// VB initializes the handlers in the property setter, where it first removes the handler
// from the previous control, and then adds the handler to the new control.
void InitVbEventHandlers(FieldDefAndDeclaringTypeDict <MFieldDef> ourFields, MethodDefAndDeclaringTypeDict <MMethodDef> ourMethods)
{
var checker = NameChecker;
foreach (var propDef in type.AllProperties)
{
var setterDef = propDef.SetMethod;
if (setterDef == null)
{
continue;
}
var handler = GetVbHandler(setterDef.MethodDef, out string eventName);
if (handler == null)
{
continue;
}
var handlerDef = ourMethods.Find(handler);
if (handlerDef == null)
{
continue;
}
if (!checker.IsValidEventName(eventName))
{
continue;
}
memberInfos.Method(handlerDef).suggestedName = $"{memberInfos.Property(propDef).newName}_{eventName}";
}
}
void removeCalls(IList <Block> allBlocks, Blocks blocks, MethodDefAndDeclaringTypeDict <bool> info)
{
var instrsToDelete = new List <int>();
foreach (var block in allBlocks)
{
instrsToDelete.Clear();
for (int i = 0; i < block.Instructions.Count; i++)
{
var instr = block.Instructions[i];
if (instr.OpCode != OpCodes.Call)
{
continue;
}
var destMethod = instr.Operand as IMethod;
if (destMethod == null)
{
continue;
}
if (info.find(destMethod))
{
Logger.v("Removed call to {0}", Utils.removeNewlines(destMethod));
instrsToDelete.Add(i);
}
}
block.remove(instrsToDelete);
}
}
// VB initializes the handlers in the property setter, where it first removes the handler
// from the previous control, and then adds the handler to the new control.
void initVbEventHandlers(FieldDefAndDeclaringTypeDict <MFieldDef> ourFields, MethodDefAndDeclaringTypeDict <MMethodDef> ourMethods)
{
var checker = NameChecker;
foreach (var propDef in type.AllProperties)
{
var setterDef = propDef.SetMethod;
if (setterDef == null)
{
continue;
}
string eventName;
var handler = getVbHandler(setterDef.MethodDef, out eventName);
if (handler == null)
{
continue;
}
var handlerDef = ourMethods.find(handler);
if (handlerDef == null)
{
continue;
}
if (!checker.isValidEventName(eventName))
{
continue;
}
memberInfos.method(handlerDef).suggestedName = string.Format("{0}_{1}", memberInfos.prop(propDef).newName, eventName);
}
}
static bool CheckAllMethodsUnused(MethodDefAndDeclaringTypeDict <bool> unused, TypeDef type)
{
foreach (var method in type.Methods)
{
if (!unused.Find(method))
{
return(false);
}
}
return(true);
}
void InitializeCtors(TypeDef manager, MethodDefAndDeclaringTypeDict<IMethod> ctors) {
if (manager == null)
return;
foreach (var ctor in manager.Methods) {
if (ctor.Name != ".ctor")
continue;
var newCtor = new MemberRefUser(module, ctor.Name, ctor.MethodSig.Clone(), manager.BaseType);
module.UpdateRowId(newCtor);
ctors.Add(ctor, newCtor);
}
}
public void add(MethodDef method, MethodDef methodToBeRemoved)
{
if (method == null || methodToBeRemoved == null)
{
return;
}
checkMethod(methodToBeRemoved);
var dict = methodRefInfos.find(method);
if (dict == null)
{
methodRefInfos.add(method, dict = new MethodDefAndDeclaringTypeDict <bool>());
}
dict.add(methodToBeRemoved, true);
}
public void add(string method, MethodDef methodToBeRemoved)
{
if (methodToBeRemoved == null)
{
return;
}
checkMethod(methodToBeRemoved);
MethodDefAndDeclaringTypeDict <bool> dict;
if (!methodNameInfos.TryGetValue(method, out dict))
