コード例 #1
0
ファイル: StringInliner.cs プロジェクト: kidhudi/de4dot
 protected override void inlineAllCalls()
 {
     foreach (var tmp in callResults)
     {
         var callResult = (MyCallResult)tmp;
         var handler    = stringDecrypters.find(callResult.methodReference);
         callResult.returnValue = handler((MethodDefinition)callResult.methodReference, callResult.gim, callResult.args);
     }
 }
コード例 #2
0
 public void add(MethodDefinition method, Func <MethodDefinition, object[], TValue> handler)
 {
     if (method == null)
     {
         return;
     }
     if (decrypterMethods.find(method) != null)
     {
         throw new ApplicationException(string.Format("Handler for method {0:X8} has already been added", method.MetadataToken.ToInt32()));
     }
     if (method != null)
     {
         decrypterMethods.add(method, handler);
     }
 }
コード例 #3
0
 public void deobfuscate(Blocks blocks)
 {
     foreach (var block in blocks.MethodBlocks.getAllBlocks())
     {
         var instrs = block.Instructions;
         for (int i = 0; i < instrs.Count; i++)
         {
             var instr = instrs[i];
             if (instr.OpCode.Code != Code.Newobj)
             {
                 continue;
             }
             var ctor = instr.Operand as MethodReference;
             if (ctor == null)
             {
                 continue;
             }
             var newCtor = resourceManagerCtors.find(ctor);
             if (newCtor == null)
             {
                 newCtor = componentManagerCtors.find(ctor);
             }
             if (newCtor == null)
             {
                 continue;
             }
             instr.Operand = newCtor;
         }
     }
 }
コード例 #4
0
        public void deobfuscate(Blocks blocks)
        {
            foreach (var block in blocks.MethodBlocks.getAllBlocks())
            {
                var instrs = block.Instructions;
                for (int i = 0; i < instrs.Count; i++)
                {
                    var call = instrs[i];
                    if (call.OpCode.Code != Code.Call)
                    {
                        continue;
                    }
                    var calledMethod = call.Operand as MethodDefinition;
                    if (calledMethod == null)
                    {
                        continue;
                    }

                    var newMethodInfo = oldToNewMethod.find(calledMethod);
                    if (newMethodInfo == null)
                    {
                        continue;
                    }

                    instrs[i] = new Instr(Instruction.Create(newMethodInfo.opCode, newMethodInfo.method));
                }
            }
        }
コード例 #5
0
            public void add(MethodDefinition method, MethodDefinition methodToBeRemoved)
            {
                if (method == null || methodToBeRemoved == null)
                {
                    return;
                }
                checkMethod(methodToBeRemoved);

                var dict = methodRefInfos.find(method);

                if (dict == null)
                {
                    methodRefInfos.add(method, dict = new MethodDefinitionAndDeclaringTypeDict <bool>());
                }
                dict.add(methodToBeRemoved, true);
            }
コード例 #6
0
            void removeCalls(IList <Block> allBlocks, Blocks blocks, MethodDefinitionAndDeclaringTypeDict <bool> info)
            {
                var instrsToDelete = new List <int>();

                foreach (var block in allBlocks)
                {
                    instrsToDelete.Clear();
                    for (int i = 0; i < block.Instructions.Count; i++)
                    {
                        var instr = block.Instructions[i];
                        if (instr.OpCode != OpCodes.Call)
                        {
                            continue;
                        }
                        var destMethod = instr.Operand as MethodReference;
                        if (destMethod == null)
                        {
                            continue;
                        }

