Exemple #1
0
 public void UpdateMethodHeaderInfo(DumpedMethod dm, MethodBodyHeader mbHeader)
 {
     dm.mhFlags          = mbHeader.flags;
     dm.mhMaxStack       = mbHeader.maxStack;
     dm.mhCodeSize       = dm.code == null ? 0 : (uint)dm.code.Length;
     dm.mhLocalVarSigTok = mbHeader.localVarSigTok;
 }
Exemple #2
0
        void DecryptMethods(uint codeHeaderOffset, MDTable methodDefTable, ICsHeader csHeader, ref DumpedMethods dumpedMethods)
        {
            var methodInfos = csHeader.GetMethodInfos(codeHeaderOffset);

            csHeader.PatchMethodTable(methodDefTable, methodInfos);

            dumpedMethods = new DumpedMethods();
            decrypter     = csHeader.CreateDecrypter();
            for (uint rid = 1; rid <= (uint)methodInfos.Count; rid++)
            {
                var methodInfo = methodInfos[(int)rid - 1];
                if (methodInfo.codeOffs == 0)
                {
                    continue;
                }

                var dm = new DumpedMethod();
                peImage.ReadMethodTableRowTo(dm, rid);

                var mbHeader = decrypter.Decrypt(methodInfo, out dm.code, out dm.extraSections);
                peImage.UpdateMethodHeaderInfo(dm, mbHeader);

                dumpedMethods.Add(dm);
            }
        }
Exemple #3
0
        void DecryptMethodsOld(MDTable methodDefTable, ref DumpedMethods dumpedMethods)
        {
            dumpedMethods = new DumpedMethods();
            var decrypter = new Decrypter10(peImage, codeHeader.decryptionKey);

            for (uint rid = 1; rid <= methodDefTable.Rows; rid++)
            {
                var dm = new DumpedMethod();

                var method = (MethodDef)module.ResolveMethod(rid);
                if (method == null || method.DeclaringType == module.GlobalType)
                {
                    continue;
                }

                peImage.ReadMethodTableRowTo(dm, rid);
                if (dm.mdRVA == 0)
                {
                    continue;
                }
                uint bodyOffset = peImage.RvaToOffset(dm.mdRVA);

                var mbHeader = decrypter.Decrypt(bodyOffset, out dm.code, out dm.extraSections);
                peImage.UpdateMethodHeaderInfo(dm, mbHeader);

                dumpedMethods.Add(dm);
            }
        }
        DumpedMethods CreateDumpedMethods(MyPEImage peImage, byte[] fileData, byte[] methodsData)
        {
            var dumpedMethods = new DumpedMethods();

            var methodsDataReader = MemoryImageStream.Create(methodsData);
            var fileDataReader    = MemoryImageStream.Create(fileData);

            var methodDef = peImage.MetaData.TablesStream.MethodTable;

            for (uint rid = 1; rid <= methodDef.Rows; rid++)
            {
                var dm = new DumpedMethod();

                peImage.ReadMethodTableRowTo(dm, rid);
                if (dm.mdRVA == 0)
                {
                    continue;
                }
                uint bodyOffset = peImage.RvaToOffset(dm.mdRVA);

                byte b = peImage.OffsetReadByte(bodyOffset);
                uint codeOffset;
                if ((b & 3) == 2)
                {
                    if (b != 2)
                    {
                        continue;                               // not zero byte code size
                    }
                    dm.mhFlags          = 2;
                    dm.mhMaxStack       = 8;
                    dm.mhLocalVarSigTok = 0;
                    codeOffset          = bodyOffset + 1;
                }
                else
                {
                    if (peImage.OffsetReadUInt32(bodyOffset + 4) != 0)
                    {
                        continue;                               // not zero byte code size
                    }
                    dm.mhFlags          = peImage.OffsetReadUInt16(bodyOffset);
                    dm.mhMaxStack       = peImage.OffsetReadUInt16(bodyOffset + 2);
                    dm.mhLocalVarSigTok = peImage.OffsetReadUInt32(bodyOffset + 8);
                    codeOffset          = bodyOffset + (uint)(dm.mhFlags >> 12) * 4;
                }
                fileDataReader.Position = codeOffset;

                if (!decrypter.Decrypt(fileDataReader, dm))
                {
                    continue;
                }

                dumpedMethods.Add(dm);
            }

            return(dumpedMethods);
        }
            protected override bool DecryptCode(DumpedMethod dm)
            {
                var code = dm.code;

                for (int i = 0; i < code.Length; i++)
                {
                    for (int j = 0; j < 4 && i + j < code.Length; j++)
                    {
                        code[i + j] ^= decryptKey[j];
                    }
                }

                return(true);
            }
Exemple #6
0
 public void ReadMethodTableRowTo(DumpedMethod dm, uint rid)
 {
     dm.token = 0x06000000 + rid;
     if (!Metadata.TablesStream.TryReadMethodRow(rid, out var row))
     {
         throw new ArgumentException("Invalid Method rid");
     }
     dm.mdRVA       = row.RVA;
     dm.mdImplFlags = row.ImplFlags;
     dm.mdFlags     = row.Flags;
     dm.mdName      = row.Name;
     dm.mdSignature = row.Signature;
     dm.mdParamList = row.ParamList;
 }
Exemple #7
0
        public void ReadMethodTableRowTo(DumpedMethod dm, uint rid)
        {
            dm.token = 0x06000000 + rid;
            var row = DotNetFile.MetaData.TablesStream.ReadMethodRow(rid);

            if (row == null)
            {
                throw new ArgumentException("Invalid Method rid");
            }
            dm.mdRVA       = row.RVA;
            dm.mdImplFlags = row.ImplFlags;
            dm.mdFlags     = row.Flags;
            dm.mdName      = row.Name;
            dm.mdSignature = row.Signature;
            dm.mdParamList = row.ParamList;
        }
        public bool decrypt(MyPEImage peImage, ref DumpedMethods dumpedMethods)
        {
            dumpedMethods = new DumpedMethods();

            bool decrypted = false;

            var methodDef = peImage.DotNetFile.MetaData.TablesStream.MethodTable;

            for (uint rid = 1; rid <= methodDef.Rows; rid++)
            {
                var dm = new DumpedMethod();
                peImage.readMethodTableRowTo(dm, rid);

                if (dm.mdRVA == 0)
                {
                    continue;
                }
                uint bodyOffset = peImage.rvaToOffset(dm.mdRVA);

                peImage.Reader.Position = bodyOffset;
                var mbHeader = MethodBodyParser.parseMethodBody(peImage.Reader, out dm.code, out dm.extraSections);
                peImage.updateMethodHeaderInfo(dm, mbHeader);

                if (dm.code.Length < 6 || dm.code[0] != 0x2A || dm.code[1] != 0x2A)
                {
                    continue;
                }

                int seed = BitConverter.ToInt32(dm.code, 2);
                Array.Copy(newCodeHeader, dm.code, newCodeHeader.Length);
                if (seed == 0)
                {
                    decrypt(dm.code);
                }
                else
                {
                    decrypt(dm.code, seed);
                }

                dumpedMethods.add(dm);
                decrypted = true;
            }

            return(decrypted);
        }
        DumpedMethods Decrypt_v17_r73404(MyPEImage peImage, byte[] fileData)
        {
            var dumpedMethods = new DumpedMethods();

