public override void DeobfuscateBegin()
{
base.DeobfuscateBegin();
staticStringInliner.Add(stringDecrypter.Method, (method, gim, args) => stringDecrypter.Decrypt((string)args[0], (int)args[1]));
DeobfuscatedFile.StringDecryptersAdded();
}
void InitializeConstantsDecrypterV18()
{
if (hasInitializedConstantsDecrypter || constantsDecrypterV18 == null || !constantsDecrypterV18.Detected)
{
return;
}
hasInitializedConstantsDecrypter = true;
DecryptResources();
constantsDecrypterV18.Initialize();
int32ValueInliner = new Int32ValueInliner();
int64ValueInliner = new Int64ValueInliner();
singleValueInliner = new SingleValueInliner();
doubleValueInliner = new DoubleValueInliner();
foreach (var info in constantsDecrypterV18.Decrypters)
{
staticStringInliner.Add(info.method, (method, gim, args) => constantsDecrypterV18.DecryptString(method, gim, (uint)args[0], (ulong)args[1]));
int32ValueInliner.Add(info.method, (method, gim, args) => constantsDecrypterV18.DecryptInt32(method, gim, (uint)args[0], (ulong)args[1]));
int64ValueInliner.Add(info.method, (method, gim, args) => constantsDecrypterV18.DecryptInt64(method, gim, (uint)args[0], (ulong)args[1]));
singleValueInliner.Add(info.method, (method, gim, args) => constantsDecrypterV18.DecryptSingle(method, gim, (uint)args[0], (ulong)args[1]));
doubleValueInliner.Add(info.method, (method, gim, args) => constantsDecrypterV18.DecryptDouble(method, gim, (uint)args[0], (ulong)args[1]));
}
DeobfuscatedFile.StringDecryptersAdded();
AddTypesToBeRemoved(constantsDecrypterV18.Types, "Constants decrypter type");
AddFieldsToBeRemoved(constantsDecrypterV18.Fields, "Constants decrypter field");
AddMethodToBeRemoved(constantsDecrypterV18.NativeMethod, "Constants decrypter native method");
AddTypeToBeRemoved(constantsDecrypterV18.LzmaType, "LZMA type");
AddResourceToBeRemoved(constantsDecrypterV18.Resource, "Encrypted constants");
}
public override void DeobfuscateBegin()
{
base.DeobfuscateBegin();
if (options.RestoreFields)
{
fieldsRestorer = new FieldsRestorer(module);
fieldsRestorer.Initialize();
}
foreach (var method in stringDecrypter.DecrypterMethods)
{
staticStringInliner.Add(method, (method2, gim, args) => {
return(stringDecrypter.Decrypt(method2, args));
});
}
DeobfuscatedFile.StringDecryptersAdded();
resourceResolver.Initialize();
DecryptResources();
DumpEmbeddedAssemblies();
startedDeobfuscating = true;
}
public override void DeobfuscateBegin()
{
base.DeobfuscateBegin();
stringDecrypter = new StringDecrypter(decrypterInfo);
stringDecrypter.Find();
if (stringDecrypter.Detected)
{
stringDecrypter.Initialize(GetEncoding(options.StringCodePage));
staticStringInliner.Add(stringDecrypter.Method, (method, gim, args) => stringDecrypter.Decrypt((uint)args[0]));
DeobfuscatedFile.StringDecryptersAdded();
}
else
{
FreePEImage();
}
foreach (var method in mainType.InitMethods)
{
AddCctorInitCallToBeRemoved(method);
}
AddTypeToBeRemoved(mainType.Type, "Obfuscator type");
RemoveDuplicateEmbeddedResources();
RemoveInvalidResources();
}
public override void DeobfuscateBegin()
{
base.DeobfuscateBegin();
stringDecrypter.Initialize(DeobfuscatedFile);
staticStringInliner.Add(stringDecrypter.RealMethod, (method2, gim, args) => {
return(stringDecrypter.Decrypt((int)args[0]));
});
DeobfuscatedFile.StringDecryptersAdded();
assemblyResolver.Initialize(DeobfuscatedFile, this);
assemblyResolver.InitializeEmbeddedFiles();
AddModuleCctorInitCallToBeRemoved(assemblyResolver.InitMethod);
resourceResolver.Initialize(DeobfuscatedFile, this);
foreach (var info in resourceResolver.MergeResources())
{
AddResourceToBeRemoved(info.Resource, "Encrypted resources");
}