                        if (info.find(destMethod))
                        {
                            Log.v("Removed call to {0}", Utils.removeNewlines(destMethod));
                            instrsToDelete.Add(i);
                        }
                    }
                    block.remove(instrsToDelete);
                }
            }
コード例 #7
0
        protected override bool deobfuscate(Blocks blocks, IList <Block> allBlocks)
        {
            var removeInfos = new Dictionary <Block, List <RemoveInfo> >();

            foreach (var block in allBlocks)
            {
                var instrs = block.Instructions;
                for (int i = 0; i < instrs.Count; i++)
                {
                    var instr = instrs[i];
                    if (instr.OpCode != OpCodes.Call)
                    {
                        continue;
                    }

                    var method = instr.Operand as MethodReference;
                    if (method == null)
                    {
                        continue;
                    }
                    var di = proxyMethodToDelegateInfo.find(method);
                    if (di == null)
                    {
                        continue;
                    }
                    add(removeInfos, block, i, di);
                }
            }

            return(fixProxyCalls(removeInfos));
        }
コード例 #8
0
        // VB initializes the handlers in the property setter, where it first removes the handler
        // from the previous control, and then adds the handler to the new control.
        void initVbEventHandlers(FieldDefinitionAndDeclaringTypeDict <FieldDef> ourFields, MethodDefinitionAndDeclaringTypeDict <MethodDef> ourMethods)
        {
            var checker = NameChecker;

            foreach (var propDef in type.AllProperties)
            {
                var setterDef = propDef.SetMethod;
                if (setterDef == null)
                {
                    continue;
                }

                string eventName;
                var    handler = getVbHandler(setterDef.MethodDefinition, out eventName);
                if (handler == null)
                {
                    continue;
                }
                var handlerDef = ourMethods.find(handler);
                if (handlerDef == null)
                {
                    continue;
                }

                if (!checker.isValidEventName(eventName))
                {
                    continue;
                }

                memberInfos.method(handlerDef).suggestedName = string.Format("{0}_{1}", memberInfos.prop(propDef).newName, eventName);
            }
        }
コード例 #9
0
ファイル: ProxyCallFixer.cs プロジェクト: kidhudi/de4dot
        protected override object checkCctor(TypeDefinition type, MethodDefinition cctor)
        {
            var instructions = cctor.Body.Instructions;

            for (int i = 0; i < instructions.Count; i++)
            {
                TypeReference   delegateType;
                FieldReference  delegateField;
                MethodReference createMethod;
                int             methodToken, declaringTypeToken;
                var             instrs = DotNetUtils.getInstructions(instructions, i, OpCodes.Ldtoken, OpCodes.Ldc_I4, OpCodes.Ldc_I4, OpCodes.Ldtoken, OpCodes.Call);
                if (instrs != null)
                {
                    delegateType       = instrs[0].Operand as TypeReference;
                    methodToken        = DotNetUtils.getLdcI4Value(instrs[1]);
                    declaringTypeToken = DotNetUtils.getLdcI4Value(instrs[2]);
                    delegateField      = instrs[3].Operand as FieldReference;
                    createMethod       = instrs[4].Operand as MethodReference;
                }
                else if ((instrs = DotNetUtils.getInstructions(instructions, i, OpCodes.Ldtoken, OpCodes.Ldc_I4, OpCodes.Ldtoken, OpCodes.Call)) != null)
                {
                    delegateType       = instrs[0].Operand as TypeReference;
                    methodToken        = DotNetUtils.getLdcI4Value(instrs[1]);
                    declaringTypeToken = -1;
                    delegateField      = instrs[2].Operand as FieldReference;
                    createMethod       = instrs[3].Operand as MethodReference;
                }
                else
                {
                    continue;
                }

                if (delegateType == null)
                {
                    continue;
                }
                if (delegateField == null)
                {
                    continue;
                }
                if (createMethod == null)
                {
                    continue;
                }
                var proxyCreatorType = methodToType.find(createMethod);
                if (proxyCreatorType == ProxyCreatorType.None)
                {
                    continue;
                }

                return(new Context(delegateType, methodToken, declaringTypeToken, proxyCreatorType));
            }

            return(null);
        }
コード例 #10
0
 static bool checkAllMethodsUnused(MethodDefinitionAndDeclaringTypeDict <bool> unused, TypeDefinition type)
 {
     foreach (var method in type.Methods)
     {
         if (!unused.find(method))
         {
             return(false);
         }
     }
     return(true);
 }
コード例 #11
0
        protected Info getInfo(MethodDefinition method)
        {
            var info = decrypterMethods.find(method);