            var methodDef = peImage.Metadata.TablesStream.MethodTable;

            for (uint rid = 1; rid <= methodDef.Rows; rid++)
            {
                var dm = new DumpedMethod();
                peImage.ReadMethodTableRowTo(dm, rid);

                if (dm.mdRVA == 0)
                {
                    continue;
                }
                uint bodyOffset = peImage.RvaToOffset(dm.mdRVA);

                if (!IsEncryptedMethod(fileData, (int)bodyOffset))
                {
                    continue;
                }

                int key      = BitConverter.ToInt32(fileData, (int)bodyOffset + 6);
                int mdOffs   = BitConverter.ToInt32(fileData, (int)bodyOffset + 2) ^ key;
                int len      = BitConverter.ToInt32(fileData, (int)bodyOffset + 11) ^ ~key;
                var codeData = DecryptMethodData_v17_r73404(methodsData, mdOffs + 2, (uint)key, len);

                var reader   = ByteArrayDataReaderFactory.CreateReader(codeData);
                var mbHeader = MethodBodyParser.ParseMethodBody(ref reader, out dm.code, out dm.extraSections);
                if (reader.Position != reader.Length)
                {
                    throw new ApplicationException("Invalid method data");
                }

                peImage.UpdateMethodHeaderInfo(dm, mbHeader);

                dumpedMethods.Add(dm);
            }

            return(dumpedMethods);
        }
            public virtual bool Decrypt(IBinaryReader fileDataReader, DumpedMethod dm)
            {
                if (fileDataReader.ReadByte() != 0x2A)
                {
                    return(false);                      // Not a RET
                }
                methodsDataReader.Position = fileDataReader.ReadCompressedUInt32();

                dm.mhCodeSize = methodsDataReader.ReadCompressedUInt32();
                dm.code       = methodsDataReader.ReadBytes((int)dm.mhCodeSize);
                if ((dm.mhFlags & 8) != 0)
                {
                    dm.extraSections = MethodBodyParser.ReadExtraSections(methodsDataReader);
                }

                if (!DecryptCode(dm))
                {
                    return(false);
                }

                return(true);
            }
Exemple #11
0
        void decryptMethodsOld(MetadataType methodDefTable, ref DumpedMethods dumpedMethods)
        {
            dumpedMethods = new DumpedMethods();
            uint offset    = methodDefTable.fileOffset;
            var  decrypter = new Decrypter10(peImage, codeHeader.decryptionKey);

            for (int i = 0; i < methodDefTable.rows; i++, offset += methodDefTable.totalSize)
            {
                var dm = new DumpedMethod();
                dm.token = 0x06000001 + (uint)i;

                var method = (Mono.Cecil.MethodDefinition)module.LookupToken((int)dm.token);
                if (method == null || method.DeclaringType == DotNetUtils.getModuleType(module))
                {
                    continue;
                }

                uint rva = peImage.offsetReadUInt32(offset + (uint)methodDefTable.fields[0].offset);
                if (rva == 0)
                {
                    continue;
                }
                uint bodyOffset = peImage.rvaToOffset(rva);
                dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[1].offset);
                dm.mdFlags     = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[2].offset);
                dm.mdName      = peImage.offsetRead(offset + (uint)methodDefTable.fields[3].offset, methodDefTable.fields[3].size);
                dm.mdSignature = peImage.offsetRead(offset + (uint)methodDefTable.fields[4].offset, methodDefTable.fields[4].size);
                dm.mdParamList = peImage.offsetRead(offset + (uint)methodDefTable.fields[5].offset, methodDefTable.fields[5].size);

                var mbHeader = decrypter.decrypt(bodyOffset, out dm.code, out dm.extraSections);
                dm.mhFlags          = mbHeader.flags;
                dm.mhMaxStack       = mbHeader.maxStack;
                dm.mhCodeSize       = (uint)dm.code.Length;
                dm.mhLocalVarSigTok = mbHeader.localVarSigTok;

                dumpedMethods.add(dm);
            }
        }
Exemple #12
0
        DumpedMethods DecryptMethods()
        {
            var dumpedMethods = new DumpedMethods();

            var peImage     = decrypterInfo.peImage;
            var methodInfos = new MethodInfos(module, decrypterInfo.mainType, peImage, decrypterInfo.peHeader, decrypterInfo.mcKey);

            methodInfos.InitializeInfos();

            var methodDef = peImage.Metadata.TablesStream.MethodTable;

            for (uint rid = 1; rid <= methodDef.Rows; rid++)
            {
                var dm = new DumpedMethod();
                peImage.ReadMethodTableRowTo(dm, rid);

                var info = methodInfos.Lookup(dm.mdRVA);
                if (info == null)
                {
                    continue;
                }

                ushort magic = peImage.ReadUInt16(dm.mdRVA);
                if (magic != 0xFFF3)
                {
                    continue;
                }

                var bodyReader = ByteArrayDataReaderFactory.CreateReader(info.body);
                var mbHeader   = MethodBodyParser.ParseMethodBody(ref bodyReader, out dm.code, out dm.extraSections);
                peImage.UpdateMethodHeaderInfo(dm, mbHeader);

                dumpedMethods.Add(dm);
            }

            return(dumpedMethods);
        }
Exemple #13
0
        DumpedMethods decryptMethods()
        {
            var dumpedMethods = new DumpedMethods();

            var peImage     = decrypterInfo.peImage;
            var methodInfos = new MethodInfos(decrypterInfo.mainType, peImage, decrypterInfo.peHeader, decrypterInfo.mcKey);

            methodInfos.initializeInfos();

            var methodDef = peImage.DotNetFile.MetaData.TablesStream.MethodTable;

            for (uint rid = 1; rid <= methodDef.Rows; rid++)
            {
                var dm = new DumpedMethod();
                peImage.readMethodTableRowTo(dm, rid);

                var info = methodInfos.lookup(dm.mdRVA);
                if (info == null)
                {
                    continue;
                }

                ushort magic = peImage.readUInt16(dm.mdRVA);
                if (magic != 0xFFF3)
                {
                    continue;
                }

                var mbHeader = MethodBodyParser.parseMethodBody(MemoryImageStream.Create(info.body), out dm.code, out dm.extraSections);
                peImage.updateMethodHeaderInfo(dm, mbHeader);

                dumpedMethods.add(dm);
            }

            return(dumpedMethods);
        }
Exemple #14
0
            public virtual bool decrypt(BinaryReader fileDataReader, DumpedMethod dm)
            {
                if (fileDataReader.ReadByte() != 0x2A)
                {
                    return(false);                      // Not a RET
                }
                int methodsDataOffset = DeobUtils.readVariableLengthInt32(fileDataReader);

                methodsDataReader.BaseStream.Position = methodsDataOffset;

                dm.mhCodeSize = (uint)DeobUtils.readVariableLengthInt32(methodsDataReader);
                dm.code       = methodsDataReader.ReadBytes((int)dm.mhCodeSize);
                if ((dm.mhFlags & 8) != 0)
                {
                    dm.extraSections = readExtraSections(methodsDataReader);
                }

                if (!decryptCode(dm))
                {
                    return(false);
                }

