Example #1
0
        string GetResourceName()
        {
            var defaultName = module.Assembly.Name.String + module.Assembly.Name.String;

            var cctor = stringDecrypterType.FindStaticConstructor();

            if (cctor == null)
            {
                return(defaultName);
            }

            foreach (var s in DotNetUtils.GetCodeStrings(cctor))
            {
                if (DotNetUtils.GetResource(module, s) != null)
                {
                    return(s);
                }
                try {
                    return(Encoding.UTF8.GetString(Convert.FromBase64String(s)));
                }
                catch {
                    string s2 = CoUtils.DecryptResourceName(module, cctor);
                    try {
                        return(Encoding.UTF8.GetString(Convert.FromBase64String(s2)));
                    }
                    catch {
                    }
                }
            }

            return(defaultName);
        }
        public void Decrypt(ResourceDecrypter resourceDecrypter, ISimpleDeobfuscator simpleDeobfuscator)
        {
            if (decryptMethod == null)
            {
                return;
            }

            resource = CoUtils.GetResource(module, decrypterCctor);
            if (resource == null)
            {
                return;
            }
            var decrypted    = resourceDecrypter.Decrypt(resource.GetResourceStream());
            var reader       = MemoryImageStream.Create(decrypted);
            int numEncrypted = reader.ReadInt32();

            Logger.v("Restoring {0} encrypted methods", numEncrypted);
            Logger.Instance.Indent();
            for (int i = 0; i < numEncrypted; i++)
            {
                int  delegateTypeToken = reader.ReadInt32();
                uint codeOffset        = reader.ReadUInt32();
                var  origOffset        = reader.Position;
                reader.Position = codeOffset;
                Decrypt(reader, delegateTypeToken, simpleDeobfuscator);
                reader.Position = origOffset;
            }
            Logger.Instance.DeIndent();
        }
Example #3
0
        public void decrypt(ResourceDecrypter resourceDecrypter)
        {
            if (decryptMethod == null)
            {
                return;
            }

            resource = CoUtils.getResource(module, decrypterCctor);
            if (resource == null)
            {
                return;
            }
            var decrypted    = resourceDecrypter.decrypt(resource.GetResourceStream());
            var reader       = new BinaryReader(new MemoryStream(decrypted));
            int numEncrypted = reader.ReadInt32();

            Log.v("Restoring {0} encrypted methods", numEncrypted);
            Log.indent();
            for (int i = 0; i < numEncrypted; i++)
            {
                int  delegateTypeToken = reader.ReadInt32();
                uint codeOffset        = reader.ReadUInt32();
                var  origOffset        = reader.BaseStream.Position;
                reader.BaseStream.Position = codeOffset;
                decrypt(reader, delegateTypeToken);
                reader.BaseStream.Position = origOffset;
            }
            Log.deIndent();
        }
Example #4
0
        public void init(ResourceDecrypter resourceDecrypter)
        {
            if (decrypterType == null)
            {
                return;
            }

            encryptedResource = CoUtils.getResource(module, DotNetUtils.getCodeStrings(DotNetUtils.getMethod(decrypterType, ".cctor")));
            constantsData     = resourceDecrypter.decrypt(encryptedResource.GetResourceStream());
        }
        public void init(ResourceDecrypter resourceDecrypter)
        {
            if (decrypterType == null)
            {
                return;
            }

            encryptedResource = CoUtils.getResource(module, DotNetUtils.getCodeStrings(decrypterType.FindStaticConstructor()));
            encryptedResource.Data.Position = 0;
            constantsData = resourceDecrypter.decrypt(encryptedResource.Data.CreateStream());
        }
Example #6
0
        public void Initialize(ResourceDecrypter resourceDecrypter)
        {
            if (decrypterType == null)
            {
                return;
            }

            var cctor = decrypterType.FindStaticConstructor();

            encryptedResource = CoUtils.GetResource(module, DotNetUtils.GetCodeStrings(cctor));

            //if the return value is null, it is possible that resource name is encrypted
            if (encryptedResource == null)
            {
                var Resources = new string[] { CoUtils.DecryptResourceName(module, cctor) };
                encryptedResource = CoUtils.GetResource(module, Resources);
            }

            constantsData = resourceDecrypter.Decrypt(encryptedResource.GetReader().AsStream());
        }