public MainType(ModuleDefMD module, MainType oldOne)
{
this.module = module;
this.theType = lookup(oldOne.theType, "Could not find main type");
this.initMethod = lookup(oldOne.initMethod, "Could not find main type init method");
this.tamperCheckMethod = lookup(oldOne.tamperCheckMethod, "Could not find tamper detection method");
this.obfuscatorVersion = oldOne.obfuscatorVersion;
this.rvas = oldOne.rvas;
foreach (var otherInitMethod in otherInitMethods)
{
otherInitMethods.Add(lookup(otherInitMethod, "Could not find otherInitMethod"));
}
}
public void find()
{
var cctor = DotNetUtils.getModuleTypeCctor(module);
if (cctor == null)
{
return;
}
var instrs = cctor.Body.Instructions;
for (int i = 0; i < instrs.Count - 2; i++)
{
var ldci4_1 = instrs[i];
if (!ldci4_1.IsLdcI4())
{
continue;
}
var ldci4_2 = instrs[i + 1];
if (!ldci4_2.IsLdcI4())
{
continue;
}
var call = instrs[i + 2];
if (call.OpCode.Code != Code.Call)
{
continue;
}
var initMethodTmp = call.Operand as MethodDef;
ObfuscatorVersion obfuscatorVersionTmp;
if (!checkInitMethod(initMethodTmp, out obfuscatorVersionTmp))
{
continue;
}
if (!checkMethodsType(initMethodTmp.DeclaringType))
{
continue;
}
obfuscatorVersion = obfuscatorVersionTmp;
theType = initMethodTmp.DeclaringType;
initMethod = initMethodTmp;
break;
}
}
bool checkInitMethod(MethodDef initMethod, out ObfuscatorVersion obfuscatorVersionTmp)
{
obfuscatorVersionTmp = ObfuscatorVersion.Unknown;
if (initMethod == null)
{
return(false);
}
if (initMethod.Body == null)
{
return(false);
}
if (!initMethod.IsStatic)
{
return(false);
}
if (!DotNetUtils.isMethod(initMethod, "System.Void", "(System.Boolean,System.Boolean)"))
{
return(false);
}
if (hasCodeString(initMethod, "E_FullTrust"))
{
if (DotNetUtils.getPInvokeMethod(initMethod.DeclaringType, "user32", "CallWindowProcW") != null)
{
obfuscatorVersionTmp = ObfuscatorVersion.V4_1;
}
else
{
obfuscatorVersionTmp = ObfuscatorVersion.V4_0;
}
}
else if (hasCodeString(initMethod, "Full Trust Required"))
{
obfuscatorVersionTmp = ObfuscatorVersion.V3;
}
else if (initMethod.DeclaringType.HasNestedTypes && new FieldTypes(initMethod.DeclaringType).all(fieldTypesV5))
{
obfuscatorVersionTmp = ObfuscatorVersion.V5_0;
}
else
{
return(false);
}
return(true);
}