            if (info == null)
            {
                return(null);
            }

            info.referenced = true;
            return(info);
        }
コード例 #12
0
ファイル: MethodCollection.cs プロジェクト: kidhudi/de4dot
 public bool exists(MethodReference method)
 {
     if (method == null)
     {
         return(false);
     }
     if (method.DeclaringType != null && types.find(method.DeclaringType))
     {
         return(true);
     }
     return(methods.find(method));
 }
コード例 #13
0
 public void deobfuscate(Blocks blocks)
 {
     foreach (var block in blocks.MethodBlocks.getAllBlocks())
     {
         var instrs = block.Instructions;
         for (int i = 0; i < instrs.Count; i++)
         {
             var call = instrs[i];
             if (call.OpCode.Code != Code.Call)
             {
                 continue;
             }
             var realInstanceMethod = classMethods.find(call.Operand as MethodReference);
             if (realInstanceMethod == null)
             {
                 continue;
             }
             call.Operand = realInstanceMethod;
         }
     }
 }
コード例 #14
0
ファイル: TypeInfo.cs プロジェクト: huliang/de4dot
        // VB initializes the handlers in the property setter, where it first removes the handler
        // from the previous control, and then adds the handler to the new control.
        void initVbEventHandlers(FieldDefinitionAndDeclaringTypeDict<FieldDef> ourFields, MethodDefinitionAndDeclaringTypeDict<MethodDef> ourMethods)
        {
            var checker = NameChecker;

            foreach (var propDef in type.AllProperties) {
                var setterDef = propDef.SetMethod;
                if (setterDef == null)
                    continue;

                string eventName;
                var handler = getVbHandler(setterDef.MethodDefinition, out eventName);
                if (handler == null)
                    continue;
                var handlerDef = ourMethods.find(handler);
                if (handlerDef == null)
                    continue;

                if (!checker.isValidEventName(eventName))
                    continue;

                memberInfos.method(handlerDef).suggestedName = string.Format("{0}_{1}", memberInfos.prop(propDef).newName, eventName);
            }
        }
コード例 #15
0
ファイル: TypeInfo.cs プロジェクト: huliang/de4dot
        void initTypeEventHandlers(FieldDefinitionAndDeclaringTypeDict<FieldDef> ourFields, MethodDefinitionAndDeclaringTypeDict<MethodDef> ourMethods)
        {
            var checker = NameChecker;

            foreach (var methodDef in type.AllMethods) {
                if (methodDef.MethodDefinition.Body == null)
                    continue;
                if (methodDef.MethodDefinition.IsStatic)
                    continue;
                var method = methodDef.MethodDefinition;
                var instructions = method.Body.Instructions;
                for (int i = 0; i < instructions.Count - 5; i++) {
                    // ldarg.0
                    // ldarg.0 / dup
                    // ldarg.0 / dup
                    // ldvirtftn handler
                    // newobj event handler ctor
                    // call add_Xyz

                    if (DotNetUtils.getArgIndex(instructions[i]) != 0)
                        continue;
                    int index = i + 1;

                    if (!isThisOrDup(instructions[index++]))
                        continue;
                    MethodReference handler;
                    if (instructions[index].OpCode.Code == Code.Ldftn) {
                        handler = instructions[index++].Operand as MethodReference;
                    }
                    else {
                        if (!isThisOrDup(instructions[index++]))
                            continue;
                        var instr = instructions[index++];
                        if (instr.OpCode.Code != Code.Ldvirtftn)
                            continue;
                        handler = instr.Operand as MethodReference;
                    }
                    if (handler == null)
                        continue;
                    var handlerDef = ourMethods.find(handler);
                    if (handlerDef == null)
                        continue;