{
methodNameInfos[method] = dict = new MethodDefAndDeclaringTypeDict <bool>();
}
dict.add(methodToBeRemoved, true);
}
public void InitializeEventHandlerNames()
{
var ourFields = new FieldDefAndDeclaringTypeDict <MFieldDef>();
foreach (var fieldDef in type.AllFields)
{
ourFields.Add(fieldDef.FieldDef, fieldDef);
}
var ourMethods = new MethodDefAndDeclaringTypeDict <MMethodDef>();
foreach (var methodDef in type.AllMethods)
{
ourMethods.Add(methodDef.MethodDef, methodDef);
}
InitVbEventHandlers(ourFields, ourMethods);
InitFieldEventHandlers(ourFields, ourMethods);
InitTypeEventHandlers(ourFields, ourMethods);
}
void InitializeCtors(TypeDef manager, MethodDefAndDeclaringTypeDict <IMethod> ctors)
{
if (manager == null)
{
return;
}
foreach (var ctor in manager.Methods)
{
if (ctor.Name != ".ctor")
{
continue;
}
var newCtor = new MemberRefUser(module, ctor.Name, ctor.MethodSig.Clone(), manager.BaseType);
module.UpdateRowId(newCtor);
ctors.Add(ctor, newCtor);
}
}
public TypeDefDict <bool> GetInlinedTypes(IEnumerable <MethodDef> unusedMethods)
{
var unused = new MethodDefAndDeclaringTypeDict <bool>();
foreach (var method in unusedMethods)
{
unused.Add(method, true);
}
var types = new TypeDefDict <bool>();
foreach (var type in methodsTypes.GetKeys())
{
if (CheckAllMethodsUnused(unused, type))
{
types.Add(type, true);
}
}
return(types);
}
void RestoreMethodBodies(ISimpleDeobfuscator simpleDeobfuscator) {
var methodToOrigMethods = new MethodDefAndDeclaringTypeDict<List<MethodDef>>();
foreach (var t in module.Types) {
var types = new List<TypeDef>(AllTypesHelper.Types(new List<TypeDef> { t }));
foreach (var type in types) {
if (methodsTypes.Find(type))
continue;
foreach (var method in type.Methods) {
if (method.Name == ".ctor" || method.Name == ".cctor")
continue;
MethodDef calledMethod;
if (!CheckRestoreBody(method, out calledMethod))
continue;
if (!CheckSameMethods(method, calledMethod))
continue;
if (!methodsTypes.Find(calledMethod.DeclaringType))
continue;
if (types.IndexOf(calledMethod.DeclaringType) < 0)
continue;
var list = methodToOrigMethods.Find(calledMethod);
if (list == null)
methodToOrigMethods.Add(calledMethod, list = new List<MethodDef>());
list.Add(method);
}
}
}
foreach (var calledMethod in methodToOrigMethods.GetKeys()) {
var list = methodToOrigMethods.Find(calledMethod);
var method = list[0];
Logger.v("Restored method body {0:X8} from method {1:X8}",
method.MDToken.ToInt32(),
calledMethod.MDToken.ToInt32());
DotNetUtils.CopyBodyFromTo(calledMethod, method);
classMethods.Add(calledMethod, method);
simpleDeobfuscator.MethodModified(method);
}
}
void InitTypeEventHandlers(FieldDefAndDeclaringTypeDict<MFieldDef> ourFields, MethodDefAndDeclaringTypeDict<MMethodDef> ourMethods) {
var checker = NameChecker;
foreach (var methodDef in type.AllMethods) {
if (methodDef.MethodDef.Body == null)
continue;
if (methodDef.MethodDef.IsStatic)
continue;
var method = methodDef.MethodDef;
var instructions = method.Body.Instructions;
for (int i = 0; i < instructions.Count - 5; i++) {
// ldarg.0
// ldarg.0 / dup
// ldarg.0 / dup
// ldvirtftn handler
// newobj event handler ctor
// call add_Xyz
if (instructions[i].GetParameterIndex() != 0)
continue;
int index = i + 1;
if (!IsThisOrDup(instructions[index++]))
