コード例 #1
0
        public void findDelegateCreator(ModuleDefinition module)
        {
            var callCounter = new CallCounter();

            foreach (var type in module.Types)
            {
                if (type.Namespace != "" || !DotNetUtils.derivesFromDelegate(type))
                {
                    continue;
                }
                var cctor = DotNetUtils.getMethod(type, ".cctor");
                if (cctor == null)
                {
                    continue;
                }
                foreach (var method in DotNetUtils.getMethodCalls(cctor))
                {
                    callCounter.add(method);
                }
            }

            var mostCalls = callCounter.most();

            if (mostCalls == null)
            {
                return;
            }

            setDelegateCreatorMethod(DotNetUtils.getMethod(module, mostCalls));
        }
コード例 #2
0
		public void find() {
			var additionalTypes = new string[] {
				"System.IntPtr",
//				"System.Reflection.Assembly",		//TODO: Not in unknown DNR version with jitter support
			};
			var checkedMethods = new Dictionary<IMethod, bool>(MethodEqualityComparer.CompareDeclaringTypes);
			var callCounter = new CallCounter();
			int typesLeft = 30;
			foreach (var type in module.GetTypes()) {
				var cctor = type.FindStaticConstructor();
				if (cctor == null || cctor.Body == null)
					continue;
				if (typesLeft-- <= 0)
					break;

				foreach (var method in DotNetUtils.getCalledMethods(module, cctor)) {
					if (!checkedMethods.ContainsKey(method)) {
						checkedMethods[method] = false;
						if (method.DeclaringType.BaseType == null || method.DeclaringType.BaseType.FullName != "System.Object")
							continue;
						if (!DotNetUtils.isMethod(method, "System.Void", "()"))
							continue;
						if (!encryptedResource.couldBeResourceDecrypter(method, additionalTypes))
							continue;
						checkedMethods[method] = true;
					}
					else if (!checkedMethods[method])
						continue;
					callCounter.add(method);
				}
			}

			encryptedResource.Method = (MethodDef)callCounter.most();
		}
コード例 #3
0
        public void find()
        {
            var additionalTypes = new string[] {
                "System.IntPtr",
//				"System.Reflection.Assembly",		//TODO: Not in unknown DNR version with jitter support
            };
            var checkedMethods = new Dictionary <MethodReferenceAndDeclaringTypeKey, bool>();
            var callCounter    = new CallCounter();
            int typesLeft      = 30;

            foreach (var type in module.GetTypes())
            {
                var cctor = DotNetUtils.getMethod(type, ".cctor");
                if (cctor == null || cctor.Body == null)
                {
                    continue;
                }
                if (typesLeft-- <= 0)
                {
                    break;
                }

                foreach (var method in DotNetUtils.getCalledMethods(module, cctor))
                {
                    var key = new MethodReferenceAndDeclaringTypeKey(method);
                    if (!checkedMethods.ContainsKey(key))
                    {
                        checkedMethods[key] = false;
                        if (method.DeclaringType.BaseType == null || method.DeclaringType.BaseType.FullName != "System.Object")
                        {
                            continue;
                        }
                        if (!DotNetUtils.isMethod(method, "System.Void", "()"))
                        {
                            continue;
                        }
                        if (!encryptedResource.couldBeResourceDecrypter(method, additionalTypes))
                        {
                            continue;
                        }
                        checkedMethods[key] = true;
                    }
                    else if (!checkedMethods[key])
                    {
                        continue;
                    }
                    callCounter.add(method);
                }
            }

            encryptedResource.Method = (MethodDefinition)callCounter.most();
        }
コード例 #4
0
        void init()
        {
            var callCounter = new CallCounter();
            int count       = 0;

            foreach (var type in module.GetTypes())
            {
                if (count >= 40)
                {
                    break;
                }
                foreach (var method in type.Methods)
                {
                    if (method.Name != ".ctor" && method.Name != ".cctor" && module.EntryPoint != method)
                    {
                        continue;
                    }
                    foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method))
                    {
                        if (!calledMethod.IsStatic || calledMethod.Body == null)
                        {
                            continue;
                        }
                        if (!DotNetUtils.isMethod(calledMethod, "System.Void", "()"))
                        {
                            continue;
                        }
                        if (isEmptyClass(calledMethod))
                        {
                            callCounter.add(calledMethod);
                            count++;
                        }
                    }
                }
            }

            int numCalls;
            var theMethod = (MethodDef)callCounter.most(out numCalls);

            if (numCalls >= 10)
            {
                emptyMethod = theMethod;
            }
        }