List <ProjectFile>?TryCreateResourceFiles(ModuleDef module, ResourceNameCreator resourceNameCreator, EmbeddedResource er)
{
ResourceElementSet set;
try {
set = ResourceReader.Read(module, er.CreateReader());
}
catch {
return(null);
}
if (IsXamlResource(module, er.Name, set))
{
return(CreateXamlResourceFiles(module, resourceNameCreator, set).ToList());
}
if (Options.CreateResX)
{
string filename = resourceNameCreator.GetResxFilename(er.Name, out string typeFullName);
return(new List <ProjectFile>()
{
CreateResXFile(module, er, set, filename, typeFullName, false)
});
}
return(null);
}
public void Initialize(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
{
if (resolverType == null)
{
return;
}
encryptedResource = BabelUtils.FindEmbeddedResource(module, resolverType, simpleDeobfuscator, deob);
if (encryptedResource == null)
{
Logger.w("Could not find embedded assemblies resource");
return;
}
var decrypted = resourceDecrypter.Decrypt(encryptedResource.CreateReader().ToArray());
var reader = new BinaryReader(new MemoryStream(decrypted));
int numAssemblies = reader.ReadInt32();
embeddedAssemblyInfos = new EmbeddedAssemblyInfo[numAssemblies];
for (int i = 0; i < numAssemblies; i++)
{
string name = reader.ReadString();
var data = reader.ReadBytes(reader.ReadInt32());
var mod = ModuleDefMD.Load(data);
embeddedAssemblyInfos[i] = new EmbeddedAssemblyInfo(name, DeobUtils.GetExtension(mod.Kind), data);
}
}
private void ParseResource(EmbeddedResource resource)
{
ResourceReader reader;
try
{
reader = new ResourceReader(resource.CreateReader().AsStream());
}
catch (ArgumentException)
{
Console.WriteLine("This resource can not be parsed.");
//throw;
return;
}
var e = reader.GetEnumerator();
while (e.MoveNext())
{
if (e.Key.ToString().ToLower().EndsWith(".baml"))
{
reader.GetResourceData(e.Key.ToString(), out _, out var contents);
//MARK:AF 3E 00 00
contents = contents.Skip(4).ToArray(); //MARK:the first 4 bytes = length
using (var ms = new MemoryStream(contents))
{
BamlDocument b = BamlReader.ReadDocument(ms);
BamlFiles.TryAdd(e.Key.ToString(), b);
}
}
}
}
public override byte[] GetMethodsData(EmbeddedResource resource)
{
var reader = resource.CreateReader();
reader.Position = (uint)startOffset;
var decrypted = new byte[reader.Read7BitEncodedUInt32()];
uint origCrc32 = reader.ReadUInt32();
uint pos = reader.Position;
var keys = new byte[][] { decryptionKey, decryptionKey6, decryptionKey7 };
foreach (var key in keys)
{
try {
reader.Position = pos;
Decompress(decrypted, ref reader, key, decryptionKeyMod);
uint crc32 = CRC32.CheckSum(decrypted);
if (crc32 == origCrc32)
{
return(decrypted);
}
}
catch (OutOfMemoryException) {
}
catch (Exception ex) when(ex is IOException || ex is ArgumentException)
{
}
}
throw new ApplicationException("Could not decrypt methods data");
}
public void Initialize(ModuleDefMD module, EmbeddedResource resource)
{
key = resource.CreateReader().ToArray();
if (key.Length != 0x100)
{
throw new ApplicationException($"Unknown key length: {key.Length}");
}
}
static ResourceElementSet?TryCreateResourceElementSet(ModuleDef module, EmbeddedResource er)
{
if (er is null)
{
return(null);
}
if (!ResourceReader.CouldBeResourcesFile(er.CreateReader()))
{
return(null);
}
try {
return(ResourceReader.Read(module, er.CreateReader()));
}
catch {
return(null);
}
}
byte[] Decrypt_v14_r55802()