                return(true);
            }
Exemple #15
0
        void decryptMethods(uint codeHeaderOffset, MetadataType methodDefTable, ICsHeader csHeader, ref DumpedMethods dumpedMethods)
        {
            var methodInfos = csHeader.getMethodInfos(codeHeaderOffset);

            csHeader.patchMethodDefTable(methodDefTable, methodInfos);

            dumpedMethods = new DumpedMethods();
            uint offset = methodDefTable.fileOffset;

            decrypter = csHeader.createDecrypter();
            for (int i = 0; i < methodInfos.Count; i++, offset += methodDefTable.totalSize)
            {
                var methodInfo = methodInfos[i];
                if (methodInfo.codeOffs == 0)
                {
                    continue;
                }

                var dm = new DumpedMethod();
                dm.token = 0x06000001 + (uint)i;

                dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[1].offset);
                dm.mdFlags     = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[2].offset);
                dm.mdName      = peImage.offsetRead(offset + (uint)methodDefTable.fields[3].offset, methodDefTable.fields[3].size);
                dm.mdSignature = peImage.offsetRead(offset + (uint)methodDefTable.fields[4].offset, methodDefTable.fields[4].size);
                dm.mdParamList = peImage.offsetRead(offset + (uint)methodDefTable.fields[5].offset, methodDefTable.fields[5].size);

                var mbHeader = decrypter.decrypt(methodInfo, out dm.code, out dm.extraSections);
                dm.mhFlags          = mbHeader.flags;
                dm.mhMaxStack       = mbHeader.maxStack;
                dm.mhCodeSize       = (uint)dm.code.Length;
                dm.mhLocalVarSigTok = mbHeader.localVarSigTok;

                dumpedMethods.add(dm);
            }
        }
Exemple #16
0
        void decryptMethodsOld(MetadataType methodDefTable, ref DumpedMethods dumpedMethods)
        {
            dumpedMethods = new DumpedMethods();
            uint offset = methodDefTable.fileOffset;
            var decrypter = new Decrypter10(peImage, codeHeader.decryptionKey);
            for (int i = 0; i < methodDefTable.rows; i++, offset += methodDefTable.totalSize) {
                var dm = new DumpedMethod();
                dm.token = 0x06000001 + (uint)i;

                var method = (Mono.Cecil.MethodDefinition)module.LookupToken((int)dm.token);
                if (method == null || method.DeclaringType == DotNetUtils.getModuleType(module))
                    continue;

                uint rva = peImage.offsetReadUInt32(offset + (uint)methodDefTable.fields[0].offset);
                if (rva == 0)
                    continue;
                uint bodyOffset = peImage.rvaToOffset(rva);
                dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[1].offset);
                dm.mdFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[2].offset);
                dm.mdName = peImage.offsetRead(offset + (uint)methodDefTable.fields[3].offset, methodDefTable.fields[3].size);
                dm.mdSignature = peImage.offsetRead(offset + (uint)methodDefTable.fields[4].offset, methodDefTable.fields[4].size);
                dm.mdParamList = peImage.offsetRead(offset + (uint)methodDefTable.fields[5].offset, methodDefTable.fields[5].size);

                var mbHeader = decrypter.decrypt(bodyOffset, out dm.code, out dm.extraSections);
                dm.mhFlags = mbHeader.flags;
                dm.mhMaxStack = mbHeader.maxStack;
                dm.mhCodeSize = (uint)dm.code.Length;
                dm.mhLocalVarSigTok = mbHeader.localVarSigTok;

                dumpedMethods.add(dm);
            }
        }
 protected virtual bool DecryptCode(DumpedMethod dm)
 {
     return(true);
 }
Exemple #18
0
        public bool decrypt(PeImage peImage, ref DumpedMethods dumpedMethods)
        {
            dumpedMethods = new DumpedMethods();

            bool decrypted = false;

            var  metadataTables  = peImage.Cor20Header.createMetadataTables();
            var  methodDef       = metadataTables.getMetadataType(MetadataIndex.iMethodDef);
            uint methodDefOffset = methodDef.fileOffset;

            for (int i = 0; i < methodDef.rows; i++, methodDefOffset += methodDef.totalSize)
            {
                uint bodyRva = peImage.offsetReadUInt32(methodDefOffset);
                if (bodyRva == 0)
                {
                    continue;
                }
                uint bodyOffset = peImage.rvaToOffset(bodyRva);

                var dm = new DumpedMethod();
                dm.token = (uint)(0x06000001 + i);

                byte[] code, extraSections;
                peImage.Reader.BaseStream.Position = bodyOffset;
                var mbHeader = MethodBodyParser.parseMethodBody(peImage.Reader, out code, out extraSections);

                if (code.Length < 6 || code[0] != 0x2A || code[1] != 0x2A)
                {
                    continue;
                }
                dm.code          = code;
                dm.extraSections = extraSections;

                int seed = BitConverter.ToInt32(code, 2);
                Array.Copy(newCodeHeader, code, newCodeHeader.Length);
                if (seed == 0)
                {
                    decrypt(code);
                }
                else
                {
                    decrypt(code, seed);
                }

                dm.mdImplFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[1].offset);
                dm.mdFlags     = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[2].offset);
                dm.mdName      = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size);
                dm.mdSignature = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[4].offset, methodDef.fields[4].size);
                dm.mdParamList = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[5].offset, methodDef.fields[5].size);

                dm.mhFlags          = mbHeader.flags;
                dm.mhMaxStack       = mbHeader.maxStack;
                dm.mhCodeSize       = (uint)dm.code.Length;
                dm.mhLocalVarSigTok = mbHeader.localVarSigTok;

                dumpedMethods.add(dm);
                decrypted = true;
            }

            return(decrypted);
        }
Exemple #19
0
            protected override bool decryptCode(DumpedMethod dm)
            {
                var code = dm.code;
                for (int i = 0; i < code.Length; i++) {
                    for (int j = 0; j < 4 && i + j < code.Length; j++)
                        code[i + j] ^= decryptKey[j];
                }

                return true;
            }
Exemple #20
0
        DumpedMethods Decrypt(MyPEImage peImage, byte[] fileData, DecryptMethodData decrypter)
        {
            var dumpedMethods = new DumpedMethods();

            var methodDef = peImage.MetaData.TablesStream.MethodTable;

            for (uint rid = 1; rid <= methodDef.Rows; rid++)
            {
                var dm = new DumpedMethod();
                peImage.ReadMethodTableRowTo(dm, rid);

                if (dm.mdRVA == 0)
                {
                    continue;
                }
                uint bodyOffset = peImage.RvaToOffset(dm.mdRVA);

                if (!IsEncryptedMethod(fileData, (int)bodyOffset))
                {
                    continue;
                }

                int    key              = BitConverter.ToInt32(fileData, (int)bodyOffset + 6);
                int    mdOffs           = BitConverter.ToInt32(fileData, (int)bodyOffset + 2) ^ key;
                int    len              = BitConverter.ToInt32(fileData, (int)bodyOffset + 11) ^ ~key;
                int    methodDataOffset = mdOffs + 2;
                uint[] methodData;
                byte[] codeData;
                decrypter.Decrypt(methodsData, methodDataOffset, (uint)key, len, out methodData, out codeData);