AddModuleCctorInitCallToBeRemoved(resourceResolver.InitMethod);
resourceMethodsRestorer = new ResourceMethodsRestorer(Module);
if ((Operations.RenamerFlags & (RenamerFlags.RenameTypes | RenamerFlags.RenameNamespaces)) != 0)
{
resourceMethodsRestorer.Find(DeobfuscatedFile, this);
}
DumpEmbeddedAssemblies();
}
public override void DeobfuscateBegin()
{
base.DeobfuscateBegin();
if (options.DecryptResources)
{
AddCctorInitCallToBeRemoved(resourceResolver.InitMethod);
AddTypeToBeRemoved(resourceResolver.Type, "Resource resolver type");
}
DecryptResources();
stringDecrypter.Initialize();
if (Operations.DecryptStrings != OpDecryptString.None)
{
if (stringDecrypter.Resource != null)
{
Logger.v("Adding string decrypter. Resource: {0}", Utils.ToCsharpString(stringDecrypter.Resource.Name));
}
staticStringInliner.Add(stringDecrypter.DecryptMethod, (method, gim, args) => {
return(stringDecrypter.Decrypt(args));
});
DeobfuscatedFile.StringDecryptersAdded();
}
if (options.DumpEmbeddedAssemblies)
{
assemblyResolver.Initialize(DeobfuscatedFile, this);
// Need to dump the assemblies before decrypting methods in case there's a reference
// in the encrypted code to one of these assemblies.
DumpEmbeddedAssemblies();
}
if (options.DecryptMethods)
{
methodsDecrypter.Initialize(DeobfuscatedFile, this);
methodsDecrypter.decrypt();
}
if (options.DecryptConstants)
{
constantsDecrypter.Initialize(DeobfuscatedFile, this);
AddTypeToBeRemoved(constantsDecrypter.Type, "Constants decrypter type");
AddResourceToBeRemoved(constantsDecrypter.Resource, "Encrypted constants");
int32ValueInliner = new Int32ValueInliner();
int32ValueInliner.Add(constantsDecrypter.Int32Decrypter, (method, gim, args) => constantsDecrypter.DecryptInt32((int)args[0]));
int64ValueInliner = new Int64ValueInliner();
int64ValueInliner.Add(constantsDecrypter.Int64Decrypter, (method, gim, args) => constantsDecrypter.DecryptInt64((int)args[0]));
singleValueInliner = new SingleValueInliner();
singleValueInliner.Add(constantsDecrypter.SingleDecrypter, (method, gim, args) => constantsDecrypter.DecryptSingle((int)args[0]));
doubleValueInliner = new DoubleValueInliner();
doubleValueInliner.Add(constantsDecrypter.DoubleDecrypter, (method, gim, args) => constantsDecrypter.DecryptDouble((int)args[0]));
}
proxyCallFixer.Find();
startedDeobfuscating = true;
}
public override void DeobfuscateBegin()
{
base.DeobfuscateBegin();
cliSecureRtType.FindStringDecrypterMethod();
stringDecrypter.AddDecrypterInfos(cliSecureRtType.StringDecrypterInfos);
stringDecrypter.Initialize();
AddAttributesToBeRemoved(cliSecureAttributes, "Obfuscator attribute");
if (options.DecryptResources)
{
DecryptResources(resourceDecrypter);
AddCctorInitCallToBeRemoved(resourceDecrypter.RsrcRrrMethod);
}
stackFrameHelper = new StackFrameHelper(Module);
stackFrameHelper.Find();
foreach (var type in Module.Types)
{
if (type.FullName == "InitializeDelegate" && DotNetUtils.DerivesFromDelegate(type))
{
this.AddTypeToBeRemoved(type, "Obfuscator type");
}
}
proxyCallFixer.Find();
foreach (var info in stringDecrypter.StringDecrypterInfos)
{
staticStringInliner.Add(info.Method, (method, gim, args) => stringDecrypter.Decrypt((string)args[0]));
}
DeobfuscatedFile.StringDecryptersAdded();
if (options.DecryptMethods)
{
AddCctorInitCallToBeRemoved(cliSecureRtType.InitializeMethod);
AddCctorInitCallToBeRemoved(cliSecureRtType.PostInitializeMethod);
FindPossibleNamesToRemove(cliSecureRtType.LoadMethod);
}
if (options.RestoreVmCode && (csvmV1.Detected || csvmV2.Detected))
{
if (csvmV1.Detected && csvmV1.Restore())
{
AddResourceToBeRemoved(csvmV1.Resource, "CSVM data resource");
}
