コード例 #1
0
        public void Initialize(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
        {
            if (resolverType == null)
            {
                return;
            }

            encryptedResource = BabelUtils.FindEmbeddedResource(module, resolverType, simpleDeobfuscator, deob);
            if (encryptedResource == null)
            {
                Logger.w("Could not find embedded assemblies resource");
                return;
            }

            var decrypted     = resourceDecrypter.Decrypt(encryptedResource.GetReader().ToArray());
            var reader        = new BinaryReader(new MemoryStream(decrypted));
            int numAssemblies = reader.ReadInt32();

            embeddedAssemblyInfos = new EmbeddedAssemblyInfo[numAssemblies];
            for (int i = 0; i < numAssemblies; i++)
            {
                string name = reader.ReadString();
                var    data = reader.ReadBytes(reader.ReadInt32());
                var    mod  = ModuleDefMD.Load(data);
                embeddedAssemblyInfos[i] = new EmbeddedAssemblyInfo(name, DeobUtils.GetExtension(mod.Kind), data);
            }
        }
コード例 #2
0
        private static IEnumerable <EmbeddedAssemblyInfo> EnumerateEmbeddedAssemblies(string text)
        {
            var split = text.Split(',');

            for (var i = 0; i < split.Length; i += 4)
            {
                var b64     = split[i];
                var resName = split[i + 1];
                var asm     = new EmbeddedAssemblyInfo {
                    FullnameBase64 = b64
                };

                //check flags
                var posPipe = resName.IndexOf('|');
                if (posPipe >= 0)
                {
                    var flags = resName.Substring(0, posPipe);
                    resName = resName.Substring(posPipe + 1);

                    asm.Encrypted        = flags.IndexOf('a') != -1;
                    asm.Prefixed         = flags.IndexOf('b') != -1;
                    asm.MustLoadfromDisk = flags.IndexOf('c') != -1;
                }

                asm.ResourceName   = resName;
                asm.FilenameBase64 = split[i + 2];

                yield return(asm);
            }
        }
コード例 #3
0
        public void initialize(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
        {
            if (resolverType == null)
                return;

            encryptedResource = BabelUtils.findEmbeddedResource(module, resolverType, simpleDeobfuscator, deob);
            if (encryptedResource == null) {
                Logger.w("Could not find embedded assemblies resource");
                return;
            }

            var decrypted = resourceDecrypter.decrypt(encryptedResource.Data.ReadAllBytes());
            var reader = new BinaryReader(new MemoryStream(decrypted));
            int numAssemblies = reader.ReadInt32();
            embeddedAssemblyInfos = new EmbeddedAssemblyInfo[numAssemblies];
            for (int i = 0; i < numAssemblies; i++) {
                string name = reader.ReadString();
                var data = reader.ReadBytes(reader.ReadInt32());
                var mod = ModuleDefMD.Load(data);
                embeddedAssemblyInfos[i] = new EmbeddedAssemblyInfo(name, DeobUtils.getExtension(mod.Kind), data);
            }
        }