                dm.mhFlags = 0x03;
                int maxStack = (int)methodData[methodDataIndexes.maxStack];
                dm.mhMaxStack       = (ushort)maxStack;
                dm.mhLocalVarSigTok = methodData[methodDataIndexes.localVarSigTok];
                if (dm.mhLocalVarSigTok != 0 && dm.mhLocalVarSigTok >> 24 != 0x11)
                {
                    throw new ApplicationException("Invalid local var sig token");
                }
                int  numExceptions = (int)methodData[methodDataIndexes.ehs];
                uint options       = methodData[methodDataIndexes.options];
                int  codeSize      = (int)methodData[methodDataIndexes.codeSize];

                var codeDataReader = MemoryImageStream.Create(codeData);
                if (decrypter.IsCodeFollowedByExtraSections(options))
                {
                    dm.code          = codeDataReader.ReadBytes(codeSize);
                    dm.extraSections = ReadExceptionHandlers(codeDataReader, numExceptions);
                }
                else
                {
                    dm.extraSections = ReadExceptionHandlers(codeDataReader, numExceptions);
                    dm.code          = codeDataReader.ReadBytes(codeSize);
                }
                if (codeDataReader.Position != codeDataReader.Length)
                {
                    throw new ApplicationException("Invalid method data");
                }
                if (dm.extraSections != null)
                {
                    dm.mhFlags |= 8;
                }
                dm.mhCodeSize = (uint)dm.code.Length;

                // Figure out if the original method was tiny or not.
                bool isTiny = dm.code.Length <= 0x3F &&
                              dm.mhLocalVarSigTok == 0 &&
                              dm.extraSections == null &&
                              dm.mhMaxStack == 8;
                if (isTiny)
                {
                    dm.mhFlags |= 0x10;                         // Set 'init locals'
                }
                dm.mhFlags |= (ushort)(options & 0x10);         // copy 'init locals' bit

                dumpedMethods.Add(dm);
            }

            return(dumpedMethods);
        }
Exemple #21
0
            public virtual bool decrypt(BinaryReader fileDataReader, DumpedMethod dm)
            {
                if (fileDataReader.ReadByte() != 0x2A)
                    return false;	// Not a RET
                int methodsDataOffset = DeobUtils.readVariableLengthInt32(fileDataReader);
                methodsDataReader.BaseStream.Position = methodsDataOffset;

                dm.mhCodeSize = (uint)DeobUtils.readVariableLengthInt32(methodsDataReader);
                dm.code = methodsDataReader.ReadBytes((int)dm.mhCodeSize);
                if ((dm.mhFlags & 8) != 0)
                    dm.extraSections = readExtraSections(methodsDataReader);

                if (!decryptCode(dm))
                    return false;

                return true;
            }
Exemple #22
0
        DumpedMethods createDumpedMethods(PeImage peImage, byte[] fileData, byte[] methodsData)
        {
            var dumpedMethods = new DumpedMethods();

            var methodsDataReader = new BinaryReader(new MemoryStream(methodsData));
            var fileDataReader = new BinaryReader(new MemoryStream(fileData));

            var metadataTables = peImage.Cor20Header.createMetadataTables();
            var methodDef = metadataTables.getMetadataType(MetadataIndex.iMethodDef);
            uint methodDefOffset = methodDef.fileOffset;
            for (int i = 0; i < methodDef.rows; i++, methodDefOffset += methodDef.totalSize) {
                uint bodyRva = peImage.offsetReadUInt32(methodDefOffset);
                if (bodyRva == 0)
                    continue;
                uint bodyOffset = peImage.rvaToOffset(bodyRva);

                var dm = new DumpedMethod();
                dm.token = (uint)(0x06000001 + i);
                dm.mdImplFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[1].offset);
                dm.mdFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[2].offset);
                dm.mdName = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size);
                dm.mdSignature = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[4].offset, methodDef.fields[4].size);
                dm.mdParamList = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[5].offset, methodDef.fields[5].size);

                byte b = peImage.offsetReadByte(bodyOffset);
                uint codeOffset;
                if ((b & 3) == 2) {
                    if (b != 2)
                        continue;	// not zero byte code size

                    dm.mhFlags = 2;
                    dm.mhMaxStack = 8;
                    dm.mhLocalVarSigTok = 0;
                    codeOffset = bodyOffset + 1;
                }
                else {
                    if (peImage.offsetReadUInt32(bodyOffset + 4) != 0)
                        continue;	// not zero byte code size

                    dm.mhFlags = peImage.offsetReadUInt16(bodyOffset);
                    dm.mhMaxStack = peImage.offsetReadUInt16(bodyOffset + 2);
                    dm.mhLocalVarSigTok = peImage.offsetReadUInt32(bodyOffset + 8);
                    codeOffset = bodyOffset + (uint)(dm.mhFlags >> 12) * 4;
                }
                fileDataReader.BaseStream.Position = codeOffset;

                if (!decrypter.decrypt(fileDataReader, dm))
                    continue;

                dumpedMethods.add(dm);
            }

            return dumpedMethods;
        }
Exemple #23
0
        DumpedMethods createDumpedMethods(PeImage peImage, byte[] fileData, byte[] methodsData)
        {
            var dumpedMethods = new DumpedMethods();

            var methodsDataReader = new BinaryReader(new MemoryStream(methodsData));
            var fileDataReader    = new BinaryReader(new MemoryStream(fileData));

            var  metadataTables  = peImage.Cor20Header.createMetadataTables();
            var  methodDef       = metadataTables.getMetadataType(MetadataIndex.iMethodDef);
            uint methodDefOffset = methodDef.fileOffset;

            for (int i = 0; i < methodDef.rows; i++, methodDefOffset += methodDef.totalSize)
            {
                uint bodyRva = peImage.offsetReadUInt32(methodDefOffset);
                if (bodyRva == 0)
                {
                    continue;
                }
                uint bodyOffset = peImage.rvaToOffset(bodyRva);

                var dm = new DumpedMethod();
                dm.token       = (uint)(0x06000001 + i);
                dm.mdImplFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[1].offset);
                dm.mdFlags     = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[2].offset);
                dm.mdName      = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size);
                dm.mdSignature = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[4].offset, methodDef.fields[4].size);
                dm.mdParamList = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[5].offset, methodDef.fields[5].size);

                byte b = peImage.offsetReadByte(bodyOffset);
                uint codeOffset;
                if ((b & 3) == 2)
                {
                    if (b != 2)
                    {
                        continue;                               // not zero byte code size
                    }
                    dm.mhFlags          = 2;
                    dm.mhMaxStack       = 8;
                    dm.mhLocalVarSigTok = 0;
                    codeOffset          = bodyOffset + 1;
                }
                else
                {
                    if (peImage.offsetReadUInt32(bodyOffset + 4) != 0)
                    {
                        continue;                               // not zero byte code size
                    }
                    dm.mhFlags          = peImage.offsetReadUInt16(bodyOffset);
                    dm.mhMaxStack       = peImage.offsetReadUInt16(bodyOffset + 2);
                    dm.mhLocalVarSigTok = peImage.offsetReadUInt32(bodyOffset + 8);
                    codeOffset          = bodyOffset + (uint)(dm.mhFlags >> 12) * 4;
                }
                fileDataReader.BaseStream.Position = codeOffset;