{
var reader = new BinaryReader(new MemoryStream(Decompress(resource.CreateReader().ToArray())));
var encypted = reader.ReadBytes(reader.ReadInt32());
if ((encypted.Length & 1) != 0)
{
throw new ApplicationException("Invalid resource data length");
}
var decrypted = new byte[encypted.Length / 2];
for (int i = 0; i < decrypted.Length; i++)
{
decrypted[i] = (byte)((encypted[i * 2 + 1] ^ key0) * key1 + (encypted[i * 2] ^ key0));
}
reader = new BinaryReader(new MemoryStream(Decompress(decrypted)));
return(reader.ReadBytes(reader.ReadInt32()));
}
public void Initialize(ModuleDefMD module, EmbeddedResource resource)
{
var decrypted = resourceDecrypter.Decrypt(resource.CreateReader().ToArray());
var reader = new BinaryReader(new MemoryStream(decrypted));
while (reader.BaseStream.Position < reader.BaseStream.Length)
{
offsetToString[GetOffset((int)reader.BaseStream.Position)] = reader.ReadString();
}
}
protected static byte[] DecryptResourceV41SL(EmbeddedResource resource)
{
var data = resource.CreateReader().ToArray();
byte k = data[0];
for (int i = 0; i < data.Length - 1; i++)
{
data[i + 1] ^= (byte)((k << (i & 5)) + i);
}
return(InflateIfNeeded(data, 1, data.Length - 1));
}
public override DataReader CreateReader(uint offset, uint length)
{
if (offset != 0)
{
throw new ArgumentException(nameof(offset));
}
if (length != Length)
{
throw new ArgumentException(nameof(length));
}
return(_resource.CreateReader());
}
public void Initialize() {
if (installMethod == null)
return;
if (!FindKeys())
throw new ApplicationException("Could not find keys");
if ((resource = FindResource(key0)) == null)
throw new ApplicationException("Could not find resource");
constants = DecryptResource(resource.CreateReader().ToArray());
FindDecrypters();
}
public void Initialize(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
{
if (methodsDecrypter == null)
{
return;
}
encryptedResource = BabelUtils.FindEmbeddedResource(module, methodsDecrypter, simpleDeobfuscator, deob);
if (encryptedResource != null)
{
AddImageReader("", resourceDecrypter.Decrypt(encryptedResource.CreateReader().ToArray()));
}
}
public virtual byte[] GetMethodsData(EmbeddedResource resource)
{
var reader = resource.CreateReader();
reader.Position = (uint)startOffset;
if ((reader.ReadInt32() & 1) != 0)
{
return(Decompress(ref reader));
}
else
{
return(reader.ReadRemainingBytes());
}
}
List <ResXDataNode> ReadResourceEntries(DecompileContext ctx)
{
var list = new List <ResXDataNode>();
int errors = 0;
try {
using (var reader = new ResourceReader(embeddedResource.CreateReader().AsStream())) {
var iter = reader.GetEnumerator();
while (iter.MoveNext())
{
ctx.CancellationToken.ThrowIfCancellationRequested();
string?key = null;
try {
key = iter.Key as string;
if (key is null)
{
continue;
}
var value = iter.Value;
// ResXDataNode ctor checks if the input is serializable, which this stream isn't.
// We have no choice but to create a new stream.
if (value is Stream && !value.GetType().IsSerializable)
{
var stream = (Stream)value;
var data = new byte[stream.Length];
if (stream.Read(data, 0, data.Length) != data.Length)
{
throw new IOException("Could not read all bytes");
}
value = new MemoryStream(data);
}
//TODO: Some resources, like images, should be saved as separate files. Use ResXFileRef.
// Don't do it if it's a satellite assembly.