else if (csvmV2.Detected && csvmV2.Restore())
{
AddResourceToBeRemoved(csvmV2.Resource, "CSVM data resource");
}
else
{
Logger.e("Couldn't restore VM methods. Use --dont-rename or it will not run");
PreserveTokensAndTypes();
}
}
}
public override void DeobfuscateBegin()
{
base.DeobfuscateBegin();
foreach (var info in stringDecrypter.StringDecrypterInfos)
{
staticStringInliner.Add(info.method, (method, gim, args) => stringDecrypter.Decrypt(method, (string)args[0], (int)args[1]));
}
DeobfuscatedFile.StringDecryptersAdded();
}
public override void DeobfuscateBegin()
{
base.DeobfuscateBegin();
proxyCallFixer = new ProxyCallFixer(Module);
proxyCallFixer.Find();
localsRestorer = new LocalsRestorer(Module);
if (options.RestoreLocals)
{
localsRestorer.Find();
}
logicalExpressionFixer = new LogicalExpressionFixer();
stringDecrypter.Initialize();
integerDecrypter.Initialize();
arrayDecrypter.Initialize();
if (options.DecryptIntegers)
{
int32ValueInliner = new Int32ValueInliner();
foreach (var method in integerDecrypter.GetMethods())
{
int32ValueInliner.Add(method, (method2, gim, args) => {
return(integerDecrypter.Decrypt(method2));
});
}
}
if (options.DecryptArrays)
{
arrayValueInliner = new ArrayValueInliner(Module, initializedDataCreator);
foreach (var method in arrayDecrypter.GetMethods())
{
arrayValueInliner.Add(method, (method2, gim, args) => {
return(arrayDecrypter.Decrypt(method2));
});
}
}
foreach (var method in stringDecrypter.GetMethods())
{
staticStringInliner.Add(method, (method2, gim, args) => {
return(stringDecrypter.Decrypt(method2));
});
DeobfuscatedFile.StringDecryptersAdded();
}
if (options.RemoveAntiStrongName)
{
AddTypeToBeRemoved(strongNameChecker.Type, "Strong name checker type");
}
startedDeobfuscating = true;
}
public override void DeobfuscateBegin()
{
base.DeobfuscateBegin();
staticStringInliner.Add(stringDecrypter.Method, (method, gim, args) => stringDecrypter.Decrypt((string)args[0]));
DeobfuscatedFile.StringDecryptersAdded();
proxyCallFixer.Find();
cfMethodCallInliner = new CfMethodCallInliner(proxyCallFixer);
DumpEmbeddedAssemblies();
}
void InitializeStringDecrypter()
{
if (hasInitializedStringDecrypter || stringDecrypter == null || !stringDecrypter.Detected)
{
return;
}
hasInitializedStringDecrypter = true;
DecryptResources();
stringDecrypter.Initialize();
staticStringInliner.Add(stringDecrypter.Method, (method, gim, args) => stringDecrypter.Decrypt(staticStringInliner.Method, (int)args[0]));
DeobfuscatedFile.StringDecryptersAdded();
}
void InitializeStringDecrypter()
{
if (hasInitializedStringDecrypter)
{
return;
}
stringDecrypter.Initialize(DeobfuscatedFile);
foreach (var info in stringDecrypter.Infos)
{
staticStringInliner.Add(info.Method, (method, gim, args) => stringDecrypter.Decrypt(method, (int)args[0], (int)args[1], (int)args[2]));
}
DeobfuscatedFile.StringDecryptersAdded();
hasInitializedStringDecrypter = true;
}
public override void DeobfuscateBegin()
{
base.DeobfuscateBegin();
AddTypeToBeRemoved(killType, "KILL type");
mainType.Initialize();
foreach (var initMethod in mainType.OtherInitMethods)
{
AddCctorInitCallToBeRemoved(initMethod);
AddCtorInitCallToBeRemoved(initMethod);
}
if (Operations.DecryptStrings != OpDecryptString.None)
{
stringDecrypter.Initialize();
staticStringInliner.Add(stringDecrypter.DecryptMethod, (method, gim, args) => {
return(stringDecrypter.Decrypt((int)args[0]));
});
DeobfuscatedFile.StringDecryptersAdded();
AddModuleCctorInitCallToBeRemoved(stringDecrypter.InitMethod);
AddCallToBeRemoved(mainType.GetInitStringDecrypterMethod(stringDecrypter.InitMethod), stringDecrypter.InitMethod);
}
assemblyResolver = new AssemblyResolver(module);