                if (!decrypter.decrypt(fileDataReader, dm))
                {
                    continue;
                }

                dumpedMethods.add(dm);
            }

            return(dumpedMethods);
        }
Exemple #24
0
        void decryptMethods(uint codeHeaderOffset, MetadataType methodDefTable, ICsHeader csHeader, ref DumpedMethods dumpedMethods)
        {
            var methodInfos = csHeader.getMethodInfos(codeHeaderOffset);
            csHeader.patchMethodDefTable(methodDefTable, methodInfos);

            dumpedMethods = new DumpedMethods();
            uint offset = methodDefTable.fileOffset;
            decrypter = csHeader.createDecrypter();
            for (int i = 0; i < methodInfos.Count; i++, offset += methodDefTable.totalSize) {
                var methodInfo = methodInfos[i];
                if (methodInfo.codeOffs == 0)
                    continue;

                var dm = new DumpedMethod();
                dm.token = 0x06000001 + (uint)i;

                dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[1].offset);
                dm.mdFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[2].offset);
                dm.mdName = peImage.offsetRead(offset + (uint)methodDefTable.fields[3].offset, methodDefTable.fields[3].size);
                dm.mdSignature = peImage.offsetRead(offset + (uint)methodDefTable.fields[4].offset, methodDefTable.fields[4].size);
                dm.mdParamList = peImage.offsetRead(offset + (uint)methodDefTable.fields[5].offset, methodDefTable.fields[5].size);

                var mbHeader = decrypter.decrypt(methodInfo, out dm.code, out dm.extraSections);
                dm.mhFlags = mbHeader.flags;
                dm.mhMaxStack = mbHeader.maxStack;
                dm.mhCodeSize = (uint)dm.code.Length;
                dm.mhLocalVarSigTok = mbHeader.localVarSigTok;

                dumpedMethods.add(dm);
            }
        }
Exemple #25
0
        public bool decrypt(PeImage peImage, ref DumpedMethods dumpedMethods)
        {
            dumpedMethods = new DumpedMethods();

            bool decrypted = false;

            var metadataTables = peImage.Cor20Header.createMetadataTables();
            var methodDef = metadataTables.getMetadataType(MetadataIndex.iMethodDef);
            uint methodDefOffset = methodDef.fileOffset;
            for (int i = 0; i < methodDef.rows; i++, methodDefOffset += methodDef.totalSize) {
                uint bodyRva = peImage.offsetReadUInt32(methodDefOffset);
                if (bodyRva == 0)
                    continue;
                uint bodyOffset = peImage.rvaToOffset(bodyRva);

                var dm = new DumpedMethod();
                dm.token = (uint)(0x06000001 + i);

                byte[] code, extraSections;
                peImage.Reader.BaseStream.Position = bodyOffset;
                var mbHeader = MethodBodyParser.parseMethodBody(peImage.Reader, out code, out extraSections);

                if (code.Length < 6 || code[0] != 0x2A || code[1] != 0x2A)
                    continue;
                dm.code = code;
                dm.extraSections = extraSections;

                int seed = BitConverter.ToInt32(code, 2);
                Array.Copy(newCodeHeader, code, newCodeHeader.Length);
                if (seed == 0)
                    decrypt(code);
                else
                    decrypt(code, seed);

                dm.mdImplFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[1].offset);
                dm.mdFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[2].offset);
                dm.mdName = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size);
                dm.mdSignature = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[4].offset, methodDef.fields[4].size);
                dm.mdParamList = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[5].offset, methodDef.fields[5].size);

                dm.mhFlags = mbHeader.flags;
                dm.mhMaxStack = mbHeader.maxStack;
                dm.mhCodeSize = (uint)dm.code.Length;
                dm.mhLocalVarSigTok = mbHeader.localVarSigTok;

                dumpedMethods.add(dm);
                decrypted = true;
            }

            return decrypted;
        }
Exemple #26
0
 protected virtual bool DecryptCode(DumpedMethod dm) => true;
Exemple #27
0
        public bool decrypt(PeImage peImage, ISimpleDeobfuscator simpleDeobfuscator, ref Dictionary<uint, DumpedMethod> dumpedMethods, Dictionary<uint,byte[]> tokenToNativeCode)
        {
            if (encryptedResource.Method == null)
                return false;

            encryptedResource.init(simpleDeobfuscator);
            if (!encryptedResource.FoundResource)
                return false;
            var methodsData = encryptedResource.decrypt();

            bool hooksJitter = findDnrCompileMethod(encryptedResource.Method.DeclaringType) != null;

            xorKey = getXorKey();
            xorEncrypt(methodsData);

            var methodsDataReader = new BinaryReader(new MemoryStream(methodsData));
            int patchCount = methodsDataReader.ReadInt32();
            int mode = methodsDataReader.ReadInt32();

            int tmp = methodsDataReader.ReadInt32();
            methodsDataReader.BaseStream.Position -= 4;
            if ((tmp & 0xFF000000) == 0x06000000) {
                // It's method token + rva. DNR 3.7.0.3 (and earlier?) - 3.9.0.1
                methodsDataReader.BaseStream.Position += 8L * patchCount;
                patchCount = methodsDataReader.ReadInt32();
                mode = methodsDataReader.ReadInt32();

                patchDwords(peImage, methodsDataReader, patchCount);
                while (methodsDataReader.BaseStream.Position < methodsData.Length - 1) {
                    uint token = methodsDataReader.ReadUInt32();
                    int numDwords = methodsDataReader.ReadInt32();
                    patchDwords(peImage, methodsDataReader, numDwords / 2);
                }
            }
            else if (!hooksJitter || mode == 1) {
                // DNR 3.9.8.0, 4.0, 4.1, 4.2, 4.3, 4.4
                patchDwords(peImage, methodsDataReader, patchCount);
                while (methodsDataReader.BaseStream.Position < methodsData.Length - 1) {
                    uint rva = methodsDataReader.ReadUInt32();
                    uint token = methodsDataReader.ReadUInt32();	// token, unknown, or index
                    int size = methodsDataReader.ReadInt32();
                    if (size > 0)
                        peImage.dotNetSafeWrite(rva, methodsDataReader.ReadBytes(size));
                }
            }
            else {
                // DNR 4.0 - 4.4 (jitter is hooked)

                var metadataTables = peImage.Cor20Header.createMetadataTables();
                var methodDef = metadataTables.getMetadataType(PE.MetadataIndex.iMethodDef);
                var rvaToIndex = new Dictionary<uint, int>((int)methodDef.rows);
                uint offset = methodDef.fileOffset;
                for (int i = 0; i < methodDef.rows; i++) {
                    uint rva = peImage.offsetReadUInt32(offset);
                    offset += methodDef.totalSize;
                    if (rva == 0)
                        continue;

                    if ((peImage.readByte(rva) & 3) == 2)
                        rva++;
                    else
                        rva += (uint)(4 * (peImage.readByte(rva + 1) >> 4));
                    rvaToIndex[rva] = i;
                }

                patchDwords(peImage, methodsDataReader, patchCount);
                int count = methodsDataReader.ReadInt32();
                dumpedMethods = new Dictionary<uint, DumpedMethod>();
                while (methodsDataReader.BaseStream.Position < methodsData.Length - 1) {
                    uint rva = methodsDataReader.ReadUInt32();
                    uint index = methodsDataReader.ReadUInt32();
                    bool isNativeCode = index >= 0x70000000;
                    int size = methodsDataReader.ReadInt32();
                    var methodData = methodsDataReader.ReadBytes(size);

                    int methodIndex;
                    if (!rvaToIndex.TryGetValue(rva, out methodIndex)) {
                        Log.w("Could not find method having code RVA {0:X8}", rva);
                        continue;
                    }
                    uint methodToken = 0x06000001 + (uint)methodIndex;

                    if (isNativeCode) {
                        totalEncryptedNativeMethods++;
                        if (tokenToNativeCode != null)
                            tokenToNativeCode[methodToken] = methodData;