list.Add(delegateResXDataNodeConstructor?.Invoke(key, value, TypeNameConverter) ?? new ResXDataNode(key, value));
}
catch (Exception ex) {
if (errors++ < 30)
{
ctx.Logger.Error($"Could not add resource '{key}', Message: {ex.Message}");
}
}
}
}
}
catch (Exception ex) {
ctx.Logger.Error($"Could not read resources from {embeddedResource.Name}, Message: {ex.Message}");
}
return(list);
}
public void Initialize(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
{
if (decrypterType == null)
{
return;
}
encryptedResource = BabelUtils.FindEmbeddedResource(module, decrypterType, simpleDeobfuscator, deob);
if (encryptedResource == null)
{
Logger.w("Could not find encrypted constants resource");
return;
}
var decrypted = resourceDecrypter.Decrypt(encryptedResource.CreateReader().ToArray());
var reader = new BinaryReader(new MemoryStream(decrypted));
int count;
count = reader.ReadInt32();
decryptedInts = new int[count];
while (count-- > 0)
{
decryptedInts[count] = reader.ReadInt32();
}
count = reader.ReadInt32();
decryptedLongs = new long[count];
while (count-- > 0)
{
decryptedLongs[count] = reader.ReadInt64();
}
count = reader.ReadInt32();
decryptedFloats = new float[count];
while (count-- > 0)
{
decryptedFloats[count] = reader.ReadSingle();
}
count = reader.ReadInt32();
decryptedDoubles = new double[count];
while (count-- > 0)
{
decryptedDoubles[count] = reader.ReadDouble();
}
}
public void Initialize(ResourceDecrypter resourceDecrypter)
{
if (decrypterType == null)
{
return;
}
var cctor = decrypterType.FindStaticConstructor();
encryptedResource = CoUtils.GetResource(module, DotNetUtils.GetCodeStrings(cctor));
//if the return value is null, it is possible that resource name is encrypted
if (encryptedResource == null)
{
var Resources = new string[] { CoUtils.DecryptResourceName(module, cctor) };
encryptedResource = CoUtils.GetResource(module, Resources);
}
constantsData = resourceDecrypter.Decrypt(encryptedResource.CreateReader().AsStream());
}
private EmbeddedResource ReloadResource(EmbeddedResource resource)
{
ResourceReader reader;
try
{
reader = new ResourceReader(resource.CreateReader().AsStream());
}
catch (ArgumentException)
{
Console.WriteLine("This resource can not be parsed.");
return(resource);
}
MemoryStream m = new MemoryStream();
ResourceWriter writer = new ResourceWriter(m);
var e = reader.GetEnumerator();
while (e.MoveNext())
{
if (BamlFiles.ContainsKey(e.Key.ToString()))
{
//MARK:AF 3E 00 00
using var ms = new MemoryStream();
BamlWriter.WriteDocument(BamlFiles[e.Key.ToString()], ms);
writer.AddResource(e.Key.ToString(), ms.ToArray());
}
else
{
writer.AddResource(e.Key.ToString(), e.Value);
}
}
//writer.AddResource(e.Key.ToString(), e.Value);
writer.Generate();
EmbeddedResource embedded = new EmbeddedResource(resource.Name, m.ToArray());
writer.Close();
return(embedded);
}
void DecryptAllAssemblies()
{
if (assemblyResource == null)
{
return;
}
var resourceSet = ResourceReader.Read(resourceModule, assemblyResource.CreateReader());
foreach (var resourceElement in resourceSet.ResourceElements)
{
if (resourceElement.ResourceData.Code != ResourceTypeCode.ByteArray)
{
throw new ApplicationException("Invalid resource");
}
var resourceData = (BuiltInResourceData)resourceElement.ResourceData;
var assemblyData = Decrypt((byte[])resourceData.Data);
var theModule = ModuleDefMD.Load(assemblyData);
bool isMain = resourceElement.Name == entryPointAssemblyKey;
assemblyInfos.Add(new AssemblyInfo(assemblyData, DeobUtils.GetExtension(theModule.Kind), theModule.Assembly.FullName, theModule.Assembly.Name.String, isMain));
}
}
byte[] Decrypt(EmbeddedResource resource)
{
var data = resource.CreateReader().ToArray();
switch (version)
{
case ConfuserVersion.v10_r42915: return(Decrypt_v10_r42915(data));
case ConfuserVersion.v10_r48717: return(Decrypt_v10_r42915(data));
case ConfuserVersion.v14_r57778: return(Decrypt_v10_r42915(data));
case ConfuserVersion.v14_r58564: return(Decrypt_v14_r58564(data));
case ConfuserVersion.v14_r58802: return(Decrypt_v14_r58564(data));
case ConfuserVersion.v14_r58852: return(Decrypt_v14_r58852(data));
case ConfuserVersion.v15_r60785: return(Decrypt_v15_r60785(data));
case ConfuserVersion.v17_r73404: return(Decrypt_v17_r73404(data));