                    var newobj = instructions[index++];
                    if (newobj.OpCode.Code != Code.Newobj)
                        continue;
                    if (!isEventHandlerCtor(newobj.Operand as MethodReference))
                        continue;

                    var call = instructions[index++];
                    if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
                        continue;
                    var addMethod = call.Operand as MethodReference;
                    if (addMethod == null)
                        continue;
                    if (!Utils.StartsWith(addMethod.Name, "add_", StringComparison.Ordinal))
                        continue;

                    var eventName = addMethod.Name.Substring(4);
                    if (!checker.isValidEventName(eventName))
                        continue;

                    memberInfos.method(handlerDef).suggestedName = string.Format("{0}_{1}", newName, eventName);
                }
            }
        }
コード例 #16
0
ファイル: TypeInfo.cs プロジェクト: huliang/de4dot
        void initializeWindowsFormsFieldsAndProps()
        {
            var checker = NameChecker;

            var ourFields = new FieldDefinitionAndDeclaringTypeDict<FieldDef>();
            foreach (var fieldDef in type.AllFields)
                ourFields.add(fieldDef.FieldDefinition, fieldDef);
            var ourMethods = new MethodDefinitionAndDeclaringTypeDict<MethodDef>();
            foreach (var methodDef in type.AllMethods)
                ourMethods.add(methodDef.MethodDefinition, methodDef);

            foreach (var methodDef in type.AllMethods) {
                if (methodDef.MethodDefinition.Body == null)
                    continue;
                if (methodDef.MethodDefinition.IsStatic || methodDef.MethodDefinition.IsVirtual)
                    continue;
                var instructions = methodDef.MethodDefinition.Body.Instructions;
                for (int i = 2; i < instructions.Count; i++) {
                    var call = instructions[i];
                    if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
                        continue;
                    if (!isWindowsFormsSetNameMethod(call.Operand as MethodReference))
                        continue;

                    var ldstr = instructions[i - 1];
                    if (ldstr.OpCode.Code != Code.Ldstr)
                        continue;
                    var fieldName = ldstr.Operand as string;
                    if (fieldName == null || !checker.isValidFieldName(fieldName))
                        continue;

                    var instr = instructions[i - 2];
                    FieldReference fieldRef = null;
                    if (instr.OpCode.Code == Code.Call || instr.OpCode.Code == Code.Callvirt) {
                        var calledMethod = instr.Operand as MethodReference;
                        if (calledMethod == null)
                            continue;
                        var calledMethodDef = ourMethods.find(calledMethod);
                        if (calledMethodDef == null)
                            continue;
                        fieldRef = getFieldReference(calledMethodDef.MethodDefinition);

                        var propDef = calledMethodDef.Property;
                        if (propDef == null)
                            continue;

                        memberInfos.prop(propDef).suggestedName = fieldName;
                        fieldName = "_" + fieldName;
                    }
                    else if (instr.OpCode.Code == Code.Ldfld) {
                        fieldRef = instr.Operand as FieldReference;
                    }

                    if (fieldRef == null)
                        continue;
                    var fieldDef = ourFields.find(fieldRef);
                    if (fieldDef == null)
                        continue;
                    var fieldInfo = memberInfos.field(fieldDef);

                    if (fieldInfo.renamed)
                        continue;

                    fieldInfo.suggestedName = variableNameState.getNewFieldName(fieldInfo.oldName, new NameCreator2(fieldName));
                }
            }
        }
コード例 #17
0
ファイル: TypeInfo.cs プロジェクト: huliang/de4dot
        void initFieldEventHandlers(FieldDefinitionAndDeclaringTypeDict<FieldDef> ourFields, MethodDefinitionAndDeclaringTypeDict<MethodDef> ourMethods)
        {
            var checker = NameChecker;