                        // Convert return true / false methods. The others are converted to
                        // throw 0xDEADCODE.
                        if (DeobUtils.isCode(nativeLdci4, methodData)) {
                            uint val = BitConverter.ToUInt32(methodData, 4);
                            // ldc.i4 XXXXXXXXh / ret
                            methodData = new byte[] { 0x20, 0, 0, 0, 0, 0x2A };
                            methodData[1] = (byte)val;
                            methodData[2] = (byte)(val >> 8);
                            methodData[3] = (byte)(val >> 16);
                            methodData[4] = (byte)(val >> 24);
                        }
                        else if (DeobUtils.isCode(nativeLdci4_0, methodData)) {
                            // ldc.i4.0 / ret
                            methodData = new byte[] { 0x16, 0x2A };
                        }
                        else {
                            tokenToNativeMethod[methodToken] = methodData;

                            // ldc.i4 0xDEADCODE / conv.u4 / throw
                            methodData = new byte[] { 0x20, 0xDE, 0xC0, 0xAD, 0xDE, 0x6D, 0x7A };
                        }
                    }

                    var dm = new DumpedMethod();
                    dm.token = methodToken;
                    dm.code = methodData;

                    offset = methodDef.fileOffset + (uint)(methodIndex * methodDef.totalSize);
                    rva = peImage.offsetReadUInt32(offset);
                    dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDef.fields[1].offset);
                    dm.mdFlags = peImage.offsetReadUInt16(offset + (uint)methodDef.fields[2].offset);
                    dm.mdName = peImage.offsetRead(offset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size);
                    dm.mdSignature = peImage.offsetRead(offset + (uint)methodDef.fields[4].offset, methodDef.fields[4].size);
                    dm.mdParamList = peImage.offsetRead(offset + (uint)methodDef.fields[5].offset, methodDef.fields[5].size);

                    if ((peImage.readByte(rva) & 3) == 2) {
                        dm.mhFlags = 2;
                        dm.mhMaxStack = 8;
                        dm.mhCodeSize = (uint)dm.code.Length;
                        dm.mhLocalVarSigTok = 0;
                    }
                    else {
                        dm.mhFlags = peImage.readUInt16(rva);
                        dm.mhMaxStack = peImage.readUInt16(rva + 2);
                        dm.mhCodeSize = (uint)dm.code.Length;
                        dm.mhLocalVarSigTok = peImage.readUInt32(rva + 8);
                    }

                    dumpedMethods[dm.token] = dm;
                }
            }

            return true;
        }
Exemple #28
0
 protected virtual bool decryptCode(DumpedMethod dm)
 {
     return true;
 }
        public bool Decrypt(MyPEImage peImage, ISimpleDeobfuscator simpleDeobfuscator, ref DumpedMethods dumpedMethods, Dictionary <uint, byte[]> tokenToNativeCode, bool unpackedNativeFile)
        {
            if (encryptedResource.Method == null)
            {
                return(false);
            }

            encryptedResource.Initialize(simpleDeobfuscator);
            if (!encryptedResource.FoundResource)
            {
                return(false);
            }
            var methodsData = encryptedResource.Decrypt();

            bool hooksJitter = FindDnrCompileMethod(encryptedResource.Method.DeclaringType) != null;

            xorKey = GetXorKey();
            XorEncrypt(methodsData);

            var methodsDataReader = MemoryImageStream.Create(methodsData);
            int patchCount        = methodsDataReader.ReadInt32();
            int mode = methodsDataReader.ReadInt32();

            int tmp = methodsDataReader.ReadInt32();

            methodsDataReader.Position -= 4;
            if ((tmp & 0xFF000000) == 0x06000000)
            {
                // It's method token + rva. DNR 3.7.0.3 (and earlier?) - 3.9.0.1
                methodsDataReader.Position += 8L * patchCount;
                patchCount = methodsDataReader.ReadInt32();
                mode       = methodsDataReader.ReadInt32();

                PatchDwords(peImage, methodsDataReader, patchCount);
                while (methodsDataReader.Position < methodsData.Length - 1)
                {
                    uint token     = methodsDataReader.ReadUInt32();
                    int  numDwords = methodsDataReader.ReadInt32();
                    PatchDwords(peImage, methodsDataReader, numDwords / 2);
                }
            }
            else if (!hooksJitter || mode == 1)
            {
                // DNR 3.9.8.0, 4.0+

                PatchDwords(peImage, methodsDataReader, patchCount);
                bool oldCode = !IsNewer45Decryption(encryptedResource.Method);
                while (methodsDataReader.Position < methodsData.Length - 1)
                {
                    uint rva = methodsDataReader.ReadUInt32();
                    int  size;
                    if (oldCode)
                    {
                        methodsDataReader.ReadUInt32();                         // token, unknown, or index
                        size = methodsDataReader.ReadInt32();
                    }
                    else
                    {
                        size = methodsDataReader.ReadInt32() * 4;
                    }

                    var newData = methodsDataReader.ReadBytes(size);
                    if (unpackedNativeFile)
                    {
                        peImage.DotNetSafeWriteOffset(rva, newData);
                    }
                    else
                    {
                        peImage.DotNetSafeWrite(rva, newData);
                    }
                }
            }
            else
            {
                // DNR 4.0+ (jitter is hooked)

                var  methodDef  = peImage.MetaData.TablesStream.MethodTable;
                var  rvaToIndex = new Dictionary <uint, int>((int)methodDef.Rows);
                uint offset     = (uint)methodDef.StartOffset;
                for (int i = 0; i < methodDef.Rows; i++)
                {
                    uint rva = peImage.OffsetReadUInt32(offset);
                    offset += methodDef.RowSize;
                    if (rva == 0)
                    {
                        continue;
                    }

                    if ((peImage.ReadByte(rva) & 3) == 2)
                    {
                        rva++;
                    }
                    else
                    {
                        rva += (uint)(4 * (peImage.ReadByte(rva + 1) >> 4));
                    }
                    rvaToIndex[rva] = i;
                }

                PatchDwords(peImage, methodsDataReader, patchCount);
                int count = methodsDataReader.ReadInt32();
                dumpedMethods = new DumpedMethods();
                while (methodsDataReader.Position < methodsData.Length - 1)
                {
                    uint rva          = methodsDataReader.ReadUInt32();
                    uint index        = methodsDataReader.ReadUInt32();
                    bool isNativeCode = index >= 0x70000000;
                    int  size         = methodsDataReader.ReadInt32();
                    var  methodData   = methodsDataReader.ReadBytes(size);

                    int methodIndex;
                    if (!rvaToIndex.TryGetValue(rva, out methodIndex))
                    {
                        Logger.w("Could not find method having code RVA {0:X8}", rva);
                        continue;
                    }

                    uint methodToken = 0x06000001 + (uint)methodIndex;

                    if (isNativeCode)
                    {
                        totalEncryptedNativeMethods++;
                        if (tokenToNativeCode != null)
                        {
                            tokenToNativeCode[methodToken] = methodData;
                        }

