static uint GetStructSize(McKey mcKey)
{
uint magicLo = mcKey.ReadUInt32(0x8C0);
uint magicHi = mcKey.ReadUInt32(0x8C4);
// Key reader of McKey8C0h keys(untested).
// Print MagicLo from McKey8C0h
Logger.vv("The MagicLo from McKey8C0h is");
Logger.Instance.Indent();
Logger.vv("MagicLo = 0x" + magicLo.ToString("X"));
Logger.Instance.DeIndent();
// Print MagicHi from McKey8C0h
Logger.vv("The MagicHi from McKey8C0h is");
Logger.Instance.Indent();
Logger.vv("MagicHi = 0x" + magicHi.ToString("X"));
Logger.Instance.DeIndent();
Logger.vv("If keys are new, add them with version info into EncryptionInfo[] McKey8C0h in de4dot.code\\deobfuscators\\MaxtoCode\\EncryptionInfos.cs, then publish your code.");
foreach (var info in EncryptionInfos.McKey8C0h)
{
if (magicLo == info.MagicLo && magicHi == info.MagicHi)
{
Logger.vv("Keys in McKey8C0h infos is used.");
return(0xC + 6 * ENCRYPTED_DATA_INFO_SIZE);
}
}
return(0xC + 3 * ENCRYPTED_DATA_INFO_SIZE);
}
static uint GetStructSize(McKey mcKey) {
uint magicLo = mcKey.ReadUInt32(0x8C0);
uint magicHi = mcKey.ReadUInt32(0x8C4);
foreach (var info in EncryptionInfos.McKey8C0h) {
if (magicLo == info.MagicLo && magicHi == info.MagicHi)
return 0xC + 6 * ENCRYPTED_DATA_INFO_SIZE;
}
return 0xC + 3 * ENCRYPTED_DATA_INFO_SIZE;
}
static uint GetStructSize(McKey mcKey)
{
uint magicLo = mcKey.ReadUInt32(0x8C0);
uint magicHi = mcKey.ReadUInt32(0x8C4);
foreach (var info in EncryptionInfos.McKey8C0h)
{
if (magicLo == info.MagicLo && magicHi == info.MagicHi)
{
return(0xC + 6 * ENCRYPTED_DATA_INFO_SIZE);
}
}
return(0xC + 3 * ENCRYPTED_DATA_INFO_SIZE);
}
public MethodInfos(ModuleDef module, MainType mainType, MyPEImage peImage, PeHeader peHeader, McKey mcKey) {
this.module = module;
this.mainType = mainType;
this.peImage = peImage;
this.peHeader = peHeader;
this.mcKey = mcKey;
structSize = GetStructSize(mcKey);
uint methodInfosRva = peHeader.GetRva(0x0FF8, mcKey.ReadUInt32(0x005A));
uint encryptedDataRva = peHeader.GetRva(0x0FF0, mcKey.ReadUInt32(0x0046));
methodInfosOffset = peImage.RvaToOffset(methodInfosRva);
encryptedDataOffset = peImage.RvaToOffset(encryptedDataRva);
}
public MethodInfos(ModuleDef module, MainType mainType, MyPEImage peImage, PeHeader peHeader, McKey mcKey)
{
this.module = module;
this.mainType = mainType;
this.peImage = peImage;
this.peHeader = peHeader;
this.mcKey = mcKey;
structSize = GetStructSize(mcKey);
uint methodInfosRva = peHeader.GetRva(0x0FF8, mcKey.ReadUInt32(0x005A));
uint encryptedDataRva = peHeader.GetRva(0x0FF0, mcKey.ReadUInt32(0x0046));
methodInfosOffset = peImage.RvaToOffset(methodInfosRva);
encryptedDataOffset = peImage.RvaToOffset(encryptedDataRva);
}
EncryptionVersion GetVersion()
{
if (peHeader.EncryptionVersion != EncryptionVersion.Unknown)
{
// Print EncryptionVersion
Logger.vv("The EncryptionVersion is");
Logger.Instance.Indent();
Logger.vv("Version = EncryptionVersion." + peHeader.EncryptionVersion.ToString());
Logger.vv("Add this version info with new keys into EncryptionInfo[] Rva900h and EncryptionInfo[] McKey8C0h in de4dot.code\\deobfuscators\\MaxtoCode\\EncryptionInfos.cs, then publish your code.");
Logger.Instance.DeIndent();
return(peHeader.EncryptionVersion);
}
uint m2lo = mcKey.ReadUInt32(0x8C0);
uint m2hi = mcKey.ReadUInt32(0x8C4);
foreach (var info in EncryptionInfos.McKey8C0h)
{
if (info.MagicLo == m2lo && info.MagicHi == m2hi)
{
return(info.Version);
}
}
Logger.w("Could not detect MC version. Magic2: {0:X8} {1:X8}", m2lo, m2hi);
return(EncryptionVersion.Unknown);
}
EncryptionVersion GetVersion()
{
if (peHeader.EncryptionVersion != EncryptionVersion.Unknown)
{
return(peHeader.EncryptionVersion);
}
uint m2lo = mcKey.ReadUInt32(0x8C0);
uint m2hi = mcKey.ReadUInt32(0x8C4);
foreach (var info in EncryptionInfos.McKey8C0h)
{
if (info.MagicLo == m2lo && info.MagicHi == m2hi)
{
return(info.Version);
}
}
Logger.w("Could not detect MC version. Magic2: {0:X8} {1:X8}", m2lo, m2hi);
return(EncryptionVersion.Unknown);
}
