public static void TamperFields2(ModuleDefMD module)
{
//Console.WriteLine("[!] Finding Field And Its Value");
var cctor = module.GlobalType.FindOrCreateStaticConstructor();
if (cctor.Body.Instructions[0].OpCode == OpCodes.Call &&
cctor.Body.Instructions[0].Operand.ToString().Contains("Koi"))
{
cctor = (MethodDef)cctor.Body.Instructions[0].Operand;
}
foreach (var t1 in cctor.Body.Instructions)
{
if (t1.OpCode == OpCodes.Call ||
t1.Operand is MethodDef)
{
var methodDef = (MethodDef)t1.Operand;
if (!methodDef.HasBody)
{
continue;
}
if (!methodDef.Body.Instructions[0].IsLdcI4() && methodDef.Body.Instructions[1].OpCode != OpCodes.Dup)
{
continue;
}
var intEnd = FindEnd(methodDef);
var insEmu = new Emulation(methodDef);
insEmu.Emulate2(methodDef.Body.Instructions, 0, intEnd);
allFields = insEmu.ValueStack.Fields;
return;
}
}
}
