bool Remove(Blocks blocks, Block block) {
var instrs = block.Instructions;
const int numInstrsToRemove = 11;
if (instrs.Count < numInstrsToRemove)
return false;
int startIndex = instrs.Count - numInstrsToRemove;
int index = startIndex;
if (instrs[index++].OpCode.Code != Code.Ldtoken)
return false;
if (!CheckCall(instrs[index++], "System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)"))
return false;
if (!CheckCall(instrs[index++], "System.Reflection.Assembly System.Type::get_Assembly()"))
return false;
if (!CheckCall(instrs[index++], "System.Reflection.AssemblyName System.Reflection.Assembly::GetName()"))
return false;
if (!CheckCall(instrs[index++], "System.Byte[] System.Reflection.AssemblyName::GetPublicKeyToken()"))
return false;
if (!CheckCall(instrs[index++], "System.String System.Convert::ToBase64String(System.Byte[])"))
return false;
if (instrs[index++].OpCode.Code != Code.Ldstr)
return false;
if (!CheckCall(instrs[index++], "System.String", "(System.String,System.String)"))
return false;
if (instrs[index++].OpCode.Code != Code.Ldstr)
return false;
if (!CheckCall(instrs[index++], "System.Boolean System.String::op_Inequality(System.String,System.String)"))
return false;
if (!instrs[index++].IsBrfalse())
return false;
var badBlock = block.FallThrough;
var goodblock = block.Targets[0];
if (badBlock == null)
return false;
if (badBlock == goodblock) {
// All of the bad block was removed by the cflow deobfuscator. It was just a useless
// calculation (div by zero).
block.ReplaceLastInstrsWithBranch(numInstrsToRemove, goodblock);
}
else if (badBlock.Sources.Count == 1) {
instrs = badBlock.Instructions;
if (instrs.Count != 12)
return false;
index = 0;
if (!instrs[index++].IsLdcI4())
return false;
if (!instrs[index].IsStloc())
return false;
var local = Instr.GetLocalVar(blocks.Locals, instrs[index++]);
if (local == null)
return false;
if (!CheckLdloc(blocks.Locals, instrs[index++], local))
return false;
if (!CheckLdloc(blocks.Locals, instrs[index++], local))
return false;
if (instrs[index++].OpCode.Code != Code.Sub)
return false;
if (instrs[index++].OpCode.Code != Code.Conv_U1)
return false;
if (!CheckStloc(blocks.Locals, instrs[index++], local))
return false;
if (!CheckLdloc(blocks.Locals, instrs[index++], local))
return false;
if (!CheckLdloc(blocks.Locals, instrs[index++], local))
return false;
if (instrs[index++].OpCode.Code != Code.Div)
return false;
if (instrs[index++].OpCode.Code != Code.Conv_U1)
return false;
if (!CheckStloc(blocks.Locals, instrs[index++], local))
return false;
block.ReplaceLastInstrsWithBranch(numInstrsToRemove, goodblock);
badBlock.Parent.RemoveDeadBlock(badBlock);
}
else
return false;
return true;
}
