public static string[] FindKeys(FourDepack.FourDots_PackedApplication packedAppInfo, SearchType keySearchType) // If a decryption method is called, it adds the string present just before to the found keys array and returns the final array.
{
string callOperandStringCompare = "CryptoHelper::Encrypt";
if (keySearchType == SearchType.DecryptionKeys)
{
callOperandStringCompare = "CryptoHelper::Decrypt";
}
List <string> foundDecryptionKeys = new List <string>();
foreach (TypeDef t_ in packedAppInfo.PackedApplication_ModuleMD.Types)
{
foreach (MethodDef methods in t_.Methods)
{
if (!methods.HasBody)
{
continue;
}
for (int x = 0; x < methods.Body.Instructions.Count - 1; x++)
{
Instruction inst = methods.Body.Instructions[x];
if (inst.OpCode == OpCodes.Call && methods.Body.Instructions[x - 1].OpCode == OpCodes.Ldstr)
{
int tempInt = 0;
for (int x_ = x; x_ > 0; x_--)
{
Instruction inst_ = methods.Body.Instructions[x_];
if (inst_.OpCode == OpCodes.Ldstr)
{
tempInt = x_; break;
}
}
if (inst.Operand.ToString().Contains(callOperandStringCompare))
{
foundDecryptionKeys.Add(methods.Body.Instructions[tempInt].Operand.ToString());
}
}
}
}
}
return(foundDecryptionKeys.ToArray());
}
public Protections(string path)
{
PackedApplication_GlobalInfo = new FourDepack.FourDots_PackedApplication(path);
}