assemblyResolver.Initialize();
DumpEmbeddedAssemblies();
RemoveTamperDetection();
proxyCallFixer.Initialize();
proxyCallFixer.Find();
resourceDecrypter = new ResourceDecrypter(module);
resourceDecrypter.Initialize();
resourceDecrypter.Decrypt();
if (resourceDecrypter.CanRemoveTypes)
{
AddTypeToBeRemoved(resourceDecrypter.ResourceFlagsType, "Obfuscator ResourceFlags type");
AddTypeToBeRemoved(resourceDecrypter.ResType, "Obfuscator Res type");
AddTypeToBeRemoved(resourceDecrypter.ResourceEnumeratorType, "Obfuscator ResourceEnumerator type");
AddTypeToBeRemoved(resourceDecrypter.EncryptedResourceReaderType, "Obfuscator EncryptedResourceReader type");
AddTypeToBeRemoved(resourceDecrypter.EncryptedResourceSetType, "Obfuscator EncryptedResourceSet type");
AddTypeToBeRemoved(resourceDecrypter.EncryptedResourceStreamType, "Obfuscator EncryptedResourceStream type");
}
}
void Initialize(ConstantsDecrypterBase constDecrypter, ref bool hasInitialized)
{
if (hasInitialized || constDecrypter == null || !constDecrypter.Detected)
{
return;
}
hasInitializedConstantsDecrypter15 = true;
DecryptResources();
constDecrypter.Initialize();
int32ValueInliner = new Int32ValueInliner();
int64ValueInliner = new Int64ValueInliner();
singleValueInliner = new SingleValueInliner();
doubleValueInliner = new DoubleValueInliner();
foreach (var info in constDecrypter.DecrypterInfos)
{
staticStringInliner.Add(info.decryptMethod, (method, gim, args) => constDecrypter.DecryptString(staticStringInliner.Method, method, args));
int32ValueInliner.Add(info.decryptMethod, (method, gim, args) => constDecrypter.DecryptInt32(int32ValueInliner.Method, method, args));
int64ValueInliner.Add(info.decryptMethod, (method, gim, args) => constDecrypter.DecryptInt64(int64ValueInliner.Method, method, args));
singleValueInliner.Add(info.decryptMethod, (method, gim, args) => constDecrypter.DecryptSingle(singleValueInliner.Method, method, args));
doubleValueInliner.Add(info.decryptMethod, (method, gim, args) => constDecrypter.DecryptDouble(doubleValueInliner.Method, method, args));
}
int32ValueInliner.RemoveUnbox = true;
int64ValueInliner.RemoveUnbox = true;
singleValueInliner.RemoveUnbox = true;
doubleValueInliner.RemoveUnbox = true;
DeobfuscatedFile.StringDecryptersAdded();
AddFieldsToBeRemoved(constDecrypter.Fields, "Constants decrypter field");
var moduleType = DotNetUtils.GetModuleType(Module);
foreach (var info in constDecrypter.DecrypterInfos)
{
if (info.decryptMethod.DeclaringType == moduleType)
{
AddMethodToBeRemoved(info.decryptMethod, "Constants decrypter method");
}
else
{
AddTypeToBeRemoved(info.decryptMethod.DeclaringType, "Constants decrypter type");
}
}
AddMethodToBeRemoved(constDecrypter.NativeMethod, "Constants decrypter native method");
AddResourceToBeRemoved(constDecrypter.Resource, "Encrypted constants");
}
void InitStringDecrypter(StringDecrypterInfo info)
{
Logger.v("Adding string decrypter. Resource: {0}", Utils.ToCsharpString(info.StringsResource.Name));
var decrypter = new StringDecrypter(info);
if (decrypter.CanDecrypt)
{
var invokeMethod = info.GetStringDelegate?.FindMethod("Invoke");
staticStringInliner.Add(invokeMethod, (method, gim, args) => {
var fieldDef = DotNetUtils.GetField(module, (IField)args[0]);
return(decrypter.Decrypt(fieldDef.MDToken.ToInt32(), (int)args[1]));
});
staticStringInliner.Add(info.StringDecrypterMethod, (method, gim, args) => {
return(decrypter.Decrypt(0, (int)args[0]));
});
}
stringDecrypters.Add(decrypter);
DeobfuscatedFile.StringDecryptersAdded();
}
public override void DeobfuscateBegin()
{
base.DeobfuscateBegin();
methodCallInliner.Initialize(DeobfuscatedFile);
