void DumpEmbeddedAssemblies()
{
foreach (var info in assemblyResolver.AssemblyInfos)
{
DeobfuscatedFile.CreateAssemblyFile(info.Data, info.SimpleName, info.Extension);
AddResourceToBeRemoved(info.Resource, string.Format("Embedded assembly: {0}", info.AssemblyFullName));
}
}
void DumpUnpackedFiles()
{
foreach (var unpackedFile in unpackedFiles)
{
DeobfuscatedFile.CreateAssemblyFile(unpackedFile.data,
Win32Path.GetFileNameWithoutExtension(unpackedFile.filename),
Win32Path.GetExtension(unpackedFile.filename));
}
}
void DumpEmbeddedAssemblies()
{
assemblyResolver.ResolveResources();
foreach (var tuple in assemblyResolver.GetDecryptedResources())
{
DeobfuscatedFile.CreateAssemblyFile(tuple.Item2, tuple.Item1.simpleName, null);
AddResourceToBeRemoved(tuple.Item1.resource, $"Embedded assembly: {tuple.Item1.assemblyName}");
}
}
void DumpEmbeddedAssemblies()
{
foreach (var info in assemblyResolver.AssemblyInfos)
{
DeobfuscatedFile.CreateAssemblyFile(info.data, info.simpleName, info.extension);
}
AddResourceToBeRemoved(assemblyResolver.BundleDataResource, "Embedded assemblies resource");
AddResourceToBeRemoved(assemblyResolver.BundleXmlFileResource, "Embedded assemblies XML file resource");
AddTypesToBeRemoved(assemblyResolver.BundleTypes, "Obfuscator assembly bundle types");
}
void DumpEmbeddedAssemblies()
{
if (!options.DumpEmbeddedAssemblies)
{
return;
}
foreach (var info in assemblyResolver.GetEmbeddedAssemblies(DeobfuscatedFile, this))
{
var simpleName = Utils.GetAssemblySimpleName(info.name);
DeobfuscatedFile.CreateAssemblyFile(info.resource.GetResourceData(), simpleName, null);
AddResourceToBeRemoved(info.resource, string.Format("Embedded assembly: {0}", info.name));
}
}
void DumpEmbeddedAssemblies()
{
if (!options.DumpEmbeddedAssemblies)
{
return;
}
foreach (var info in assemblyResolver.GetEmbeddedAssemblies(DeobfuscatedFile, this))
{
var simpleName = Utils.GetAssemblySimpleName(info.name);
DeobfuscatedFile.CreateAssemblyFile(info.resource.CreateReader().ToArray(), simpleName, null);
AddResourceToBeRemoved(info.resource, $"Embedded assembly: {info.name}");
}
}
void DumpEmbeddedAssemblies()
{
if (!options.DumpEmbeddedAssemblies)
{
return;
}
foreach (var info in assemblyResolver.EmbeddedAssemblyInfos)
{
DeobfuscatedFile.CreateAssemblyFile(info.data, Utils.GetAssemblySimpleName(info.fullname), info.extension);
}
AddTypeToBeRemoved(assemblyResolver.Type, "Assembly resolver type");
AddCctorInitCallToBeRemoved(assemblyResolver.InitMethod);
AddResourceToBeRemoved(assemblyResolver.EncryptedResource, "Embedded encrypted assemblies");
}
void DumpResourceFiles()
{
foreach (var resource in libAssemblyResolver.Resources)
{
var mod = ModuleDefMD.Load(resource.Data.ReadAllBytes());
AddResourceToBeRemoved(resource, string.Format("Embedded assembly: {0}", mod.Assembly.FullName));
DeobfuscatedFile.CreateAssemblyFile(resource.GetResourceData(),
Utils.GetAssemblySimpleName(mod.Assembly.FullName),
DeobUtils.GetExtension(mod.Kind));
}
RemoveInitCall(libAssemblyResolver.InitMethod);
AddCallToBeRemoved(module.EntryPoint, libAssemblyResolver.InitMethod);
AddTypeToBeRemoved(libAssemblyResolver.Type, "Assembly resolver type (library mode)");
}
void DumpEmbeddedAssemblies()
{
if (assemblyDecrypter.MainAssemblyHasAssemblyResolver && !options.DumpEmbeddedAssemblies)
{
return;
}
foreach (var info in assemblyDecrypter.GetAssemblyInfos(DeobfuscatedFile, this))
{
DeobfuscatedFile.CreateAssemblyFile(info.data, info.asmSimpleName, info.extension);
AddResourceToBeRemoved(info.resource, string.Format("Embedded assembly: {0}", info.asmFullName));
}
AddCctorInitCallToBeRemoved(assemblyDecrypter.InitMethod);
AddCallToBeRemoved(module.EntryPoint, assemblyDecrypter.InitMethod);
AddTypeToBeRemoved(assemblyDecrypter.Type, "Assembly resolver type");
}
void DumpEmbeddedAssemblies()
{
if (assemblyDecrypter == null)
{
return;
}
foreach (var info in assemblyDecrypter.AssemblyInfos)
{
var asmName = info.assemblySimpleName;
if (info.isEntryPointAssembly)
{
asmName += "_real";
}
DeobfuscatedFile.CreateAssemblyFile(info.data, asmName, info.extension);
}
}
void DumpEmbeddedAssemblies()
{
if (mainAsmInfo != null)
{
var asm = Module.Assembly;
var name = (asm == null ? Module.Name : asm.Name).String;
DeobfuscatedFile.CreateAssemblyFile(mainAsmInfo.data, name + "_real", mainAsmInfo.extension);
AddResourceToBeRemoved(mainAsmInfo.resource, string.Format("Embedded assembly: {0}", mainAsmInfo.asmFullName));
}
foreach (var info in embeddedAssemblyInfos)
{
if (Module.Assembly == null || info.asmFullName != Module.Assembly.FullName)
{
DeobfuscatedFile.CreateAssemblyFile(info.data, info.asmSimpleName, info.extension);
}
AddResourceToBeRemoved(info.resource, string.Format("Embedded assembly: {0}", info.asmFullName));
}
embeddedAssemblyInfos.Clear();
}
void DumpEmbeddedAssemblies()
{
if (!options.DumpEmbeddedAssemblies)
{
return;
}
foreach (var info in assemblyResolver.GetAssemblyInfos())
{
if (info.resource != null && info.resource == resourceResolver.Resource)
{
continue;
}
DeobfuscatedFile.CreateAssemblyFile(info.data, info.simpleName, info.extension);
AddResourceToBeRemoved(info.resource, $"Embedded assembly: {info.fullName}");
}
AddCctorInitCallToBeRemoved(assemblyResolver.InitMethod);
AddCallToBeRemoved(module.EntryPoint, assemblyResolver.InitMethod);
AddMethodToBeRemoved(assemblyResolver.InitMethod, "Assembly resolver init method");
AddMethodToBeRemoved(assemblyResolver.HandlerMethod, "Assembly resolver handler method");
AddMethodToBeRemoved(assemblyResolver.DecryptMethod, "Assembly resolver decrypt method");
}
void DumpEmbeddedFile(EmbeddedResource resource, string assemblyName, string extension, string reason)
{
DeobfuscatedFile.CreateAssemblyFile(resourceDecrypter.Decrypt(resource.GetResourceStream()), Utils.GetAssemblySimpleName(assemblyName), extension);
AddResourceToBeRemoved(resource, reason);
}