                        // Convert return true / false methods. The others are converted to
                        // throw 0xDEADCODE.
                        if (DeobUtils.IsCode(nativeLdci4, methodData))
                        {
                            uint val = BitConverter.ToUInt32(methodData, 4);
                            // ldc.i4 XXXXXXXXh / ret
                            methodData    = new byte[] { 0x20, 0, 0, 0, 0, 0x2A };
                            methodData[1] = (byte)val;
                            methodData[2] = (byte)(val >> 8);
                            methodData[3] = (byte)(val >> 16);
                            methodData[4] = (byte)(val >> 24);
                        }
                        else if (DeobUtils.IsCode(nativeLdci4_0, methodData))
                        {
                            // ldc.i4.0 / ret
                            methodData = new byte[] { 0x16, 0x2A };
                        }
                        else
                        {
                            tokenToNativeMethod[methodToken] = methodData;

                            // ldc.i4 0xDEADCODE / conv.u4 / throw
                            methodData = new byte[] { 0x20, 0xDE, 0xC0, 0xAD, 0xDE, 0x6D, 0x7A };
                        }
                    }

                    var dm = new DumpedMethod();
                    peImage.ReadMethodTableRowTo(dm, MDToken.ToRID(methodToken));
                    dm.code = methodData;

                    var codeReader = peImage.Reader;
                    codeReader.Position = peImage.RvaToOffset(dm.mdRVA);
                    byte[] code;
                    var    mbHeader = MethodBodyParser.ParseMethodBody(codeReader, out code, out dm.extraSections);
                    peImage.UpdateMethodHeaderInfo(dm, mbHeader);

                    dumpedMethods.Add(dm);
                }
            }

            return(true);
        }
Exemple #30
0
        public bool decrypt(PeImage peImage, ISimpleDeobfuscator simpleDeobfuscator, ref DumpedMethods dumpedMethods, Dictionary <uint, byte[]> tokenToNativeCode)
        {
            if (encryptedResource.Method == null)
            {
                return(false);
            }

            encryptedResource.init(simpleDeobfuscator);
            if (!encryptedResource.FoundResource)
            {
                return(false);
            }
            var methodsData = encryptedResource.decrypt();

            bool hooksJitter = findDnrCompileMethod(encryptedResource.Method.DeclaringType) != null;

            xorKey = getXorKey();
            xorEncrypt(methodsData);

            var methodsDataReader = new BinaryReader(new MemoryStream(methodsData));
            int patchCount        = methodsDataReader.ReadInt32();
            int mode = methodsDataReader.ReadInt32();

            int tmp = methodsDataReader.ReadInt32();

            methodsDataReader.BaseStream.Position -= 4;
            if ((tmp & 0xFF000000) == 0x06000000)
            {
                // It's method token + rva. DNR 3.7.0.3 (and earlier?) - 3.9.0.1
                methodsDataReader.BaseStream.Position += 8L * patchCount;
                patchCount = methodsDataReader.ReadInt32();
                mode       = methodsDataReader.ReadInt32();

                patchDwords(peImage, methodsDataReader, patchCount);
                while (methodsDataReader.BaseStream.Position < methodsData.Length - 1)
                {
                    uint token     = methodsDataReader.ReadUInt32();
                    int  numDwords = methodsDataReader.ReadInt32();
                    patchDwords(peImage, methodsDataReader, numDwords / 2);
                }
            }
            else if (!hooksJitter || mode == 1)
            {
                // DNR 3.9.8.0, 4.0, 4.1, 4.2, 4.3, 4.4
                patchDwords(peImage, methodsDataReader, patchCount);
                while (methodsDataReader.BaseStream.Position < methodsData.Length - 1)
                {
                    uint rva   = methodsDataReader.ReadUInt32();
                    uint token = methodsDataReader.ReadUInt32();                        // token, unknown, or index
                    int  size  = methodsDataReader.ReadInt32();
                    if (size > 0)
                    {
                        peImage.dotNetSafeWrite(rva, methodsDataReader.ReadBytes(size));
                    }
                }
            }
            else
            {
                // DNR 4.0 - 4.4 (jitter is hooked)

                var  metadataTables = peImage.Cor20Header.createMetadataTables();
                var  methodDef      = metadataTables.getMetadataType(MetadataIndex.iMethodDef);
                var  rvaToIndex     = new Dictionary <uint, int>((int)methodDef.rows);
                uint offset         = methodDef.fileOffset;
                for (int i = 0; i < methodDef.rows; i++)
                {
                    uint rva = peImage.offsetReadUInt32(offset);
                    offset += methodDef.totalSize;
                    if (rva == 0)
                    {
                        continue;
                    }

                    if ((peImage.readByte(rva) & 3) == 2)
                    {
                        rva++;
                    }
                    else
                    {
                        rva += (uint)(4 * (peImage.readByte(rva + 1) >> 4));
                    }
                    rvaToIndex[rva] = i;
                }

                patchDwords(peImage, methodsDataReader, patchCount);
                int count = methodsDataReader.ReadInt32();
                dumpedMethods = new DumpedMethods();
                while (methodsDataReader.BaseStream.Position < methodsData.Length - 1)
                {
                    uint rva          = methodsDataReader.ReadUInt32();
                    uint index        = methodsDataReader.ReadUInt32();
                    bool isNativeCode = index >= 0x70000000;
                    int  size         = methodsDataReader.ReadInt32();
                    var  methodData   = methodsDataReader.ReadBytes(size);

                    int methodIndex;
                    if (!rvaToIndex.TryGetValue(rva, out methodIndex))
                    {
                        Log.w("Could not find method having code RVA {0:X8}", rva);
                        continue;
                    }
                    uint methodToken = 0x06000001 + (uint)methodIndex;

                    if (isNativeCode)
                    {
                        totalEncryptedNativeMethods++;
                        if (tokenToNativeCode != null)
                        {
                            tokenToNativeCode[methodToken] = methodData;
                        }

                        // Convert return true / false methods. The others are converted to
                        // throw 0xDEADCODE.
                        if (DeobUtils.isCode(nativeLdci4, methodData))
                        {
                            uint val = BitConverter.ToUInt32(methodData, 4);
                            // ldc.i4 XXXXXXXXh / ret
                            methodData    = new byte[] { 0x20, 0, 0, 0, 0, 0x2A };
                            methodData[1] = (byte)val;
                            methodData[2] = (byte)(val >> 8);
                            methodData[3] = (byte)(val >> 16);
                            methodData[4] = (byte)(val >> 24);
                        }
                        else if (DeobUtils.isCode(nativeLdci4_0, methodData))
                        {
                            // ldc.i4.0 / ret
                            methodData = new byte[] { 0x16, 0x2A };
                        }
                        else
                        {
                            tokenToNativeMethod[methodToken] = methodData;