            foreach (var methodDef in type.AllMethods) {
                if (methodDef.MethodDefinition.Body == null)
                    continue;
                if (methodDef.MethodDefinition.IsStatic)
                    continue;
                var instructions = methodDef.MethodDefinition.Body.Instructions;
                for (int i = 0; i < instructions.Count - 6; i++) {
                    // We're looking for this code pattern:
                    //	ldarg.0
                    //	ldfld field
                    //	ldarg.0
                    //	ldftn method / ldarg.0 + ldvirtftn
                    //	newobj event_handler_ctor
                    //	callvirt add_SomeEvent

                    if (DotNetUtils.getArgIndex(instructions[i]) != 0)
                        continue;
                    int index = i + 1;

                    var ldfld = instructions[index++];
                    if (ldfld.OpCode.Code != Code.Ldfld)
                        continue;
                    var fieldRef = ldfld.Operand as FieldReference;
                    if (fieldRef == null)
                        continue;
                    var fieldDef = ourFields.find(fieldRef);
                    if (fieldDef == null)
                        continue;

                    if (DotNetUtils.getArgIndex(instructions[index++]) != 0)
                        continue;

                    MethodReference methodRef;
                    var instr = instructions[index + 1];
                    if (instr.OpCode.Code == Code.Ldvirtftn) {
                        if (!isThisOrDup(instructions[index++]))
                            continue;
                        var ldvirtftn = instructions[index++];
                        methodRef = ldvirtftn.Operand as MethodReference;
                    }
                    else {
                        var ldftn = instructions[index++];
                        if (ldftn.OpCode.Code != Code.Ldftn)
                            continue;
                        methodRef = ldftn.Operand as MethodReference;
                    }
                    if (methodRef == null)
                        continue;
                    var handlerMethod = ourMethods.find(methodRef);
                    if (handlerMethod == null)
                        continue;

                    var newobj = instructions[index++];
                    if (newobj.OpCode.Code != Code.Newobj)
                        continue;
                    if (!isEventHandlerCtor(newobj.Operand as MethodReference))
                        continue;

                    var call = instructions[index++];
                    if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
                        continue;
                    var addHandler = call.Operand as MethodReference;
                    if (addHandler == null)
                        continue;
                    if (!Utils.StartsWith(addHandler.Name, "add_", StringComparison.Ordinal))
                        continue;

                    var eventName = addHandler.Name.Substring(4);
                    if (!checker.isValidEventName(eventName))
                        continue;

                    memberInfos.method(handlerMethod).suggestedName = string.Format("{0}_{1}", memberInfos.field(fieldDef).newName, eventName);
                }
            }
        }
コード例 #18
0
        void restoreMethodBodies()
        {
            var methodToOrigMethods = new MethodDefinitionAndDeclaringTypeDict<List<MethodDefinition>>();
            foreach (var t in module.Types) {
                var types = new List<TypeDefinition>(TypeDefinition.GetTypes(new List<TypeDefinition> { t }));
                foreach (var type in types) {
                    if (methodsTypes.find(type))
                        continue;
                    foreach (var method in type.Methods) {
                        if (method.Name == ".ctor" || method.Name == ".cctor")
                            continue;

                        MethodDefinition calledMethod;
                        if (!checkRestoreBody(method, out calledMethod))
                            continue;
                        if (!checkSameMethods(method, calledMethod))
                            continue;
                        if (!methodsTypes.find(calledMethod.DeclaringType))
                            continue;
                        if (types.IndexOf(calledMethod.DeclaringType) < 0)
                            continue;

                        var list = methodToOrigMethods.find(calledMethod);
                        if (list == null)
                            methodToOrigMethods.add(calledMethod, list = new List<MethodDefinition>());
                        list.Add(method);
                    }
                }
            }

            foreach (var calledMethod in methodToOrigMethods.getKeys()) {
                var list = methodToOrigMethods.find(calledMethod);
                var method = list[0];

