Exemple #1
0
        bool CheckType(MethodDef initMethod)
        {
            if (!initMethod.HasBody)
            {
                return(false);
            }
            if (DotNetUtils.FindFieldType(initMethod.DeclaringType, "System.Reflection.Assembly", true) == null)
            {
                return(false);
            }

            resolverVersion = CheckSetupMethod(initMethod);
            if (resolverVersion == ResolverVersion.None)
            {
                resolverVersion = CheckSetupMethod(initMethod.DeclaringType.FindStaticConstructor());
            }
            if (resolverVersion == ResolverVersion.None)
            {
                return(false);
            }

            resolverType   = initMethod.DeclaringType;
            resolverMethod = initMethod;
            return(true);
        }
        bool FindStringDecrypterType(out TypeDef theType, out MethodDef theMethod)
        {
            theType   = null;
            theMethod = null;

            foreach (var type in module.Types)
            {
                if (type.IsPublic)
                {
                    continue;
                }
                if (type.Fields.Count != 1)
                {
                    continue;
                }
                if (DotNetUtils.FindFieldType(type, "System.Byte[]", true) == null)
                {
                    continue;
                }
                if (type.Methods.Count != 2 && type.Methods.Count != 3)
                {
                    continue;
                }
                if (type.NestedTypes.Count > 0)
                {
                    continue;
                }

                MethodDef method = null;
                foreach (var m in type.Methods)
                {
                    if (m.Name == ".ctor" || m.Name == ".cctor")
                    {
                        continue;
                    }
                    if (DotNetUtils.IsMethod(m, "System.String", "(System.Int32)"))
                    {
                        method = m;
                        continue;
                    }
                    break;
                }
                if (method == null)
                {
                    continue;
                }

                theType   = type;
                theMethod = method;
                return(true);
            }

            return(false);
        }
Exemple #3
0
        protected override bool CheckResolverType(TypeDef type)
        {
            if (DotNetUtils.FindFieldType(type, "System.Collections.Hashtable", true) != null ||
                DotNetUtils.FindFieldType(type, "System.Collections.Generic.Dictionary`2<System.String,System.Reflection.Assembly>", true) != null)
            {
                return(true);
            }

            foreach (var field in type.Fields)
            {
                if (DotNetUtils.DerivesFromDelegate(DotNetUtils.GetType(module, field.FieldType)))
                {
                    continue;
                }
                if (field.IsLiteral && field.FieldType.ToString() == "System.String")
                {
                    continue;
                }
                return(false);
            }
            return(true);
        }
Exemple #4
0
        MethodDef GetProxyCreateMethod(TypeDef type)
        {
            if (DotNetUtils.FindFieldType(type, "System.ModuleHandle", true) == null)
            {
                return(null);
            }
            if (!type.HasFields)
            {
                return(null);
            }
            if (type.Fields.Count > 25)
            {
                return(null);
            }

            MethodDef createMethod = null;

            foreach (var m in type.Methods)
            {
                if (m.Name == ".ctor" || m.Name == ".cctor")
                {
                    continue;
                }
                if (createMethod == null && DotNetUtils.IsMethod(m, "System.Void", "(System.Int32,System.Int32,System.Int32)"))
                {
                    createMethod = m;
                }
            }
            if (createMethod == null || !createMethod.HasBody)
            {
                return(null);
            }
            if (!DeobUtils.HasInteger(createMethod, 0xFFFFFF))
            {
                return(null);
            }

            return(createMethod);
        }
Exemple #5
0
        bool CheckType(TypeDef type, MethodDef initMethod, ISimpleDeobfuscator simpleDeobfuscator)
        {
            if (DotNetUtils.FindFieldType(type, "System.Collections.Hashtable", true) == null)
            {
                return(false);
            }
            simpleDeobfuscator.Deobfuscate(initMethod);
            if (!CheckInitMethod(initMethod))
            {
                return(false);
            }
            if ((asmSeparator = FindAssemblySeparator(initMethod)) == null)
            {
                return(false);
            }

            List <AssemblyInfo> newAssemblyInfos = null;

            foreach (var s in DotNetUtils.GetCodeStrings(initMethod))
            {
                newAssemblyInfos = InitializeEmbeddedAssemblies(s);
                if (newAssemblyInfos != null)
                {
                    break;
                }
            }
            if (newAssemblyInfos == null)
            {
                return(false);
            }

            resolverType   = type;
            resolverMethod = initMethod;
            assemblyInfos  = newAssemblyInfos;
            return(true);
        }
 protected override bool CheckResolverType(TypeDef type)
 {
     return(DotNetUtils.FindFieldType(type, "System.Reflection.Assembly", true) != null);
 }