protected override void ScanForObfuscator()
        {
            foreach (var type in module.Types)
            {
                if (type.FullName == "CryptoObfuscator.ProtectedWithCryptoObfuscatorAttribute")
                {
                    foundCryptoObfuscatorAttribute = true;
                    AddAttributeToBeRemoved(type, "Obfuscator attribute");
                    InitializeVersion(type);
                }
            }
            if (CheckCryptoObfuscator())
            {
                foundObfuscatedSymbols = true;
            }

            inlinedMethodTypes = new InlinedMethodTypes();
            methodsDecrypter   = new MethodsDecrypter(module);
            methodsDecrypter.Find();
            proxyCallFixer = new ProxyCallFixer(module);
            proxyCallFixer.FindDelegateCreator();
            stringDecrypter = new StringDecrypter(module);
            stringDecrypter.Find();
            tamperDetection = new TamperDetection(module);
            tamperDetection.Find();
            constantsDecrypter = new ConstantsDecrypter(module, initializedDataCreator);
            constantsDecrypter.Find();
            foundObfuscatorUserString = Utils.StartsWith(module.ReadUserString(0x70000001), "\u0011\"3D9B94A98B-76A8-4810-B1A0-4BE7C4F9C98D", StringComparison.Ordinal);
        }
Example #2
0
        FieldDefAndDeclaringTypeDict <FieldDef> FindFieldTypes()
        {
            var dict = new FieldDefAndDeclaringTypeDict <FieldDef>();

            foreach (var type in module.GetTypes())
            {
                foreach (var method in type.Methods)
                {
                    var body = method.Body;
                    if (body == null)
                    {
                        continue;
                    }
                    foreach (var instr in body.Instructions)
                    {
                        if (instr.OpCode.Code != Code.Ldsfld)
                        {
                            continue;
                        }
                        var field = instr.Operand as FieldDef;
                        if (field == null)
                        {
                            continue;
                        }
                        var declType = field.DeclaringType;
                        if (declType == null)
                        {
                            continue;
                        }
                        if (!InlinedMethodTypes.IsValidFieldType(declType))
                        {
                            continue;
                        }
                        dict.Add(field, field);
                    }
                }
            }

            return(dict);
        }
        protected override bool CanInline(MethodDef method)
        {
            if (method == null)
            {
                return(false);
            }

            if (method.Attributes != (MethodAttributes.Assembly | MethodAttributes.Static | MethodAttributes.HideBySig))
            {
                return(false);
            }
            if (method.HasGenericParameters)
            {
                return(false);
            }
            if (!InlinedMethodTypes.IsValidMethodType(method.DeclaringType))
            {
                return(false);
            }

            return(true);
        }
Example #4
0
 public LdnullFixer(ModuleDef module, InlinedMethodTypes inlinedMethodTypes)
 {
     this.module             = module;
     this.inlinedMethodTypes = inlinedMethodTypes;
 }
Example #5
0
		protected override void ScanForObfuscator() {
			foreach (var type in module.Types) {
				if (type.FullName == "CryptoObfuscator.ProtectedWithCryptoObfuscatorAttribute") {
					foundCryptoObfuscatorAttribute = true;
					AddAttributeToBeRemoved(type, "Obfuscator attribute");
					InitializeVersion(type);
				}
			}
			if (CheckCryptoObfuscator())
				foundObfuscatedSymbols = true;

			inlinedMethodTypes = new InlinedMethodTypes();
			methodsDecrypter = new MethodsDecrypter(module);
			methodsDecrypter.Find();
			proxyCallFixer = new ProxyCallFixer(module);
			proxyCallFixer.FindDelegateCreator();
			stringDecrypter = new StringDecrypter(module);
			stringDecrypter.Find();
			tamperDetection = new TamperDetection(module);
			tamperDetection.Find();
			constantsDecrypter = new ConstantsDecrypter(module, initializedDataCreator);
			constantsDecrypter.Find();
			foundObfuscatorUserString = Utils.StartsWith(module.ReadUserString(0x70000001), "\u0011\"3D9B94A98B-76A8-4810-B1A0-4BE7C4F9C98D", StringComparison.Ordinal);
		}
 public CoMethodCallInliner(InlinedMethodTypes inlinedMethodTypes)
     : base(false)
 {
     this.inlinedMethodTypes = inlinedMethodTypes;
 }
		public CoMethodCallInliner(InlinedMethodTypes inlinedMethodTypes)
			: base(false) {
			this.inlinedMethodTypes = inlinedMethodTypes;
		}
		public LdnullFixer(ModuleDef module, InlinedMethodTypes inlinedMethodTypes) {
			this.module = module;
			this.inlinedMethodTypes = inlinedMethodTypes;
		}