public void TryDecryptString(byte[] contents, Func <byte[], bool> validate, bool ascii)
{
if (cryptoLocked)
{
currentEncryption.Decrypt(contents);
return;
}
// Get score of data for each crypto
var results = new DecryptedString[cryptos.Length];
for (var i = 0; i < cryptos.Length; i++)
{
var crypto = cryptos[i];
var copy = GetCopy(contents);
crypto.Decrypt(copy);
var score = getScoreForString(ascii ? Encoding.ASCII.GetString(copy) : Encoding.Unicode.GetString(copy), ascii);
if (crypto == currentEncryption)
{
score += 5;
}
results[i] = new DecryptedString
{
decrypted = copy,
score = score,
crypto = crypto,
};
}
var orderedResults = results.OrderByDescending(x => x.score);
// Take a wild guess, pick the first one
var best = orderedResults.First();
currentEncryption = best.crypto;
PutCurrentInFront();
best.decrypted.CopyTo(contents, 0);
}
private Dictionary <MethodBase, List <DecryptedString> > GetDecryptedStrings(MethodInfo decryptionMethod)
{
ParameterInfo[] decryptionParameters = decryptionMethod.GetParameters();
Dictionary <MethodBase, List <DecryptedString> > stringsPerMethod = new Dictionary <MethodBase, List <DecryptedString> >();
var mc = AnalysisManager.Instance.GetMemberCache(decryptionMethod);
IEnumerable <MemberInfo> methodsToInspect;
if (specificMethod != null)
{
methodsToInspect = new MemberInfo[] { specificMethod }
}
;
else
{
methodsToInspect = mc.UsedBy.Select(entry => entry.Member);
}
foreach (MemberInfo mUsing in methodsToInspect)
{
if (mUsing is MethodBase)
{
List <DecryptedString> decryptedStrings = new List <DecryptedString>();
try
{
var instructions = ((MethodBase)mUsing).GetILInstructions();
var instructionsCallingDecrypt = instructions.Where(i => object.Equals(i.Operand, decryptionMethod));
foreach (var call in instructionsCallingDecrypt)
{
object[] parameterValues = new object[decryptionParameters.Length];
var curInstruction = call.Previous;
int curParamIndex = decryptionParameters.Length - 1;
while (curInstruction != null && curParamIndex >= 0)
{
object valuePutOnStackForInstruction = curInstruction.ConstantValuePutOnStack;
if (valuePutOnStackForInstruction != null &&
decryptionParameters[curParamIndex].ParameterType.IsAssignableFrom(valuePutOnStackForInstruction.GetType()))
{
parameterValues[curParamIndex] = valuePutOnStackForInstruction;
curParamIndex--;
}
curInstruction = curInstruction.Previous;
}
if (curParamIndex < 0)
{
string decryptedString = (string)decryptionMethod.Invoke(null, parameterValues);
DecryptedString ds = new DecryptedString()
{
Decrypted = decryptedString,
Encrypted = parameterValues.Where(p => p is string).FirstOrDefault() + "",
ILOffset = call.Offset
};
decryptedStrings.Add(ds);
}
}
}
catch (Exception ex)
{
decryptedStrings.Add(new DecryptedString()
{
Decrypted = "#ERROR: Unable to decrypt strings, " + ex.GetType().FullName + " - " + ex.Message, Encrypted = "", ILOffset = 0
});
}
stringsPerMethod.Add((MethodBase)mUsing, decryptedStrings);
}
}
return(stringsPerMethod);
}
