protected ProxyCallFixer1(ModuleDefMD module, ProxyCallFixer1 oldOne) : base(module, oldOne) { foreach (var key in oldOne.fieldToDelegateInfo.GetKeys()) { fieldToDelegateInfo.Add(Lookup(key, "Could not find field"), Copy(oldOne.fieldToDelegateInfo.Find(key))); } }
protected ProxyCallFixer4(ModuleDefMD module, ProxyCallFixer4 oldOne) : base(module, oldOne) { foreach (var key in oldOne.fieldToDelegateInfo.GetKeys()) { fieldToDelegateInfo.Add(Lookup(key, "Could not find field"), Copy(oldOne.fieldToDelegateInfo.Find(key))); } foreach (var oldMethod in oldOne.proxyMethodToDelegateInfo.GetKeys()) { var oldDi = oldOne.proxyMethodToDelegateInfo.Find(oldMethod); var method = Lookup(oldMethod, "Could not find proxy method"); proxyMethodToDelegateInfo.Add(method, Copy(oldDi)); } }
protected override object CheckCctor(TypeDef type, MethodDef cctor) { // Here if 1.2 r54564 (almost 1.3) or later var fieldToInfo = new FieldDefAndDeclaringTypeDict<DelegateInitInfo>(); var instrs = cctor.Body.Instructions; for (int i = 0; i < instrs.Count - 1; i++) { var ldtoken = instrs[i]; if (ldtoken.OpCode.Code != Code.Ldtoken) continue; var field = ldtoken.Operand as FieldDef; if (field == null || field.DeclaringType != cctor.DeclaringType) continue; var call = instrs[i + 1]; if (call.OpCode.Code != Code.Call) continue; var calledMethod = call.Operand as MethodDef; if (calledMethod == null) continue; if (!IsDelegateCreatorMethod(calledMethod)) continue; var info = methodToInfo.Find(calledMethod); if (info == null) continue; i++; fieldToInfo.Add(field, new DelegateInitInfo(field, calledMethod)); } return fieldToInfo.Count == 0 ? null : fieldToInfo; }
static internal IEnumerable <FieldDef> GetFields(TypeDef type) { var typeFields = new FieldDefAndDeclaringTypeDict <FieldDef>(); foreach (var field in type.Fields) { typeFields.Add(field, field); } var realFields = new Dictionary <FieldDef, bool>(); foreach (var method in type.Methods) { if (method.Body == null) { continue; } foreach (var instr in method.Body.Instructions) { var fieldRef = instr.Operand as IField; if (fieldRef == null) { continue; } var field = typeFields.Find(fieldRef); if (field == null) { continue; } realFields[field] = true; } } return(realFields.Keys); }
public void Initialize() { foreach (var kv in GetMovedTypes()) { var structType = kv.Key; structToOwners.Add(structType, kv.Value); foreach (var ownerType in kv.Value) { foreach (var ownerField in ownerType.Fields) { if (DotNetUtils.GetType(module, ownerField.FieldSig.GetFieldType()) != structType) { continue; } structFieldsToFix.Add(ownerField, true); break; } var fieldsDict = new FieldDefAndDeclaringTypeDict <FieldDef>(); typeToFieldsDict.Add(ownerType, fieldsDict); foreach (var structField in structType.Fields) { var newField = module.UpdateRowId(new FieldDefUser(structField.Name, structField.FieldSig.Clone(), structField.Attributes)); ownerType.Fields.Add(newField); fieldsDict.Add(structField, newField); } } } }
static short[] FindKey(MethodDef initMethod, FieldDef keyField) { var fields = new FieldDefAndDeclaringTypeDict <bool>(); fields.Add(keyField, true); return(FindKey(initMethod, fields)); }
FieldDefAndDeclaringTypeDict<FieldDef> FindFieldTypes() { var dict = new FieldDefAndDeclaringTypeDict<FieldDef>(); foreach (var type in module.GetTypes()) { foreach (var method in type.Methods) { var body = method.Body; if (body == null) continue; foreach (var instr in body.Instructions) { if (instr.OpCode.Code != Code.Ldsfld) continue; var field = instr.Operand as FieldDef; if (field == null) continue; var declType = field.DeclaringType; if (declType == null) continue; if (!InlinedMethodTypes.IsValidFieldType(declType)) continue; dict.Add(field, field); } } } return dict; }
