodeDocument>();
if (!canceled)
{
// This helps a little to speed up the code
ProfileOptimizationHelper.StartProfile("add-decompiled-code-" + decompiler.UniqueGuid.ToString());
var docs = new List <IDecompiledDocument>();
docs.Add(new DecompiledDocument(mainCode, MAIN_CODE_NAME));
if (hiddenCode != string.Empty)
{
docs.Add(new DecompiledDocument(hiddenCode, MAIN_CODE_NAME + ".g"));
}
codeDocs = languageCompiler.AddDecompiledCode(new DecompiledCodeResult(docs.ToArray(), assemblyReferences, assemblyReferenceResolver, PlatformHelper.GetPlatform(method.Module)));
}
decompileCodeState?.Dispose();
decompileCodeState = null;
foreach (var doc in codeDocs)
{
doc.TextView.Properties.AddProperty(editCodeTextViewKey, this);
}
Documents.AddRange(codeDocs.Select(a => new CodeDocument(a)));
SelectedDocument = Documents.FirstOrDefault(a => a.NameNoExtension == MAIN_CODE_NAME) ?? Documents.FirstOrDefault();
foreach (var doc in Documents)
{
if (doc.NameNoExtension == MAIN_CODE_NAME && refSpan.End <= doc.TextView.TextSnapshot.Length)
{
doc.Initialize(new SnapshotPoint(doc.TextView.TextSnapshot, refSpan.Start));
}
else
{
doc.Initialize(new SnapshotPoint(doc.TextView.TextSnapshot, 0));
}
}
CanCompile = canCompile;
HasDecompiled = true;
OnPropertyChanged(nameof(HasDecompiled));
}
static Task <CompilerMetadataReference[]> CreateCompilerMetadataReferencesAsync(MethodDef method, AssemblyReferenceResolver assemblyReferenceResolver, IEnumerable <string> extraAssemblyReferences, CancellationToken cancellationToken)
{
cancellationToken.ThrowIfCancellationRequested();
var modules = new HashSet <ModuleDef>(new MetadataReferenceFinder(method.Module, cancellationToken).Find(extraAssemblyReferences));
var mdRefs = new List <CompilerMetadataReference>();
foreach (var module in modules)
{
cancellationToken.ThrowIfCancellationRequested();
CompilerMetadataReference?cmr;
if (module.IsManifestModule)
{
cmr = assemblyReferenceResolver.Create(module.Assembly);
}
else
{
cmr = assemblyReferenceResolver.Create(module);
}
if (cmr == null)
{
continue;
}
mdRefs.Add(cmr.Value);
}
return(Task.FromResult(mdRefs.ToArray()));
}