                Log.v("Restored method body {0:X8} from method {1:X8}",
                            method.MetadataToken.ToInt32(),
                            calledMethod.MetadataToken.ToInt32());
                DotNetUtils.copyBodyFromTo(calledMethod, method);
                classMethods.add(calledMethod, method);
            }
        }
コード例 #19
0
        void restoreMethodBodies()
        {
            var methodToOrigMethods = new MethodDefinitionAndDeclaringTypeDict <List <MethodDefinition> >();

            foreach (var t in module.Types)
            {
                var types = new List <TypeDefinition>(TypeDefinition.GetTypes(new List <TypeDefinition> {
                    t
                }));
                foreach (var type in types)
                {
                    if (methodsTypes.find(type))
                    {
                        continue;
                    }
                    foreach (var method in type.Methods)
                    {
                        if (method.Name == ".ctor" || method.Name == ".cctor")
                        {
                            continue;
                        }

                        MethodDefinition calledMethod;
                        if (!checkRestoreBody(method, out calledMethod))
                        {
                            continue;
                        }
                        if (!checkSameMethods(method, calledMethod))
                        {
                            continue;
                        }
                        if (!methodsTypes.find(calledMethod.DeclaringType))
                        {
                            continue;
                        }
                        if (types.IndexOf(calledMethod.DeclaringType) < 0)
                        {
                            continue;
                        }

                        var list = methodToOrigMethods.find(calledMethod);
                        if (list == null)
                        {
                            methodToOrigMethods.add(calledMethod, list = new List <MethodDefinition>());
                        }
                        list.Add(method);
                    }
                }
            }

            foreach (var calledMethod in methodToOrigMethods.getKeys())
            {
                var list   = methodToOrigMethods.find(calledMethod);
                var method = list[0];

                Log.v("Restored method body {0:X8} from method {1:X8}",
                      method.MetadataToken.ToInt32(),
                      calledMethod.MetadataToken.ToInt32());
                DotNetUtils.copyBodyFromTo(calledMethod, method);
                classMethods.add(calledMethod, method);
            }
        }
コード例 #20
0
        public string decrypt(MethodReference method, object[] args)
        {
            var info = methodToInfo.find(method);

            return(info.decrypt(args));
        }
コード例 #21
0
        void initializeWindowsFormsFieldsAndProps()
        {
            var checker = NameChecker;

            var ourFields = new FieldDefinitionAndDeclaringTypeDict <FieldDef>();

            foreach (var fieldDef in type.AllFields)
            {
                ourFields.add(fieldDef.FieldDefinition, fieldDef);
            }
            var ourMethods = new MethodDefinitionAndDeclaringTypeDict <MethodDef>();

            foreach (var methodDef in type.AllMethods)
            {
                ourMethods.add(methodDef.MethodDefinition, methodDef);
            }

            foreach (var methodDef in type.AllMethods)
            {
                if (methodDef.MethodDefinition.Body == null)
                {
                    continue;
                }
                if (methodDef.MethodDefinition.IsStatic || methodDef.MethodDefinition.IsVirtual)
                {
                    continue;
                }
                var instructions = methodDef.MethodDefinition.Body.Instructions;
                for (int i = 2; i < instructions.Count; i++)
                {
                    var call = instructions[i];
                    if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
                    {
                        continue;
                    }
                    if (!isWindowsFormsSetNameMethod(call.Operand as MethodReference))
                    {
                        continue;
                    }

                    var ldstr = instructions[i - 1];
                    if (ldstr.OpCode.Code != Code.Ldstr)
                    {
                        continue;
                    }
                    var fieldName = ldstr.Operand as string;
                    if (fieldName == null || !checker.isValidFieldName(fieldName))
                    {
                        continue;
                    }

                    var            instr    = instructions[i - 2];
                    FieldReference fieldRef = null;
                    if (instr.OpCode.Code == Code.Call || instr.OpCode.Code == Code.Callvirt)
                    {
                        var calledMethod = instr.Operand as MethodReference;
                        if (calledMethod == null)
                        {
                            continue;
                        }
                        var calledMethodDef = ourMethods.find(calledMethod);
                        if (calledMethodDef == null)
                        {
                            continue;
                        }
                        fieldRef = getFieldReference(calledMethodDef.MethodDefinition);