if (options.RestoreResourceNames)
{
resourceNamesRestorer = new ResourceNamesRestorer(Module);
resourceNamesRestorer.Find();
}
stringDecrypter.Initialize();
foreach (var info in stringDecrypter.DecrypterInfos)
{
staticStringInliner.Add(info.method, (method2, gim, args) => {
return(stringDecrypter.Decrypt(method2));
});
}
DeobfuscatedFile.StringDecryptersAdded();
startedDeobfuscating = true;
}
public override void DeobfuscateBegin()
{
base.DeobfuscateBegin();
antiStrongName = new AntiStrongName();
staticStringInliner.Add(decrypterType.StringDecrypter1, (method2, gim, args) => {
return(decrypterType.Decrypt1((string)args[0]));
});
staticStringInliner.Add(decrypterType.StringDecrypter2, (method2, gim, args) => {
return(decrypterType.Decrypt2((string)args[0]));
});
DeobfuscatedFile.StringDecryptersAdded();
libAssemblyResolver = new LibAssemblyResolver(module);
libAssemblyResolver.Find(DeobfuscatedFile, this);
if (Operations.DecryptStrings == OpDecryptString.None)
{
canRemoveDecrypterType = false;
}
RemoveInitCall(nativeLibSaver.InitMethod);
AddResourceToBeRemoved(nativeLibSaver.Resource, "Native lib resource");
AddTypeToBeRemoved(nativeLibSaver.Type, "Native lib saver type");
foreach (var initMethod in decrypterType.InitMethods)
{
RemoveInitCall(initMethod);
}
DumpUnpackedFiles();
DumpResourceFiles();
startedDeobfuscating = true;
}
public override void DeobfuscateBegin()
{
base.DeobfuscateBegin();
proxyCallFixer = new ProxyCallFixer(Module, DeobfuscatedFile);
proxyCallFixer.FindDelegateCreator();
proxyCallFixer.Find();
stringDecrypter.Initialize(peImage, fileData, DeobfuscatedFile);
if (!stringDecrypter.Detected)
{
FreePEImage();
}
booleanDecrypter.Initialize(fileData, DeobfuscatedFile);
booleanValueInliner = new BooleanValueInliner();
emptyClass = new EmptyClass(Module);
if (options.DecryptBools)
{
booleanValueInliner.Add(booleanDecrypter.Method, (method, gim, args) => {
return(booleanDecrypter.Decrypt((int)args[0]));
});
}
foreach (var info in stringDecrypter.DecrypterInfos)
{
staticStringInliner.Add(info.method, (method2, gim, args) => {
return(stringDecrypter.Decrypt(method2, (int)args[0]));
});
}
if (stringDecrypter.OtherStringDecrypter != null)
{
staticStringInliner.Add(stringDecrypter.OtherStringDecrypter, (method2, gim, args) => {
return(stringDecrypter.Decrypt((string)args[0]));
});
}
DeobfuscatedFile.StringDecryptersAdded();
metadataTokenObfuscator = new MetadataTokenObfuscator(Module);
antiStrongname = new AntiStrongName(GetDecrypterType());
bool removeResourceResolver = false;
if (options.DecryptResources)
{
resourceResolver.Initialize(DeobfuscatedFile, this);
DecryptResources();
if (options.InlineMethods)
{
AddTypeToBeRemoved(resourceResolver.Type, "Resource decrypter type");
removeResourceResolver = true;
}
AddEntryPointCallToBeRemoved(resourceResolver.InitMethod);
AddCctorInitCallToBeRemoved(resourceResolver.InitMethod);
}
if (resourceResolver.Detected && !removeResourceResolver && !resourceResolver.FoundResource)
{
canRemoveDecrypterType = false; // There may be calls to its .ctor
}
if (Operations.DecryptStrings != OpDecryptString.None)
{
AddResourceToBeRemoved(stringDecrypter.Resource, "Encrypted strings");
}
else
{
canRemoveDecrypterType = false;
}
if (options.DecryptMethods && !methodsDecrypter.HasNativeMethods)
{
AddResourceToBeRemoved(methodsDecrypter.Resource, "Encrypted methods");
AddCctorInitCallToBeRemoved(methodsDecrypter.Method);
}
else
{
canRemoveDecrypterType = false;
}
if (options.DecryptBools)
{
AddResourceToBeRemoved(booleanDecrypter.Resource, "Encrypted booleans");
}
else
{
canRemoveDecrypterType = false;
}