case ConfuserVersion.v17_r73477: return(Decrypt_v17_r73404(data));
case ConfuserVersion.v17_r73566: return(Decrypt_v17_r73404(data));
case ConfuserVersion.v17_r75076: return(Decrypt_v17_r75076(data));
case ConfuserVersion.v18_r75184: return(Decrypt_v17_r75076(data));
case ConfuserVersion.v18_r75367: return(Decrypt_v17_r75076(data));
case ConfuserVersion.v19_r77172: return(Decrypt_v17_r75076(data));
default: throw new ApplicationException("Unknown version");
}
}
IEnumerable <ProjectFile> CreateEmbeddedResourceFiles(ModuleDef module, ResourceNameCreator resourceNameCreator, EmbeddedResource er)
{
if (!Options.UnpackResources)
{
yield return(CreateRawEmbeddedResourceProjectFile(module, resourceNameCreator, er));
yield break;
}
if (ResourceReader.CouldBeResourcesFile(er.CreateReader()))
{
var files = TryCreateResourceFiles(module, resourceNameCreator, er);
if (!(files is null))
{
foreach (var file in files)
{
yield return(file);
}
yield break;
}
}
yield return(CreateRawEmbeddedResourceProjectFile(module, resourceNameCreator, er));
}
void Rename(TypeDef type, EmbeddedResource resource)
{
newNames.Clear();
var resourceSet = ResourceReader.Read(module, resource.CreateReader());
var renamed = new List <RenameInfo>();
foreach (var elem in resourceSet.ResourceElements)
{
if (nameChecker.IsValidResourceKeyName(elem.Name))
{
newNames.Add(elem.Name, true);
continue;
}
renamed.Add(new RenameInfo(elem, GetNewName(elem)));
}
if (renamed.Count == 0)
{
return;
}
Rename(type, renamed);
var outStream = new MemoryStream();
ResourceWriter.Write(module, outStream, resourceSet);
var newResource = new EmbeddedResource(resource.Name, outStream.ToArray(), resource.Attributes);
int resourceIndex = module.Resources.IndexOf(resource);
if (resourceIndex < 0)
{
throw new ApplicationException("Could not find index of resource");
}
module.Resources[resourceIndex] = newResource;
}
void Restore2()
{
Logger.n("Restoring CSVM methods");
Logger.Instance.Indent();
var opcodeDetector = GetVmOpCodeHandlerDetector();
var csvmMethods = new CsvmDataReader(resource.CreateReader()).Read();
var converter = new CsvmToCilMethodConverter(deobfuscatorContext, module, opcodeDetector);
var methodPrinter = new MethodPrinter();
foreach (var csvmMethod in csvmMethods)
{
var cilMethod = module.ResolveToken(csvmMethod.Token) as MethodDef;
if (cilMethod == null)
{
throw new ApplicationException($"Could not find method {csvmMethod.Token:X8}");
}
converter.Convert(cilMethod, csvmMethod);
Logger.v("Restored method {0:X8}", cilMethod.MDToken.ToInt32());
PrintMethod(methodPrinter, cilMethod);
}
Logger.Instance.DeIndent();
Logger.n("Restored {0} CSVM methods", csvmMethods.Count);
}
byte[] DecryptResourceAssembly()
{
var decrypted = resourceDecrypter.Decrypt(encryptedResource.CreateReader().ToArray());
var reader = new BinaryReader(new MemoryStream(decrypted));
int numResources = reader.ReadInt32() ^ xorKey1;
for (int i = 0; i < numResources; i++)
{
reader.ReadString();
}
int len;
if (hasXorKeys)
{
len = reader.ReadInt32() ^ xorKey2;
}
else
{
len = (int)(reader.BaseStream.Length - reader.BaseStream.Position);
}
return(reader.ReadBytes(len));
}
public ImageResourceNodeImpl(ITreeNodeGroup treeNodeGroup, EmbeddedResource resource)
: base(treeNodeGroup, resource)
{
imageData = resource.CreateReader().ToArray();
imageSource = ImageResourceUtilities.CreateImageSource(imageData);
}
public override void Create(DecompileContext ctx)
{
using (var stream = File.Create(Filename))
embeddedResource.CreateReader().CopyTo(stream);
}
protected static byte[] DecryptResourceV3(EmbeddedResource resource) => DecryptResourceV3(resource.CreateReader().ToArray());
public ResourceElementSetNodeImpl(ITreeNodeGroup treeNodeGroup, ModuleDef module, EmbeddedResource resource)
: base(treeNodeGroup, resource)
{
this.module = module;
resourceElementSet = ResourceReader.Read(module, resource.CreateReader());
}
void DumpEmbeddedFile(EmbeddedResource resource, string assemblyName, string extension, string reason)
{
DeobfuscatedFile.CreateAssemblyFile(resourceDecrypter.Decrypt(resource.CreateReader().AsStream()), Utils.GetAssemblySimpleName(assemblyName), extension);
AddResourceToBeRemoved(resource, reason);
}