                        var propDef = calledMethodDef.Property;
                        if (propDef == null)
                        {
                            continue;
                        }

                        memberInfos.prop(propDef).suggestedName = fieldName;
                        fieldName = "_" + fieldName;
                    }
                    else if (instr.OpCode.Code == Code.Ldfld)
                    {
                        fieldRef = instr.Operand as FieldReference;
                    }

                    if (fieldRef == null)
                    {
                        continue;
                    }
                    var fieldDef = ourFields.find(fieldRef);
                    if (fieldDef == null)
                    {
                        continue;
                    }
                    var fieldInfo = memberInfos.field(fieldDef);

                    if (fieldInfo.renamed)
                    {
                        continue;
                    }

                    fieldInfo.suggestedName = variableNameState.getNewFieldName(fieldInfo.oldName, new NameCreator2(fieldName));
                }
            }
        }
コード例 #22
0
        void initTypeEventHandlers(FieldDefinitionAndDeclaringTypeDict <FieldDef> ourFields, MethodDefinitionAndDeclaringTypeDict <MethodDef> ourMethods)
        {
            var checker = NameChecker;

            foreach (var methodDef in type.AllMethods)
            {
                if (methodDef.MethodDefinition.Body == null)
                {
                    continue;
                }
                if (methodDef.MethodDefinition.IsStatic)
                {
                    continue;
                }
                var method       = methodDef.MethodDefinition;
                var instructions = method.Body.Instructions;
                for (int i = 0; i < instructions.Count - 5; i++)
                {
                    // ldarg.0
                    // ldarg.0 / dup
                    // ldarg.0 / dup
                    // ldvirtftn handler
                    // newobj event handler ctor
                    // call add_Xyz

                    if (DotNetUtils.getArgIndex(instructions[i]) != 0)
                    {
                        continue;
                    }
                    int index = i + 1;

                    if (!isThisOrDup(instructions[index++]))
                    {
                        continue;
                    }
                    MethodReference handler;
                    if (instructions[index].OpCode.Code == Code.Ldftn)
                    {
                        handler = instructions[index++].Operand as MethodReference;
                    }
                    else
                    {
                        if (!isThisOrDup(instructions[index++]))
                        {
                            continue;
                        }
                        var instr = instructions[index++];
                        if (instr.OpCode.Code != Code.Ldvirtftn)
                        {
                            continue;
                        }
                        handler = instr.Operand as MethodReference;
                    }
                    if (handler == null)
                    {
                        continue;
                    }
                    var handlerDef = ourMethods.find(handler);
                    if (handlerDef == null)
                    {
                        continue;
                    }

                    var newobj = instructions[index++];
                    if (newobj.OpCode.Code != Code.Newobj)
                    {
                        continue;
                    }
                    if (!isEventHandlerCtor(newobj.Operand as MethodReference))
                    {
                        continue;
                    }

                    var call = instructions[index++];
                    if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
                    {
                        continue;
                    }
                    var addMethod = call.Operand as MethodReference;
                    if (addMethod == null)
                    {
                        continue;
                    }
                    if (!Utils.StartsWith(addMethod.Name, "add_", StringComparison.Ordinal))
                    {
                        continue;
                    }

                    var eventName = addMethod.Name.Substring(4);
                    if (!checker.isValidEventName(eventName))
                    {
                        continue;
                    }

                    memberInfos.method(handlerDef).suggestedName = string.Format("{0}_{1}", newName, eventName);
                }
            }
        }
コード例 #23
0
ファイル: StringDecrypter.cs プロジェクト: kidhudi/de4dot
        public string decrypt(MethodDefinition method)
        {
            var info = methodToInfo.find(method);

            return(Encoding.Unicode.GetString(decryptedData, info.offset, info.length));
        }
コード例 #24
0
 protected virtual bool isExceptionLogger(MethodReference method)
 {
     return(exceptionLoggerMethods.find(method));
 }
コード例 #25
0
        void initFieldEventHandlers(FieldDefinitionAndDeclaringTypeDict <FieldDef> ourFields, MethodDefinitionAndDeclaringTypeDict <MethodDef> ourMethods)
        {
            var checker = NameChecker;