FieldDefAndDeclaringTypeDict<DelegateInitInfo> CreateDelegateInitInfos_v10_r42915(MethodDef method) { var infos = new FieldDefAndDeclaringTypeDict<DelegateInitInfo>(); var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count - 2; i++) { var ldstr = instrs[i]; if (ldstr.OpCode.Code != Code.Ldstr) continue; var info = ldstr.Operand as string; if (info == null) continue; var ldtoken = instrs[i + 1]; if (ldtoken.OpCode.Code != Code.Ldtoken) continue; var delegateField = ldtoken.Operand as FieldDef; if (delegateField == null) continue; var delegateType = delegateField.FieldType.TryGetTypeDef(); if (!DotNetUtils.DerivesFromDelegate(delegateType)) continue; var call = instrs[i + 2]; if (call.OpCode.Code != Code.Call) continue; var delegateCreatorMethod = call.Operand as MethodDef; if (delegateCreatorMethod == null || !IsDelegateCreatorMethod(delegateCreatorMethod)) continue; infos.Add(delegateField, new DelegateInitInfo(info, delegateField, delegateCreatorMethod)); i += 2; } return infos; }
protected bool Add(FieldDef field) { if (field == null) { return(false); } fields.Add(field, true); return(true); }
bool InitializeArrays2(ISimpleDeobfuscator simpleDeobfuscator, MethodDef method) { bool foundField = false; simpleDeobfuscator.Deobfuscate(method, true); var instructions = method.Body.Instructions; for (int i = 0; i < instructions.Count; i++) { var ldci4 = instructions[i]; if (!ldci4.IsLdcI4()) { continue; } i++; var instrs = DotNetUtils.GetInstructions(instructions, i, OpCodes.Newarr, OpCodes.Dup, OpCodes.Ldtoken, OpCodes.Call, OpCodes.Stsfld); if (instrs == null) { continue; } var arrayInitField = instrs[2].Operand as FieldDef; if (arrayInitField == null || arrayInitField.InitialValue == null || arrayInitField.InitialValue.Length == 0) { continue; } var calledMethod = instrs[3].Operand as IMethod; if (calledMethod == null || calledMethod.FullName != "System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)") { continue; } var targetField = instrs[4].Operand as FieldDef; if (targetField == null || targetField.FieldType.GetElementType() != ElementType.SZArray) { continue; } var etype = ((SZArraySig)targetField.FieldType).Next.GetElementType(); if (etype < ElementType.Boolean || etype > ElementType.U4) { continue; } if (fieldToInfo.Find(targetField) == null) { fieldToInfo.Add(targetField, new FieldInfo(targetField, arrayInitField)); foundField = true; } } return(foundField); }
public void Initialize(ISimpleDeobfuscator deobfuscator) { if (decrypterCctor == null) { return; } deobfuscator.Deobfuscate(decrypterCctor); var instrs = decrypterCctor.Body.Instructions; for (int i = 0; i < instrs.Count - 4; i++) { var ldstr = instrs[i]; if (ldstr.OpCode.Code != Code.Ldstr) { continue; } var encryptedString = ldstr.Operand as string; if (encryptedString == null) { continue; } if (instrs[i + 1].OpCode.Code != Code.Stsfld) { continue; } if (instrs[i + 2].OpCode.Code != Code.Ldsfld) { continue; } if (instrs[i + 3].OpCode.Code != Code.Call) { continue; } if (instrs[i + 4].OpCode.Code != Code.Stsfld) { continue; } var field = instrs[i + 4].Operand as FieldDef; if (field == null) { continue; } if (!new SigComparer().Equals(field.DeclaringType, decrypterType)) { continue; } fieldToDecryptedString.Add(field, decrypter.Decrypt(encryptedString)); } }
static FieldDefAndDeclaringTypeDict<List<MethodDef>> CreateFieldToMethodsDictionary(TypeDef type) { var dict = new FieldDefAndDeclaringTypeDict<List<MethodDef>>(); foreach (var method in type.Methods) { if (!method.IsStatic || method.Body == null || method.Name == ".cctor") continue; var delegateField = GetDelegateField(method); if (delegateField == null) continue; var methods = dict.Find(delegateField); if (methods == null) dict.Add(delegateField, methods = new List<MethodDef>()); methods.Add(method); } return dict; }
void InitType(TypeDef type) { var cctor = type.FindStaticConstructor(); if (cctor == null) { return; } var info = GetStringInfo(cctor); if (info == null) { return; } stringInfos.Add(info.field, info); }
// Find the string decrypter string offset value or null if none found int?FindOffsetValue(MethodDef method) { var fieldDict = new FieldDefAndDeclaringTypeDict <IField>(); foreach (var field in method.DeclaringType.Fields) { fieldDict.Add(field, field); } var offsetField = FindOffsetField(method); if (offsetField == null) { return(null); } return(FindOffsetValue(method, (FieldDef)fieldDict.Find(offsetField), fieldDict)); }
