public static IEnumerable <MethodDef> GetMethods(this ModuleDef module)
{
foreach (var type in AllTypesHelper.Types(module.Types))
{
foreach (var method in type.Methods)
{
yield return(method);
}
}
}
/// <summary>
/// Find a method inside a module.
/// </summary>
/// <param name="module">Module</param>
/// <param name="methodToMatch">Method</param>
/// <param name="fuzzy">Matching mode</param>
/// <param name="threshold">Threshold of the fuzzy comparison (ignored if not fuzzy)</param>
/// <returns>Returns all the method that matches.</returns>
static public IEnumerable <MethodDef> GetSimilarMethods(ModuleDef module, MethodDef methodToMatch, bool fuzzy = false, double threshold = 0.0, ComparisonMode mode = ComparisonMode.PreferFirst)
{
foreach (var v in AllTypesHelper.Types(module.Types))
{
foreach (var vv in FindMethod(v, methodToMatch, fuzzy, threshold))
{
yield return(vv);
}
}
}
static public void FindAndReplaceWithResult(List <MethodDef> toFind, ModuleDefMD whereToFind,
Dictionary <string, MethodInfo> usableType, object instance)
{
List <MethodDef> methodsToCopy = new List <MethodDef>();
toFind.ForEach(x => methodsToCopy.AddRange(BodyComparison.GetSimilarMethods(whereToFind, x, true, 0.70).ToList()));
foreach (var v in toFind)
{
foreach (var toReplace in BodyComparison.GetSimilarMethods(whereToFind, v, true, 0.70))
{
foreach (var currentType in AllTypesHelper.Types(whereToFind.Types))
{
foreach (var currentMethod in currentType.Methods)
{
if (!currentMethod.HasBody)
{
continue;
}
for (var i = 0; i < currentMethod.Body.Instructions.Count; ++i)
{
if (currentMethod.Body.Instructions[i].Operand == null)
{
continue;
}
if (currentMethod.Body.Instructions[i].Operand is MethodDef && currentMethod.Body.Instructions[i].Operand == toReplace)
{
if (toReplace.Body.Instructions[i].OpCode == OpCodes.Call)
{
}
}
}
}
}
}
}
}
void RestoreMethodBodies(ISimpleDeobfuscator simpleDeobfuscator)
{
var methodToOrigMethods = new MethodDefAndDeclaringTypeDict <List <MethodDef> >();
foreach (var t in module.Types)
{
var types = new List <TypeDef>(AllTypesHelper.Types(new List <TypeDef> {
t
}));
foreach (var type in types)
{
if (methodsTypes.Find(type))
{
continue;
}
foreach (var method in type.Methods)
{
if (method.Name == ".ctor" || method.Name == ".cctor")
{
continue;
}
MethodDef calledMethod;
if (!CheckRestoreBody(method, out calledMethod))
{
continue;
}
if (!CheckSameMethods(method, calledMethod))
{
continue;
}
if (!methodsTypes.Find(calledMethod.DeclaringType))
{
continue;
}
if (types.IndexOf(calledMethod.DeclaringType) < 0)
{
continue;
}
var list = methodToOrigMethods.Find(calledMethod);
if (list == null)
{
methodToOrigMethods.Add(calledMethod, list = new List <MethodDef>());
}
list.Add(method);
}
}
}
foreach (var calledMethod in methodToOrigMethods.GetKeys())
{
var list = methodToOrigMethods.Find(calledMethod);
var method = list[0];
Logger.v("Restored method body {0:X8} from method {1:X8}",
method.MDToken.ToInt32(),
calledMethod.MDToken.ToInt32());
DotNetUtils.CopyBodyFromTo(calledMethod, method);
classMethods.Add(calledMethod, method);
simpleDeobfuscator.MethodModified(method);
}
}