            foreach (var methodDef in type.AllMethods)
            {
                if (methodDef.MethodDefinition.Body == null)
                {
                    continue;
                }
                if (methodDef.MethodDefinition.IsStatic)
                {
                    continue;
                }
                var instructions = methodDef.MethodDefinition.Body.Instructions;
                for (int i = 0; i < instructions.Count - 6; i++)
                {
                    // We're looking for this code pattern:
                    //	ldarg.0
                    //	ldfld field
                    //	ldarg.0
                    //	ldftn method / ldarg.0 + ldvirtftn
                    //	newobj event_handler_ctor
                    //	callvirt add_SomeEvent

                    if (DotNetUtils.getArgIndex(instructions[i]) != 0)
                    {
                        continue;
                    }
                    int index = i + 1;

                    var ldfld = instructions[index++];
                    if (ldfld.OpCode.Code != Code.Ldfld)
                    {
                        continue;
                    }
                    var fieldRef = ldfld.Operand as FieldReference;
                    if (fieldRef == null)
                    {
                        continue;
                    }
                    var fieldDef = ourFields.find(fieldRef);
                    if (fieldDef == null)
                    {
                        continue;
                    }

                    if (DotNetUtils.getArgIndex(instructions[index++]) != 0)
                    {
                        continue;
                    }

                    MethodReference methodRef;
                    var             instr = instructions[index + 1];
                    if (instr.OpCode.Code == Code.Ldvirtftn)
                    {
                        if (!isThisOrDup(instructions[index++]))
                        {
                            continue;
                        }
                        var ldvirtftn = instructions[index++];
                        methodRef = ldvirtftn.Operand as MethodReference;
                    }
                    else
                    {
                        var ldftn = instructions[index++];
                        if (ldftn.OpCode.Code != Code.Ldftn)
                        {
                            continue;
                        }
                        methodRef = ldftn.Operand as MethodReference;
                    }
                    if (methodRef == null)
                    {
                        continue;
                    }
                    var handlerMethod = ourMethods.find(methodRef);
                    if (handlerMethod == null)
                    {
                        continue;
                    }

                    var newobj = instructions[index++];
                    if (newobj.OpCode.Code != Code.Newobj)
                    {
                        continue;
                    }
                    if (!isEventHandlerCtor(newobj.Operand as MethodReference))
                    {
                        continue;
                    }

                    var call = instructions[index++];
                    if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
                    {
                        continue;
                    }
                    var addHandler = call.Operand as MethodReference;
                    if (addHandler == null)
                    {
                        continue;
                    }
                    if (!Utils.StartsWith(addHandler.Name, "add_", StringComparison.Ordinal))
                    {
                        continue;
                    }

                    var eventName = addHandler.Name.Substring(4);
                    if (!checker.isValidEventName(eventName))
                    {
                        continue;
                    }

                    memberInfos.method(handlerMethod).suggestedName = string.Format("{0}_{1}", memberInfos.field(fieldDef).newName, eventName);
                }
            }
        }
コード例 #26
0
 static bool checkAllMethodsUnused(MethodDefinitionAndDeclaringTypeDict<bool> unused, TypeDefinition type)
 {
     foreach (var method in type.Methods) {
         if (!unused.find(method))
             return false;
     }
     return true;
 }
コード例 #27
0
ファイル: StringDecrypter.cs プロジェクト: kidhudi/de4dot
        public string decrypt(MethodDefinition method, int magic1, int magic2, int magic3)
        {
            var info = stringEncrypterInfos.find(method);

            return(info.decrypt(magic1, magic2, magic3));
        }
コード例 #28
0
 public bool isProxyTargetMethod(MethodReference method)
 {
     return(proxyTargetMethods.find(method));
 }