void decryptMethods(uint codeHeaderOffset, MDTable methodDefTable, ICsHeader csHeader, ref DumpedMethods dumpedMethods)
        {
            var methodInfos = csHeader.getMethodInfos(codeHeaderOffset);

            csHeader.patchMethodTable(methodDefTable, methodInfos);

            dumpedMethods = new DumpedMethods();
            decrypter     = csHeader.createDecrypter();
            for (uint rid = 1; rid <= (uint)methodInfos.Count; rid++)
            {
                var methodInfo = methodInfos[(int)rid - 1];
                if (methodInfo.codeOffs == 0)
                {
                    continue;
                }

                var dm = new DumpedMethod();
                peImage.readMethodTableRowTo(dm, rid);


                var mbHeader = decrypter.decrypt(methodInfo, out dm.code, out dm.extraSections);
                peImage.updateMethodHeaderInfo(dm, mbHeader);

                dumpedMethods.add(dm);
            }
        }
Esempio n. 2
0
        void decryptMethods(uint codeHeaderOffset, MetadataType methodDefTable, ICsHeader csHeader, ref DumpedMethods dumpedMethods)
        {
            var methodInfos = csHeader.getMethodInfos(codeHeaderOffset);

            csHeader.patchMethodDefTable(methodDefTable, methodInfos);

            dumpedMethods = new DumpedMethods();
            uint offset = methodDefTable.fileOffset;

            decrypter = csHeader.createDecrypter();
            for (int i = 0; i < methodInfos.Count; i++, offset += methodDefTable.totalSize)
            {
                var methodInfo = methodInfos[i];
                if (methodInfo.codeOffs == 0)
                {
                    continue;
                }

                var dm = new DumpedMethod();
                dm.token = 0x06000001 + (uint)i;

                dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[1].offset);
                dm.mdFlags     = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[2].offset);
                dm.mdName      = peImage.offsetRead(offset + (uint)methodDefTable.fields[3].offset, methodDefTable.fields[3].size);
                dm.mdSignature = peImage.offsetRead(offset + (uint)methodDefTable.fields[4].offset, methodDefTable.fields[4].size);
                dm.mdParamList = peImage.offsetRead(offset + (uint)methodDefTable.fields[5].offset, methodDefTable.fields[5].size);

                var mbHeader = decrypter.decrypt(methodInfo, out dm.code, out dm.extraSections);
                dm.mhFlags          = mbHeader.flags;
                dm.mhMaxStack       = mbHeader.maxStack;
                dm.mhCodeSize       = (uint)dm.code.Length;
                dm.mhLocalVarSigTok = mbHeader.localVarSigTok;

                dumpedMethods.add(dm);
            }
        }
Esempio n. 3
0
        void decryptMethods(uint codeHeaderOffset, MetadataType methodDefTable, ICsHeader csHeader, ref DumpedMethods dumpedMethods)
        {
            var methodInfos = csHeader.getMethodInfos(codeHeaderOffset);
            csHeader.patchMethodDefTable(methodDefTable, methodInfos);

            dumpedMethods = new DumpedMethods();
            uint offset = methodDefTable.fileOffset;
            decrypter = csHeader.createDecrypter();
            for (int i = 0; i < methodInfos.Count; i++, offset += methodDefTable.totalSize) {
                var methodInfo = methodInfos[i];
                if (methodInfo.codeOffs == 0)
                    continue;

                var dm = new DumpedMethod();
                dm.token = 0x06000001 + (uint)i;

                dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[1].offset);
                dm.mdFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[2].offset);
                dm.mdName = peImage.offsetRead(offset + (uint)methodDefTable.fields[3].offset, methodDefTable.fields[3].size);
                dm.mdSignature = peImage.offsetRead(offset + (uint)methodDefTable.fields[4].offset, methodDefTable.fields[4].size);
                dm.mdParamList = peImage.offsetRead(offset + (uint)methodDefTable.fields[5].offset, methodDefTable.fields[5].size);

                var mbHeader = decrypter.decrypt(methodInfo, out dm.code, out dm.extraSections);
                dm.mhFlags = mbHeader.flags;
                dm.mhMaxStack = mbHeader.maxStack;
                dm.mhCodeSize = (uint)dm.code.Length;
                dm.mhLocalVarSigTok = mbHeader.localVarSigTok;

                dumpedMethods.add(dm);
            }
        }
        void decryptMethods(uint codeHeaderOffset, MDTable methodDefTable, ICsHeader csHeader, ref DumpedMethods dumpedMethods)
        {
            var methodInfos = csHeader.getMethodInfos(codeHeaderOffset);
            csHeader.patchMethodTable(methodDefTable, methodInfos);

            dumpedMethods = new DumpedMethods();
            decrypter = csHeader.createDecrypter();
            for (uint rid = 1; rid <= (uint)methodInfos.Count; rid++) {
                var methodInfo = methodInfos[(int)rid - 1];
                if (methodInfo.codeOffs == 0)
                    continue;

                var dm = new DumpedMethod();
                peImage.readMethodTableRowTo(dm, rid);

                var mbHeader = decrypter.decrypt(methodInfo, out dm.code, out dm.extraSections);
                peImage.updateMethodHeaderInfo(dm, mbHeader);

                dumpedMethods.add(dm);
            }
        }