protected override bool CheckHandlerMethodDesktopInternal(MethodDef handler) { if (CheckHandlerV3(handler)) { version = ResourceVersion.V3; return true; } simpleDeobfuscator.Deobfuscate(handler); if ((data40 = CheckHandlerV40(handler)) != null) { version = ResourceVersion.V40; return true; } var info = GetHandlerArgs41(handler); Data41 data41Tmp; if (info != null && CheckHandlerV41(info, out data41Tmp)) { version = ResourceVersion.V41; data41 = data41Tmp; return true; } return false; }
static Data40 CheckHandlerV40(MethodDef handler) { var data40 = new Data40(); var instrs = handler.Body.Instructions; for (int i = 0; i < instrs.Count; i++) { int index = i; if (instrs[index++].OpCode.Code != Code.Ldarg_1) continue; var ldtoken = instrs[index++]; if (ldtoken.OpCode.Code != Code.Ldtoken) continue; var field = ldtoken.Operand as FieldDef; string methodSig = "(System.ResolveEventArgs,System.RuntimeFieldHandle,System.Int32,System.String,System.Int32)"; var method = ldtoken.Operand as MethodDef; if (method != null) { // >= 4.0.4 if (!DotNetUtils.IsMethod(method, "System.Byte[]", "()")) continue; field = GetResourceField(method); methodSig = "(System.ResolveEventArgs,System.RuntimeMethodHandle,System.Int32,System.String,System.Int32)"; } else { // 4.0.1.18 .. 4.0.3 } if (field == null || field.InitialValue == null || field.InitialValue.Length == 0) continue; var ldci4_len = instrs[index++]; if (!ldci4_len.IsLdcI4()) continue; if (ldci4_len.GetLdcI4Value() != field.InitialValue.Length) continue; if (instrs[index++].OpCode.Code != Code.Ldstr) continue; var ldci4_magic = instrs[index++]; if (!ldci4_magic.IsLdcI4()) continue; data40.magic = ldci4_magic.GetLdcI4Value(); var call = instrs[index++]; if (call.OpCode.Code == Code.Tailcall) call = instrs[index++]; if (call.OpCode.Code != Code.Call) continue; var resolveHandler2 = call.Operand as MethodDef; if (!DotNetUtils.IsMethod(resolveHandler2, "System.Reflection.Assembly", methodSig)) continue; data40.resourceField = field; data40.getDataMethod = method; data40.resolveHandler2 = resolveHandler2; return data40; } return null; }