if (!options.RemoveAntiStrongName)
{
canRemoveDecrypterType = false;
}
// The inlined methods may contain calls to the decrypter class
if (!options.InlineMethods)
{
canRemoveDecrypterType = false;
}
if (options.DumpEmbeddedAssemblies)
{
if (options.InlineMethods)
{
AddTypeToBeRemoved(assemblyResolver.Type, "Assembly resolver");
}
AddEntryPointCallToBeRemoved(assemblyResolver.InitMethod);
AddCctorInitCallToBeRemoved(assemblyResolver.InitMethod);
DumpEmbeddedAssemblies();
}
if (options.InlineMethods)
{
AddTypeToBeRemoved(metadataTokenObfuscator.Type, "Metadata token obfuscator");
}
AddCctorInitCallToBeRemoved(emptyClass.Method);
AddCtorInitCallToBeRemoved(emptyClass.Method);
AddEntryPointCallToBeRemoved(emptyClass.Method);
if (options.InlineMethods)
{
AddTypeToBeRemoved(emptyClass.Type, "Empty class");
}
startedDeobfuscating = true;
}
public override void DeobfuscateBegin()
{
base.DeobfuscateBegin();
resourceDecrypter = new ResourceDecrypter(module, DeobfuscatedFile);
resourceResolver = new ResourceResolver(module, resourceDecrypter);
assemblyResolver = new AssemblyResolver(module);
resourceResolver.Find();
assemblyResolver.Find(DeobfuscatedFile);
DecryptResources();
stringDecrypter.Initialize(resourceDecrypter);
if (stringDecrypter.Method != null)
{
staticStringInliner.Add(stringDecrypter.Method, (method, gim, args) => {
return(stringDecrypter.Decrypt((int)args[0]));
});
DeobfuscatedFile.StringDecryptersAdded();
}
methodsDecrypter.Decrypt(resourceDecrypter, DeobfuscatedFile);
if (methodsDecrypter.Detected)
{
if (!assemblyResolver.Detected)
{
assemblyResolver.Find(DeobfuscatedFile);
}
if (!tamperDetection.Detected)
{
tamperDetection.Find();
}
}
antiDebugger = new AntiDebugger(module, DeobfuscatedFile, this);
antiDebugger.Find();
if (options.DecryptConstants)
{
constantsDecrypter.Initialize(resourceDecrypter);
int32ValueInliner = new Int32ValueInliner();
int32ValueInliner.Add(constantsDecrypter.Int32Decrypter, (method, gim, args) => constantsDecrypter.DecryptInt32((int)args[0]));
int64ValueInliner = new Int64ValueInliner();
int64ValueInliner.Add(constantsDecrypter.Int64Decrypter, (method, gim, args) => constantsDecrypter.DecryptInt64((int)args[0]));
singleValueInliner = new SingleValueInliner();
singleValueInliner.Add(constantsDecrypter.SingleDecrypter, (method, gim, args) => constantsDecrypter.DecryptSingle((int)args[0]));
doubleValueInliner = new DoubleValueInliner();
doubleValueInliner.Add(constantsDecrypter.DoubleDecrypter, (method, gim, args) => constantsDecrypter.DecryptDouble((int)args[0]));
AddTypeToBeRemoved(constantsDecrypter.Type, "Constants decrypter type");
AddResourceToBeRemoved(constantsDecrypter.Resource, "Encrypted constants");
}
AddModuleCctorInitCallToBeRemoved(resourceResolver.Method);
AddModuleCctorInitCallToBeRemoved(assemblyResolver.Method);
AddCallToBeRemoved(module.EntryPoint, tamperDetection.Method);
AddModuleCctorInitCallToBeRemoved(tamperDetection.Method);
AddCallToBeRemoved(module.EntryPoint, antiDebugger.Method);
AddModuleCctorInitCallToBeRemoved(antiDebugger.Method);
AddTypeToBeRemoved(resourceResolver.Type, "Resource resolver type");
AddTypeToBeRemoved(assemblyResolver.Type, "Assembly resolver type");
AddTypeToBeRemoved(tamperDetection.Type, "Tamper detection type");
AddTypeToBeRemoved(antiDebugger.Type, "Anti-debugger type");
AddTypeToBeRemoved(methodsDecrypter.Type, "Methods decrypter type");
AddTypesToBeRemoved(methodsDecrypter.DelegateTypes, "Methods decrypter delegate type");
AddResourceToBeRemoved(methodsDecrypter.Resource, "Encrypted methods");
proxyCallFixer.Find();
DumpEmbeddedAssemblies();
startedDeobfuscating = true;
}