continue;
IMethod handler;
if (instructions[index].OpCode.Code == Code.Ldftn) {
handler = instructions[index++].Operand as IMethod;
}
else {
if (!IsThisOrDup(instructions[index++]))
continue;
var instr = instructions[index++];
if (instr.OpCode.Code != Code.Ldvirtftn)
continue;
handler = instr.Operand as IMethod;
}
if (handler == null)
continue;
var handlerDef = ourMethods.Find(handler);
if (handlerDef == null)
continue;
var newobj = instructions[index++];
if (newobj.OpCode.Code != Code.Newobj)
continue;
if (!IsEventHandlerCtor(newobj.Operand as IMethod))
continue;
var call = instructions[index++];
if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
continue;
var addMethod = call.Operand as IMethod;
if (addMethod == null)
continue;
if (!Utils.StartsWith(addMethod.Name.String, "add_", StringComparison.Ordinal))
continue;
var eventName = addMethod.Name.String.Substring(4);
if (!checker.IsValidEventName(eventName))
continue;
memberInfos.Method(handlerDef).suggestedName = string.Format("{0}_{1}", newName, eventName);
}
}
}
void InitFieldEventHandlers(FieldDefAndDeclaringTypeDict<MFieldDef> ourFields, MethodDefAndDeclaringTypeDict<MMethodDef> ourMethods) {
var checker = NameChecker;
foreach (var methodDef in type.AllMethods) {
if (methodDef.MethodDef.Body == null)
continue;
if (methodDef.MethodDef.IsStatic)
continue;
var instructions = methodDef.MethodDef.Body.Instructions;
for (int i = 0; i < instructions.Count - 6; i++) {
// We're looking for this code pattern:
// ldarg.0
// ldfld field
// ldarg.0
// ldftn method / ldarg.0 + ldvirtftn
// newobj event_handler_ctor
// callvirt add_SomeEvent
if (instructions[i].GetParameterIndex() != 0)
continue;
int index = i + 1;
var ldfld = instructions[index++];
if (ldfld.OpCode.Code != Code.Ldfld)
continue;
var fieldRef = ldfld.Operand as IField;
if (fieldRef == null)
continue;
var fieldDef = ourFields.Find(fieldRef);
if (fieldDef == null)
continue;
if (instructions[index++].GetParameterIndex() != 0)
continue;
IMethod methodRef;
var instr = instructions[index + 1];
if (instr.OpCode.Code == Code.Ldvirtftn) {
if (!IsThisOrDup(instructions[index++]))
continue;
var ldvirtftn = instructions[index++];
methodRef = ldvirtftn.Operand as IMethod;
}
else {
var ldftn = instructions[index++];
if (ldftn.OpCode.Code != Code.Ldftn)
continue;
methodRef = ldftn.Operand as IMethod;
}
if (methodRef == null)
continue;
var handlerMethod = ourMethods.Find(methodRef);
if (handlerMethod == null)
continue;
var newobj = instructions[index++];
if (newobj.OpCode.Code != Code.Newobj)
continue;
if (!IsEventHandlerCtor(newobj.Operand as IMethod))
continue;
var call = instructions[index++];
if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
continue;
var addHandler = call.Operand as IMethod;
if (addHandler == null)
continue;
if (!Utils.StartsWith(addHandler.Name.String, "add_", StringComparison.Ordinal))
continue;
var eventName = addHandler.Name.String.Substring(4);
if (!checker.IsValidEventName(eventName))
continue;
memberInfos.Method(handlerMethod).suggestedName = string.Format("{0}_{1}", memberInfos.Field(fieldDef).newName, eventName);
}
}
}
// VB initializes the handlers in the property setter, where it first removes the handler
// from the previous control, and then adds the handler to the new control.