public void InitializeEventHandlerNames() { var ourFields = new FieldDefAndDeclaringTypeDict <MFieldDef>(); foreach (var fieldDef in type.AllFields) { ourFields.Add(fieldDef.FieldDef, fieldDef); } var ourMethods = new MethodDefAndDeclaringTypeDict <MMethodDef>(); foreach (var methodDef in type.AllMethods) { ourMethods.Add(methodDef.MethodDef, methodDef); } InitVbEventHandlers(ourFields, ourMethods); InitFieldEventHandlers(ourFields, ourMethods); InitTypeEventHandlers(ourFields, ourMethods); }
static internal IEnumerable<FieldDef> GetFields(TypeDef type) { var typeFields = new FieldDefAndDeclaringTypeDict<FieldDef>(); foreach (var field in type.Fields) typeFields.Add(field, field); var realFields = new Dictionary<FieldDef, bool>(); foreach (var method in type.Methods) { if (method.Body == null) continue; foreach (var instr in method.Body.Instructions) { var fieldRef = instr.Operand as IField; if (fieldRef == null) continue; var field = typeFields.Find(fieldRef); if (field == null) continue; realFields[field] = true; } } return realFields.Keys; }
FieldDefAndDeclaringTypeDict <FieldDef> FindFieldTypes() { var dict = new FieldDefAndDeclaringTypeDict <FieldDef>(); foreach (var type in module.GetTypes()) { foreach (var method in type.Methods) { var body = method.Body; if (body == null) { continue; } foreach (var instr in body.Instructions) { if (instr.OpCode.Code != Code.Ldsfld) { continue; } var field = instr.Operand as FieldDef; if (field == null) { continue; } var declType = field.DeclaringType; if (declType == null) { continue; } if (!InlinedMethodTypes.IsValidFieldType(declType)) { continue; } dict.Add(field, field); } } } return(dict); }
static FieldDefAndDeclaringTypeDict <bool> GetFields(MethodDef method) { var fields = new FieldDefAndDeclaringTypeDict <bool>(); foreach (var instr in method.Body.Instructions) { if (instr.OpCode.Code != Code.Ldsfld && instr.OpCode.Code != Code.Stsfld) { continue; } var field = instr.Operand as FieldDef; if (field == null) { continue; } if (field.DeclaringType != method.DeclaringType) { continue; } fields.Add(field, true); } return(fields); }
public void Initialize() { foreach (var kv in GetMovedTypes()) { var structType = kv.Key; structToOwners.Add(structType, kv.Value); foreach (var ownerType in kv.Value) { foreach (var ownerField in ownerType.Fields) { if (DotNetUtils.GetType(module, ownerField.FieldSig.GetFieldType()) != structType) continue; structFieldsToFix.Add(ownerField, true); break; } var fieldsDict = new FieldDefAndDeclaringTypeDict<FieldDef>(); typeToFieldsDict.Add(ownerType, fieldsDict); foreach (var structField in structType.Fields) { var newField = module.UpdateRowId(new FieldDefUser(structField.Name, structField.FieldSig.Clone(), structField.Attributes)); ownerType.Fields.Add(newField); fieldsDict.Add(structField, newField); } } } }
// Find the string decrypter string offset value or null if none found int? FindOffsetValue(MethodDef method) { var fieldDict = new FieldDefAndDeclaringTypeDict<IField>(); foreach (var field in method.DeclaringType.Fields) fieldDict.Add(field, field); var offsetField = FindOffsetField(method); if (offsetField == null) return null; return FindOffsetValue(method, (FieldDef)fieldDict.Find(offsetField), fieldDict); }
public void InitializeEventHandlerNames() { var ourFields = new FieldDefAndDeclaringTypeDict<MFieldDef>(); foreach (var fieldDef in type.AllFields) ourFields.Add(fieldDef.FieldDef, fieldDef); var ourMethods = new MethodDefAndDeclaringTypeDict<MMethodDef>(); foreach (var methodDef in type.AllMethods) ourMethods.Add(methodDef.MethodDef, methodDef); InitVbEventHandlers(ourFields, ourMethods); InitFieldEventHandlers(ourFields, ourMethods); InitTypeEventHandlers(ourFields, ourMethods); }