                            // ldc.i4 0xDEADCODE / conv.u4 / throw
                            methodData = new byte[] { 0x20, 0xDE, 0xC0, 0xAD, 0xDE, 0x6D, 0x7A };
                        }
                    }

                    var dm = new DumpedMethod();
                    dm.token = methodToken;
                    dm.code  = methodData;

                    offset         = methodDef.fileOffset + (uint)(methodIndex * methodDef.totalSize);
                    rva            = peImage.offsetReadUInt32(offset);
                    dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDef.fields[1].offset);
                    dm.mdFlags     = peImage.offsetReadUInt16(offset + (uint)methodDef.fields[2].offset);
                    dm.mdName      = peImage.offsetRead(offset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size);
                    dm.mdSignature = peImage.offsetRead(offset + (uint)methodDef.fields[4].offset, methodDef.fields[4].size);
                    dm.mdParamList = peImage.offsetRead(offset + (uint)methodDef.fields[5].offset, methodDef.fields[5].size);

                    if ((peImage.readByte(rva) & 3) == 2)
                    {
                        dm.mhFlags          = 2;
                        dm.mhMaxStack       = 8;
                        dm.mhCodeSize       = (uint)dm.code.Length;
                        dm.mhLocalVarSigTok = 0;
                    }
                    else
                    {
                        dm.mhFlags          = peImage.readUInt16(rva);
                        dm.mhMaxStack       = peImage.readUInt16(rva + 2);
                        dm.mhCodeSize       = (uint)dm.code.Length;
                        dm.mhLocalVarSigTok = peImage.readUInt32(rva + 8);
                    }

                    dumpedMethods.add(dm);
                }
            }

            return(true);
        }
Exemple #31
0
        DumpedMethods decryptMethods()
        {
            var dumpedMethods = new DumpedMethods();

            var peImage     = decrypterInfo.peImage;
            var methodInfos = new MethodInfos(decrypterInfo.mainType, peImage, decrypterInfo.peHeader, decrypterInfo.mcKey);

            methodInfos.initializeInfos();

            var  metadataTables  = peImage.Cor20Header.createMetadataTables();
            var  methodDef       = metadataTables.getMetadataType(MetadataIndex.iMethodDef);
            uint methodDefOffset = methodDef.fileOffset;

            for (int i = 0; i < methodDef.rows; i++, methodDefOffset += methodDef.totalSize)
            {
                uint bodyRva = peImage.offsetReadUInt32(methodDefOffset);
                if (bodyRva == 0)
                {
                    continue;
                }

                var info = methodInfos.lookup(bodyRva);
                if (info == null)
                {
                    continue;
                }

                uint   bodyOffset = peImage.rvaToOffset(bodyRva);
                ushort magic      = peImage.offsetReadUInt16(bodyOffset);
                if (magic != 0xFFF3)
                {
                    continue;
                }

                var dm = new DumpedMethod();
                dm.token       = (uint)(0x06000001 + i);
                dm.mdImplFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[1].offset);
                dm.mdFlags     = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[2].offset);
                dm.mdName      = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size);
                dm.mdSignature = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[4].offset, methodDef.fields[4].size);
                dm.mdParamList = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[5].offset, methodDef.fields[5].size);

                var  reader = new BinaryReader(new MemoryStream(info.body));
                byte b      = reader.ReadByte();
                if ((b & 3) == 2)
                {
                    dm.mhFlags          = 2;
                    dm.mhMaxStack       = 8;
                    dm.mhCodeSize       = (uint)(b >> 2);
                    dm.mhLocalVarSigTok = 0;
                }
                else
                {
                    reader.BaseStream.Position--;
                    dm.mhFlags          = reader.ReadUInt16();
                    dm.mhMaxStack       = reader.ReadUInt16();
                    dm.mhCodeSize       = reader.ReadUInt32();
                    dm.mhLocalVarSigTok = reader.ReadUInt32();
                    uint codeOffset = (uint)(dm.mhFlags >> 12) * 4;
                    reader.BaseStream.Position += codeOffset - 12;
                }

                dm.code = reader.ReadBytes((int)dm.mhCodeSize);
                if ((dm.mhFlags & 8) != 0)
                {
                    reader.BaseStream.Position = (reader.BaseStream.Position + 3) & ~3;
                    dm.extraSections           = reader.ReadBytes((int)(reader.BaseStream.Length - reader.BaseStream.Position));
                }

                dumpedMethods.add(dm);
            }

            return(dumpedMethods);
        }
Exemple #32
0
        public bool decrypt2(ref DumpedMethods dumpedMethods)
        {
            uint offset = peImage.rvaToOffset(peImage.Cor20Header.metadataDirectory.virtualAddress + peImage.Cor20Header.metadataDirectory.size);

            if (!readCodeHeader(offset))
            {
                return(false);
            }

            var metadataTables = peImage.Cor20Header.createMetadataTables();
            var methodDefTable = metadataTables.getMetadataType(MetadataIndex.iMethodDef);

            if (methodDefTable.totalSize != codeHeader.methodDefElemSize)
            {
                return(false);
            }

            var methodInfos = getMethodInfos(offset + 0x30 + codeHeader.totalCodeSize);

            offset = methodDefTable.fileOffset - methodDefTable.totalSize;
            foreach (var methodInfo in methodInfos)
            {
                offset += methodDefTable.totalSize;
                if (methodInfo.flags == 0 || methodInfo.codeOffs == 0)
                {
                    continue;
                }
                uint rva = peImage.offsetReadUInt32(offset);
                peImage.writeUint16(rva, (ushort)methodInfo.flags);
                peImage.writeUint32(rva + 8, methodInfo.localVarSigTok);
            }

            dumpedMethods = new DumpedMethods();
            offset        = methodDefTable.fileOffset;
            for (int i = 0; i < methodInfos.Count; i++, offset += methodDefTable.totalSize)
            {
                var methodInfo = methodInfos[i];
                if (methodInfo.codeOffs == 0)
                {
                    continue;
                }

                var dm = new DumpedMethod();
                dm.token = 0x06000001 + (uint)i;

                uint rva = peImage.offsetReadUInt32(offset);
                dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[1].offset);
                dm.mdFlags     = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[2].offset);
                dm.mdName      = peImage.offsetRead(offset + (uint)methodDefTable.fields[3].offset, methodDefTable.fields[3].size);
                dm.mdSignature = peImage.offsetRead(offset + (uint)methodDefTable.fields[4].offset, methodDefTable.fields[4].size);
                dm.mdParamList = peImage.offsetRead(offset + (uint)methodDefTable.fields[5].offset, methodDefTable.fields[5].size);

                dm.code = decrypter.decrypt(methodInfo);

                if ((peImage.readByte(rva) & 3) == 2)
                {
                    dm.mhFlags          = 2;
                    dm.mhMaxStack       = 8;
                    dm.mhCodeSize       = (uint)dm.code.Length;
                    dm.mhLocalVarSigTok = 0;
                }
                else
                {
                    dm.mhFlags          = peImage.readUInt16(rva);
                    dm.mhMaxStack       = peImage.readUInt16(rva + 2);
                    dm.mhCodeSize       = (uint)dm.code.Length;
                    dm.mhLocalVarSigTok = peImage.readUInt32(rva + 8);
                }

                dumpedMethods.add(dm);
            }

            return(true);
        }