void InitVbEventHandlers(FieldDefAndDeclaringTypeDict<MFieldDef> ourFields, MethodDefAndDeclaringTypeDict<MMethodDef> ourMethods) {
var checker = NameChecker;
foreach (var propDef in type.AllProperties) {
var setterDef = propDef.SetMethod;
if (setterDef == null)
continue;
string eventName;
var handler = GetVbHandler(setterDef.MethodDef, out eventName);
if (handler == null)
continue;
var handlerDef = ourMethods.Find(handler);
if (handlerDef == null)
continue;
if (!checker.IsValidEventName(eventName))
continue;
memberInfos.Method(handlerDef).suggestedName = string.Format("{0}_{1}", memberInfos.Property(propDef).newName, eventName);
}
}
public void InitializeEventHandlerNames() {
var ourFields = new FieldDefAndDeclaringTypeDict<MFieldDef>();
foreach (var fieldDef in type.AllFields)
ourFields.Add(fieldDef.FieldDef, fieldDef);
var ourMethods = new MethodDefAndDeclaringTypeDict<MMethodDef>();
foreach (var methodDef in type.AllMethods)
ourMethods.Add(methodDef.MethodDef, methodDef);
InitVbEventHandlers(ourFields, ourMethods);
InitFieldEventHandlers(ourFields, ourMethods);
InitTypeEventHandlers(ourFields, ourMethods);
}
void InitializeWindowsFormsFieldsAndProps() {
var checker = NameChecker;
var ourFields = new FieldDefAndDeclaringTypeDict<MFieldDef>();
foreach (var fieldDef in type.AllFields)
ourFields.Add(fieldDef.FieldDef, fieldDef);
var ourMethods = new MethodDefAndDeclaringTypeDict<MMethodDef>();
foreach (var methodDef in type.AllMethods)
ourMethods.Add(methodDef.MethodDef, methodDef);
foreach (var methodDef in type.AllMethods) {
if (methodDef.MethodDef.Body == null)
continue;
if (methodDef.MethodDef.IsStatic || methodDef.MethodDef.IsVirtual)
continue;
var instructions = methodDef.MethodDef.Body.Instructions;
for (int i = 2; i < instructions.Count; i++) {
var call = instructions[i];
if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
continue;
if (!IsWindowsFormsSetNameMethod(call.Operand as IMethod))
continue;
var ldstr = instructions[i - 1];
if (ldstr.OpCode.Code != Code.Ldstr)
continue;
var fieldName = ldstr.Operand as string;
if (fieldName == null || !checker.IsValidFieldName(fieldName))
continue;
var instr = instructions[i - 2];
IField fieldRef = null;
if (instr.OpCode.Code == Code.Call || instr.OpCode.Code == Code.Callvirt) {
var calledMethod = instr.Operand as IMethod;
if (calledMethod == null)
continue;
var calledMethodDef = ourMethods.Find(calledMethod);
if (calledMethodDef == null)
continue;
fieldRef = GetFieldRef(calledMethodDef.MethodDef);
var propDef = calledMethodDef.Property;
if (propDef == null)
continue;
memberInfos.Property(propDef).suggestedName = fieldName;
fieldName = "_" + fieldName;
}
else if (instr.OpCode.Code == Code.Ldfld) {
fieldRef = instr.Operand as IField;
}
if (fieldRef == null)
continue;
var fieldDef = ourFields.Find(fieldRef);
if (fieldDef == null)
continue;
var fieldInfo = memberInfos.Field(fieldDef);
if (fieldInfo.renamed)
continue;
fieldInfo.suggestedName = variableNameState.GetNewFieldName(fieldInfo.oldName, new NameCreator2(fieldName));
}
}
}
void RestoreMethodBodies(ISimpleDeobfuscator simpleDeobfuscator)
{
var methodToOrigMethods = new MethodDefAndDeclaringTypeDict <List <MethodDef> >();
foreach (var t in module.Types)
{
var types = new List <TypeDef>(AllTypesHelper.Types(new List <TypeDef> {
t
}));
foreach (var type in types)
{
if (methodsTypes.Find(type))
{
continue;
}
foreach (var method in type.Methods)
{
if (method.Name == ".ctor" || method.Name == ".cctor")
{
continue;
}
MethodDef calledMethod;
if (!CheckRestoreBody(method, out calledMethod))
{
continue;