void InitializeWindowsFormsFieldsAndProps() { var checker = NameChecker; var ourFields = new FieldDefAndDeclaringTypeDict<MFieldDef>(); foreach (var fieldDef in type.AllFields) ourFields.Add(fieldDef.FieldDef, fieldDef); var ourMethods = new MethodDefAndDeclaringTypeDict<MMethodDef>(); foreach (var methodDef in type.AllMethods) ourMethods.Add(methodDef.MethodDef, methodDef); foreach (var methodDef in type.AllMethods) { if (methodDef.MethodDef.Body == null) continue; if (methodDef.MethodDef.IsStatic || methodDef.MethodDef.IsVirtual) continue; var instructions = methodDef.MethodDef.Body.Instructions; for (int i = 2; i < instructions.Count; i++) { var call = instructions[i]; if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt) continue; if (!IsWindowsFormsSetNameMethod(call.Operand as IMethod)) continue; var ldstr = instructions[i - 1]; if (ldstr.OpCode.Code != Code.Ldstr) continue; var fieldName = ldstr.Operand as string; if (fieldName == null || !checker.IsValidFieldName(fieldName)) continue; var instr = instructions[i - 2]; IField fieldRef = null; if (instr.OpCode.Code == Code.Call || instr.OpCode.Code == Code.Callvirt) { var calledMethod = instr.Operand as IMethod; if (calledMethod == null) continue; var calledMethodDef = ourMethods.Find(calledMethod); if (calledMethodDef == null) continue; fieldRef = GetFieldRef(calledMethodDef.MethodDef); var propDef = calledMethodDef.Property; if (propDef == null) continue; memberInfos.Property(propDef).suggestedName = fieldName; fieldName = "_" + fieldName; } else if (instr.OpCode.Code == Code.Ldfld) { fieldRef = instr.Operand as IField; } if (fieldRef == null) continue; var fieldDef = ourFields.Find(fieldRef); if (fieldDef == null) continue; var fieldInfo = memberInfos.Field(fieldDef); if (fieldInfo.renamed) continue; fieldInfo.suggestedName = variableNameState.GetNewFieldName(fieldInfo.oldName, new NameCreator2(fieldName)); } } }
void InitializeWindowsFormsFieldsAndProps() { var checker = NameChecker; var ourFields = new FieldDefAndDeclaringTypeDict <MFieldDef>(); foreach (var fieldDef in type.AllFields) { ourFields.Add(fieldDef.FieldDef, fieldDef); } var ourMethods = new MethodDefAndDeclaringTypeDict <MMethodDef>(); foreach (var methodDef in type.AllMethods) { ourMethods.Add(methodDef.MethodDef, methodDef); } foreach (var methodDef in type.AllMethods) { if (methodDef.MethodDef.Body == null) { continue; } if (methodDef.MethodDef.IsStatic || methodDef.MethodDef.IsVirtual) { continue; } var instructions = methodDef.MethodDef.Body.Instructions; for (int i = 2; i < instructions.Count; i++) { var call = instructions[i]; if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt) { continue; } if (!IsWindowsFormsSetNameMethod(call.Operand as IMethod)) { continue; } var ldstr = instructions[i - 1]; if (ldstr.OpCode.Code != Code.Ldstr) { continue; } var fieldName = ldstr.Operand as string; if (fieldName == null || !checker.IsValidFieldName(fieldName)) { continue; } var instr = instructions[i - 2]; IField fieldRef = null; if (instr.OpCode.Code == Code.Call || instr.OpCode.Code == Code.Callvirt) { var calledMethod = instr.Operand as IMethod; if (calledMethod == null) { continue; } var calledMethodDef = ourMethods.Find(calledMethod); if (calledMethodDef == null) { continue; } fieldRef = GetFieldRef(calledMethodDef.MethodDef); var propDef = calledMethodDef.Property; if (propDef == null) { continue; } memberInfos.Property(propDef).suggestedName = fieldName; fieldName = "_" + fieldName; } else if (instr.OpCode.Code == Code.Ldfld) { fieldRef = instr.Operand as IField; } if (fieldRef == null) { continue; } var fieldDef = ourFields.Find(fieldRef); if (fieldDef == null) { continue; } var fieldInfo = memberInfos.Field(fieldDef); if (fieldInfo.renamed) { continue; } fieldInfo.suggestedName = variableNameState.GetNewFieldName(fieldInfo.oldName, new NameCreator2(fieldName)); } } }
static short[] FindKey(MethodDef initMethod, FieldDef keyField) { var fields = new FieldDefAndDeclaringTypeDict<bool>(); fields.Add(keyField, true); return FindKey(initMethod, fields); }
static FieldDefAndDeclaringTypeDict<bool> GetFields(MethodDef method) { var fields = new FieldDefAndDeclaringTypeDict<bool>(); foreach (var instr in method.Body.Instructions) { if (instr.OpCode.Code != Code.Ldsfld && instr.OpCode.Code != Code.Stsfld) continue; var field = instr.Operand as FieldDef; if (field == null) continue; if (field.DeclaringType != method.DeclaringType) continue; fields.Add(field, true); } return fields; }