Esempio n. 1
0
        void Find()
        {
            var cflowDeobfuscator = new CflowDeobfuscator(new MethodCallInliner(true));

            foreach (var type in module.Types)
            {
                if (DotNetUtils.GetPInvokeMethod(type, "kernel32", "CloseHandle") == null)
                {
                    continue;
                }

                var resolver = new AssemblyResolver(type, cflowDeobfuscator);
                if (!resolver.Detected)
                {
                    continue;
                }
                var patcher = new MemoryPatcher(type, cflowDeobfuscator);
                if (!patcher.Detected)
                {
                    continue;
                }

                assemblyResolver = resolver;
                memoryPatcher    = patcher;
                return;
            }
        }
		void Find() {
			var cflowDeobfuscator = new CflowDeobfuscator(new MethodCallInliner(true));

			foreach (var type in module.Types) {
				if (DotNetUtils.GetPInvokeMethod(type, "kernel32", "CloseHandle") == null)
					continue;

				var resolver = new AssemblyResolver(type, cflowDeobfuscator);
				if (!resolver.Detected)
					continue;
				var patcher = new MemoryPatcher(type, cflowDeobfuscator);
				if (!patcher.Detected)
					continue;

				assemblyResolver = resolver;
				memoryPatcher = patcher;
				return;
			}
		}