public PatchInfo[] FindInstructionsByOperand(PatchInfo patchInfo, int[] operand, bool removeIfFound = false)
{
List <ObfuscatedPatchInfo> obfuscatedPatchInfos = new List <ObfuscatedPatchInfo>();
List <int> operands = operand.ToList();
TypeDef type = FindType(patchInfo);
MethodDef m = null;
if (patchInfo.Method != null)
{
m = FindMethod(patchInfo);
}
if (m != null)
{
List <int> indexList = new List <int>();
var obfuscatedPatchInfo = new ObfuscatedPatchInfo()
{
Type = type, Method = m
};
int i = 0;
foreach (var instruction in m.Body.Instructions)
{
if (instruction.Operand != null)
{
if (operands.Contains(Convert.ToInt32(instruction.Operand.ToString())))
{
indexList.Add(i);
if (removeIfFound)
{
operands.Remove(Convert.ToInt32(instruction.Operand.ToString()));
}
}
}
i++;
}
if (indexList.Count == operand.Length || removeIfFound == false)
{
obfuscatedPatchInfo.Indices = indexList;
obfuscatedPatchInfos.Add(obfuscatedPatchInfo);
}
operands = operand.ToList();
}
else
{
foreach (var method in type.Methods)
{
if (method.Body != null)
{
List <int> indexList = new List <int>();
var obfuscatedPatchInfo = new ObfuscatedPatchInfo()
{
Type = type, Method = method
};
int i = 0;
foreach (var instruction in method.Body.Instructions)
{
if (instruction.Operand != null)
{
if (operands.Contains(Convert.ToInt32(instruction.Operand.ToString())))
{
indexList.Add(i);
if (removeIfFound)
{
operands.Remove(Convert.ToInt32(instruction.Operand.ToString()));
}
}
}
i++;
}
if (indexList.Count == operand.Length || removeIfFound == false)
{
obfuscatedPatchInfo.Indices = indexList;
obfuscatedPatchInfos.Add(obfuscatedPatchInfo);
}
operands = operand.ToList();
}
}
}
List <PatchInfo> patchInfos = new List <PatchInfo>();
foreach (var obfuscatedPatchInfo in obfuscatedPatchInfos)
{
PatchInfo t = new PatchInfo()
{
Namespace = obfuscatedPatchInfo.Type.Namespace,
Class = obfuscatedPatchInfo.Type.Name,
Method = obfuscatedPatchInfo.Method.Name,
NestedClasses = obfuscatedPatchInfo.NestedTypes.ToArray()
};
if (obfuscatedPatchInfo.Indices.Count == 1)
{
t.Index = obfuscatedPatchInfo.Indices[0];
}
else if (obfuscatedPatchInfo.Indices.Count > 1)
{
t.Indices = obfuscatedPatchInfo.Indices.ToArray();
}
patchInfos.Add(t);
}
return(patchInfos.ToArray());
}
public PatchInfo[] FindInstructionsByOpcode(OpCode[] opcode)
{
List <ObfuscatedPatchInfo> obfuscatedPatchInfos = new List <ObfuscatedPatchInfo>();
List <string> operands = opcode.Select(o => o.Name).ToList();
foreach (var type in Module.Types)
{
if (!type.HasNestedTypes)
{
foreach (var method in type.Methods)
{
if (method.Body != null)
{
List <int> indexList = new List <int>();
var obfuscatedPatchInfo = new ObfuscatedPatchInfo()
{
Type = type, Method = method
};
int i = 0;
foreach (var instruction in method.Body.Instructions)
{
if (operands.Contains(instruction.OpCode.Name))
{
indexList.Add(i);
operands.Remove(instruction.OpCode.Name);
}
i++;
}
if (indexList.Count == opcode.Length)
{
obfuscatedPatchInfo.Indices = indexList;
obfuscatedPatchInfos.Add(obfuscatedPatchInfo);
}
operands = opcode.Select(o => o.Name).ToList();
}
}
}
else
{
var nestedTypes = type.NestedTypes;
NestedWorker:
foreach (var nestedType in nestedTypes)
{
foreach (var method in type.Methods)
{
if (method.Body != null)
{
List <int> indexList = new List <int>();
var obfuscatedPatchInfo = new ObfuscatedPatchInfo()
{
Type = type, Method = method
};
int i = 0;
obfuscatedPatchInfo.NestedTypes.Add(nestedType.Name);
foreach (var instruction in method.Body.Instructions)
{
if (operands.Contains(instruction.OpCode.Name))
{
indexList.Add(i);
operands.Remove(instruction.OpCode.Name);
}
i++;
}
if (indexList.Count == opcode.Length)
{
obfuscatedPatchInfo.Indices = indexList;
obfuscatedPatchInfos.Add(obfuscatedPatchInfo);
}
operands = opcode.Select(o => o.Name).ToList();
}
}
if (nestedType.HasNestedTypes)
{
nestedTypes = nestedType.NestedTypes;
goto NestedWorker;
}
}
}
}
List <PatchInfo> patchInfos = new List <PatchInfo>();
foreach (var obfuscatedPatchInfo in obfuscatedPatchInfos)
{
PatchInfo t = new PatchInfo()
{
Namespace = obfuscatedPatchInfo.Type.Namespace,
Class = obfuscatedPatchInfo.Type.Name,
Method = obfuscatedPatchInfo.Method.Name,
NestedClasses = obfuscatedPatchInfo.NestedTypes.ToArray()
};
if (obfuscatedPatchInfo.Indices.Count == 1)
{
t.Index = obfuscatedPatchInfo.Indices[0];
}
else if (obfuscatedPatchInfo.Indices.Count > 1)
{
t.Indices = obfuscatedPatchInfo.Indices.ToArray();
}
patchInfos.Add(t);
}
return(patchInfos.ToArray());
}
