コード例 #1
0
 void dumpEmbeddedAssemblies()
 {
     foreach (var info in assemblyResolver.AssemblyInfos)
     {
         DeobfuscatedFile.createAssemblyFile(info.Data, info.SimpleName, info.Extension);
         addResourceToBeRemoved(info.Resource, string.Format("Embedded assembly: {0}", info.AssemblyFullName));
     }
 }
コード例 #2
0
 void dumpUnpackedFiles()
 {
     foreach (var unpackedFile in unpackedFiles)
     {
         DeobfuscatedFile.createAssemblyFile(unpackedFile.data,
                                             Win32Path.GetFileNameWithoutExtension(unpackedFile.filename),
                                             Win32Path.GetExtension(unpackedFile.filename));
     }
 }
コード例 #3
0
 void dumpEmbeddedAssemblies()
 {
     assemblyResolver.resolveResources();
     foreach (var tuple in assemblyResolver.getDecryptedResources())
     {
         DeobfuscatedFile.createAssemblyFile(tuple.Item2, tuple.Item1.simpleName);
         addResourceToBeRemoved(tuple.Item1.resource, string.Format("Embedded assembly: {0}", tuple.Item1.assemblyName));
     }
 }
コード例 #4
0
ファイル: Deobfuscator.cs プロジェクト: kidhudi/de4dot
 void dumpEmbeddedAssemblies()
 {
     foreach (var info in assemblyResolver.AssemblyInfos)
     {
         DeobfuscatedFile.createAssemblyFile(info.data, info.simpleName, info.extension);
     }
     addResourceToBeRemoved(assemblyResolver.BundleDataResource, "Embedded assemblies resource");
     addResourceToBeRemoved(assemblyResolver.BundleXmlFileResource, "Embedded assemblies XML file resource");
     addTypesToBeRemoved(assemblyResolver.BundleTypes, "Obfuscator assembly bundle types");
 }
コード例 #5
0
ファイル: Deobfuscator.cs プロジェクト: kidhudi/de4dot
 void dumpEmbeddedAssemblies()
 {
     if (!options.DumpEmbeddedAssemblies)
     {
         return;
     }
     foreach (var info in assemblyResolver.getEmbeddedAssemblies(DeobfuscatedFile, this))
     {
         var simpleName = Utils.getAssemblySimpleName(info.name);
         DeobfuscatedFile.createAssemblyFile(info.resource.GetResourceData(), simpleName, null);
         addResourceToBeRemoved(info.resource, string.Format("Embedded assembly: {0}", info.name));
     }
 }
コード例 #6
0
 void dumpResourceFiles()
 {
     foreach (var resource in libAssemblyResolver.Resources)
     {
         var mod = ModuleDefinition.ReadModule(resource.GetResourceStream());
         addResourceToBeRemoved(resource, string.Format("Embedded assembly: {0}", mod.Assembly.FullName));
         DeobfuscatedFile.createAssemblyFile(resource.GetResourceData(),
                                             Utils.getAssemblySimpleName(mod.Assembly.FullName),
                                             DeobUtils.getExtension(mod.Kind));
     }
     removeInitCall(libAssemblyResolver.InitMethod);
     addCallToBeRemoved(module.EntryPoint, libAssemblyResolver.InitMethod);
     addTypeToBeRemoved(libAssemblyResolver.Type, "Assembly resolver type (library mode)");
 }
コード例 #7
0
 void dumpEmbeddedAssemblies()
 {
     if (!options.DumpEmbeddedAssemblies)
     {
         return;
     }
     foreach (var info in assemblyResolver.EmbeddedAssemblyInfos)
     {
         DeobfuscatedFile.createAssemblyFile(info.data, Utils.getAssemblySimpleName(info.fullname), info.extension);
     }
     addTypeToBeRemoved(assemblyResolver.Type, "Assembly resolver type");
     addCctorInitCallToBeRemoved(assemblyResolver.InitMethod);
     addResourceToBeRemoved(assemblyResolver.EncryptedResource, "Embedded encrypted assemblies");
 }
コード例 #8
0
 void dumpEmbeddedAssemblies()
 {
     if (assemblyDecrypter.MainAssemblyHasAssemblyResolver && !options.DumpEmbeddedAssemblies)
     {
         return;
     }
     foreach (var info in assemblyDecrypter.getAssemblyInfos(DeobfuscatedFile, this))
     {
         DeobfuscatedFile.createAssemblyFile(info.data, info.asmSimpleName, info.extension);
         addResourceToBeRemoved(info.resource, string.Format("Embedded assembly: {0}", info.asmFullName));
     }
     addCctorInitCallToBeRemoved(assemblyDecrypter.InitMethod);
     addCallToBeRemoved(module.EntryPoint, assemblyDecrypter.InitMethod);
     addTypeToBeRemoved(assemblyDecrypter.Type, "Assembly resolver type");
 }
コード例 #9
0
 void dumpEmbeddedAssemblies()
 {
     if (assemblyDecrypter == null)
     {
         return;
     }
     foreach (var info in assemblyDecrypter.AssemblyInfos)
     {
         var asmName = info.assemblySimpleName;
         if (info.isEntryPointAssembly)
         {
             asmName += "_real";
         }
         DeobfuscatedFile.createAssemblyFile(info.data, asmName, info.extension);
     }
 }
コード例 #10
0
 void dumpEmbeddedAssemblies()
 {
     if (!options.DumpEmbeddedAssemblies)
     {
         return;
     }
     foreach (var info in assemblyResolver.getAssemblyInfos())
     {
         if (info.resource != null && info.resource == resourceResolver.Resource)
         {
             continue;
         }
         DeobfuscatedFile.createAssemblyFile(info.data, info.simpleName, info.extension);
         addResourceToBeRemoved(info.resource, string.Format("Embedded assembly: {0}", info.fullName));
     }
     addCctorInitCallToBeRemoved(assemblyResolver.InitMethod);
     addCallToBeRemoved(module.EntryPoint, assemblyResolver.InitMethod);
     addMethodToBeRemoved(assemblyResolver.InitMethod, "Assembly resolver init method");
     addMethodToBeRemoved(assemblyResolver.HandlerMethod, "Assembly resolver handler method");
 }
コード例 #11
0
 void dumpEmbeddedFile(EmbeddedResource resource, string assemblyName, string extension, string reason)
 {
     DeobfuscatedFile.createAssemblyFile(resourceDecrypter.decrypt(resource.GetResourceStream()), Utils.getAssemblySimpleName(assemblyName), extension);
     addResourceToBeRemoved(resource, reason);
 }