}
if (!CheckSameMethods(method, calledMethod))
{
continue;
}
if (!methodsTypes.Find(calledMethod.DeclaringType))
{
continue;
}
if (types.IndexOf(calledMethod.DeclaringType) < 0)
{
continue;
}
var list = methodToOrigMethods.Find(calledMethod);
if (list == null)
{
methodToOrigMethods.Add(calledMethod, list = new List <MethodDef>());
}
list.Add(method);
}
}
}
foreach (var calledMethod in methodToOrigMethods.GetKeys())
{
var list = methodToOrigMethods.Find(calledMethod);
var method = list[0];
Logger.v("Restored method body {0:X8} from method {1:X8}",
method.MDToken.ToInt32(),
calledMethod.MDToken.ToInt32());
DotNetUtils.CopyBodyFromTo(calledMethod, method);
classMethods.Add(calledMethod, method);
simpleDeobfuscator.MethodModified(method);
}
}
static bool checkAllMethodsUnused(MethodDefAndDeclaringTypeDict<bool> unused, TypeDef type)
{
foreach (var method in type.Methods) {
if (!unused.find(method))
return false;
}
return true;
}
void InitializeWindowsFormsFieldsAndProps()
{
var checker = NameChecker;
var ourFields = new FieldDefAndDeclaringTypeDict <MFieldDef>();
foreach (var fieldDef in type.AllFields)
{
ourFields.Add(fieldDef.FieldDef, fieldDef);
}
var ourMethods = new MethodDefAndDeclaringTypeDict <MMethodDef>();
foreach (var methodDef in type.AllMethods)
{
ourMethods.Add(methodDef.MethodDef, methodDef);
}
foreach (var methodDef in type.AllMethods)
{
if (methodDef.MethodDef.Body == null)
{
continue;
}
if (methodDef.MethodDef.IsStatic || methodDef.MethodDef.IsVirtual)
{
continue;
}
var instructions = methodDef.MethodDef.Body.Instructions;
for (int i = 2; i < instructions.Count; i++)
{
var call = instructions[i];
if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
{
continue;
}
if (!IsWindowsFormsSetNameMethod(call.Operand as IMethod))
{
continue;
}
var ldstr = instructions[i - 1];
if (ldstr.OpCode.Code != Code.Ldstr)
{
continue;
}
var fieldName = ldstr.Operand as string;
if (fieldName == null || !checker.IsValidFieldName(fieldName))
{
continue;
}
var instr = instructions[i - 2];
IField fieldRef = null;
if (instr.OpCode.Code == Code.Call || instr.OpCode.Code == Code.Callvirt)
{
var calledMethod = instr.Operand as IMethod;
if (calledMethod == null)
{
continue;
}
var calledMethodDef = ourMethods.Find(calledMethod);
if (calledMethodDef == null)
{
continue;
}
fieldRef = GetFieldRef(calledMethodDef.MethodDef);
var propDef = calledMethodDef.Property;
if (propDef == null)
{
continue;
}
memberInfos.Property(propDef).suggestedName = fieldName;
fieldName = "_" + fieldName;
}
else if (instr.OpCode.Code == Code.Ldfld)
{
fieldRef = instr.Operand as IField;
}
if (fieldRef == null)
{
continue;
}
var fieldDef = ourFields.Find(fieldRef);
if (fieldDef == null)
{
continue;
}
var fieldInfo = memberInfos.Field(fieldDef);
if (fieldInfo.renamed)
{
continue;
}
fieldInfo.suggestedName = variableNameState.GetNewFieldName(fieldInfo.oldName, new NameCreator2(fieldName));
}
}
}
void InitTypeEventHandlers(FieldDefAndDeclaringTypeDict <MFieldDef> ourFields, MethodDefAndDeclaringTypeDict <MMethodDef> ourMethods)
{
var checker = NameChecker;
foreach (var methodDef in type.AllMethods)
{
if (methodDef.MethodDef.Body == null)
{
continue;
}
if (methodDef.MethodDef.IsStatic)
{
continue;
}
var method = methodDef.MethodDef;
var instructions = method.Body.Instructions;
for (int i = 0; i < instructions.Count - 5; i++)
{
// ldarg.0
// ldarg.0 / dup
// ldarg.0 / dup
// ldvirtftn handler
// newobj event handler ctor
// call add_Xyz
if (instructions[i].GetParameterIndex() != 0)
{
continue;
}
int index = i + 1;
if (!IsThisOrDup(instructions[index++]))
