Esempio n. 1
0
 public void deobfuscate(MethodDefinition method)
 {
     deobfuscate(method, (blocks) => {
         cflowDeobfuscator.init(blocks);
         cflowDeobfuscator.deobfuscate();
     });
 }
Esempio n. 2
0
        void deobfuscate(MethodDefinition method, BlocksCflowDeobfuscator cflowDeobfuscator, MethodPrinter methodPrinter)
        {
            if (!hasNonEmptyBody(method))
                return;

            var blocks = new Blocks(method);
            int numRemovedLocals = 0;
            int oldNumInstructions = method.Body.Instructions.Count;

            deob.deobfuscateMethodBegin(blocks);
            if (options.ControlFlowDeobfuscation) {
                cflowDeobfuscator.init(blocks);
                cflowDeobfuscator.deobfuscate();
            }

            if (deob.deobfuscateOther(blocks) && options.ControlFlowDeobfuscation)
                cflowDeobfuscator.deobfuscate();

            if (options.ControlFlowDeobfuscation) {
                numRemovedLocals = blocks.optimizeLocals();
                blocks.repartitionBlocks();
            }

            deobfuscateStrings(blocks);
            deob.deobfuscateMethodEnd(blocks);

            IList<Instruction> allInstructions;
            IList<ExceptionHandler> allExceptionHandlers;
            blocks.getCode(out allInstructions, out allExceptionHandlers);
            DotNetUtils.restoreBody(method, allInstructions, allExceptionHandlers);

            if (numRemovedLocals > 0)
                Log.v("Removed {0} unused local(s)", numRemovedLocals);
            int numRemovedInstructions = oldNumInstructions - method.Body.Instructions.Count;
            if (numRemovedInstructions > 0)
                Log.v("Removed {0} dead instruction(s)", numRemovedInstructions);

            const Log.LogLevel dumpLogLevel = Log.LogLevel.veryverbose;
            if (Log.isAtLeast(dumpLogLevel)) {
                Log.log(dumpLogLevel, "Deobfuscated code:");
                Log.indent();
                methodPrinter.print(dumpLogLevel, allInstructions, allExceptionHandlers);
                Log.deIndent();
            }
        }
Esempio n. 3
0
        void ISimpleDeobfuscator.deobfuscate(MethodDefinition method)
        {
            if (check(method, SimpleDeobFlags.HasDeobfuscated))
                return;

            deobfuscate(method, "Deobfuscating control flow", (blocks) => {
                var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators);
                cflowDeobfuscator.init(blocks);
                cflowDeobfuscator.deobfuscate();
            });
        }
 void deobfuscate(Blocks blocks)
 {
     cflowDeobfuscator.init(blocks);
     cflowDeobfuscator.deobfuscate();
 }
        void deobfuscate(MethodDef method, BlocksCflowDeobfuscator cflowDeobfuscator, MethodPrinter methodPrinter, bool isVerbose, bool isVV)
        {
            if (!hasNonEmptyBody(method))
                return;

            var blocks = new Blocks(method);
            int numRemovedLocals = 0;
            int oldNumInstructions = method.Body.Instructions.Count;

            deob.deobfuscateMethodBegin(blocks);
            if (options.ControlFlowDeobfuscation) {
                cflowDeobfuscator.init(blocks);
                cflowDeobfuscator.deobfuscate();
            }

            if (deob.deobfuscateOther(blocks) && options.ControlFlowDeobfuscation)
                cflowDeobfuscator.deobfuscate();

            if (options.ControlFlowDeobfuscation) {
                if (CanOptimizeLocals())
                    numRemovedLocals = blocks.optimizeLocals();
                blocks.repartitionBlocks();
            }

            deobfuscateStrings(blocks);
            deob.deobfuscateMethodEnd(blocks);

            IList<Instruction> allInstructions;
            IList<ExceptionHandler> allExceptionHandlers;
            blocks.getCode(out allInstructions, out allExceptionHandlers);
            DotNetUtils.restoreBody(method, allInstructions, allExceptionHandlers);

            if (isVerbose && numRemovedLocals > 0)
                Logger.v("Removed {0} unused local(s)", numRemovedLocals);
            int numRemovedInstructions = oldNumInstructions - method.Body.Instructions.Count;
            if (isVerbose && numRemovedInstructions > 0)
                Logger.v("Removed {0} dead instruction(s)", numRemovedInstructions);

            if (isVV) {
                Logger.log(LoggerEvent.VeryVerbose, "Deobfuscated code:");
                Logger.Instance.indent();
                methodPrinter.print(LoggerEvent.VeryVerbose, allInstructions, allExceptionHandlers);
                Logger.Instance.deIndent();
            }
        }
Esempio n. 6
0
        void deobfuscateMethods()
        {
            if (savedMethodBodies != null) {
                savedMethodBodies.restoreAll();
                savedMethodBodies = null;
            }
            deob.DeobfuscatedFile = null;

            Log.v("Deobfuscating methods");
            var methodPrinter = new MethodPrinter();
            var cflowDeobfuscator = new BlocksCflowDeobfuscator { InlineMethods = deob.CanInlineMethods };
            foreach (var method in allMethods) {
                Log.v("Deobfuscating {0} ({1:X8})", method, method.MetadataToken.ToUInt32());
                Log.indent();

                if (hasNonEmptyBody(method)) {
                    var blocks = new Blocks(method);
                    int numRemovedLocals = 0;
                    int oldNumInstructions = method.Body.Instructions.Count;

                    deob.deobfuscateMethodBegin(blocks);
                    if (options.ControlFlowDeobfuscation) {
                        cflowDeobfuscator.init(blocks);
                        cflowDeobfuscator.deobfuscate();
                    }

                    if (deob.deobfuscateOther(blocks) && options.ControlFlowDeobfuscation)
                        cflowDeobfuscator.deobfuscate();

                    if (options.ControlFlowDeobfuscation) {
                        numRemovedLocals = blocks.optimizeLocals();
                        blocks.repartitionBlocks();
                    }

                    deobfuscateStrings(blocks);
                    deob.deobfuscateMethodEnd(blocks);

                    IList<Instruction> allInstructions;
                    IList<ExceptionHandler> allExceptionHandlers;
                    blocks.getCode(out allInstructions, out allExceptionHandlers);
                    DotNetUtils.restoreBody(method, allInstructions, allExceptionHandlers);

                    if (numRemovedLocals > 0)
                        Log.v("Removed {0} unused local(s)", numRemovedLocals);
                    int numRemovedInstructions = oldNumInstructions - method.Body.Instructions.Count;
                    if (numRemovedInstructions > 0)
                        Log.v("Removed {0} dead instruction(s)", numRemovedInstructions);

                    const Log.LogLevel dumpLogLevel = Log.LogLevel.veryverbose;
                    if (Log.isAtLeast(dumpLogLevel)) {
                        Log.log(dumpLogLevel, "Deobfuscated code:");
                        Log.indent();
                        methodPrinter.print(dumpLogLevel, method, allInstructions, allExceptionHandlers);
                        Log.deIndent();
                    }
                }

                removeNoInliningAttribute(method);

                Log.deIndent();
            }
        }