{
continue;
}
IMethod handler;
if (instructions[index].OpCode.Code == Code.Ldftn)
{
handler = instructions[index++].Operand as IMethod;
}
else
{
if (!IsThisOrDup(instructions[index++]))
{
continue;
}
var instr = instructions[index++];
if (instr.OpCode.Code != Code.Ldvirtftn)
{
continue;
}
handler = instr.Operand as IMethod;
}
if (handler == null)
{
continue;
}
var handlerDef = ourMethods.Find(handler);
if (handlerDef == null)
{
continue;
}
var newobj = instructions[index++];
if (newobj.OpCode.Code != Code.Newobj)
{
continue;
}
if (!IsEventHandlerCtor(newobj.Operand as IMethod))
{
continue;
}
var call = instructions[index++];
if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
{
continue;
}
var addMethod = call.Operand as IMethod;
if (addMethod == null)
{
continue;
}
if (!Utils.StartsWith(addMethod.Name.String, "add_", StringComparison.Ordinal))
{
continue;
}
var eventName = addMethod.Name.String.Substring(4);
if (!checker.IsValidEventName(eventName))
{
continue;
}
memberInfos.Method(handlerDef).suggestedName = $"{newName}_{eventName}";
}
}
}
public TypeDefDict<bool> getInlinedTypes(IEnumerable<MethodDef> unusedMethods)
{
var unused = new MethodDefAndDeclaringTypeDict<bool>();
foreach (var method in unusedMethods)
unused.add(method, true);
var types = new TypeDefDict<bool>();
foreach (var type in methodsTypes.getKeys()) {
if (checkAllMethodsUnused(unused, type))
types.add(type, true);
}
return types;
}
void InitFieldEventHandlers(FieldDefAndDeclaringTypeDict <MFieldDef> ourFields, MethodDefAndDeclaringTypeDict <MMethodDef> ourMethods)
{
var checker = NameChecker;
foreach (var methodDef in type.AllMethods)
{
if (methodDef.MethodDef.Body == null)
{
continue;
}
if (methodDef.MethodDef.IsStatic)
{
continue;
}
var instructions = methodDef.MethodDef.Body.Instructions;
for (int i = 0; i < instructions.Count - 6; i++)
{
// We're looking for this code pattern:
// ldarg.0
// ldfld field
// ldarg.0
// ldftn method / ldarg.0 + ldvirtftn
// newobj event_handler_ctor
// callvirt add_SomeEvent
if (instructions[i].GetParameterIndex() != 0)
{
continue;
}
int index = i + 1;
var ldfld = instructions[index++];
if (ldfld.OpCode.Code != Code.Ldfld)
{
continue;
}
var fieldRef = ldfld.Operand as IField;
if (fieldRef == null)
{
continue;
}
var fieldDef = ourFields.Find(fieldRef);
if (fieldDef == null)
{
continue;
}
if (instructions[index++].GetParameterIndex() != 0)
{
continue;
}
IMethod methodRef;
var instr = instructions[index + 1];
if (instr.OpCode.Code == Code.Ldvirtftn)
{
if (!IsThisOrDup(instructions[index++]))
{
continue;
}
var ldvirtftn = instructions[index++];
methodRef = ldvirtftn.Operand as IMethod;
}
else
{
var ldftn = instructions[index++];
if (ldftn.OpCode.Code != Code.Ldftn)
{
continue;
}
methodRef = ldftn.Operand as IMethod;
}
if (methodRef == null)
{
continue;
}
var handlerMethod = ourMethods.Find(methodRef);
if (handlerMethod == null)
{
continue;
}
var newobj = instructions[index++];
if (newobj.OpCode.Code != Code.Newobj)
{
continue;
}
if (!IsEventHandlerCtor(newobj.Operand as IMethod))
{
continue;
}
var call = instructions[index++];
if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
{
continue;
}
var addHandler = call.Operand as IMethod;
if (addHandler == null)
{
continue;
}
if (!Utils.StartsWith(addHandler.Name.String, "add_", StringComparison.Ordinal))
{
continue;
}
var eventName = addHandler.Name.String.Substring(4);
if (!checker.IsValidEventName(eventName))
{
continue;
}
memberInfos.Method(handlerMethod).suggestedName = $"{memberInfos.Field(fieldDef).newName}_{eventName}";
}
}
}