protected override void inlineAllCalls() { foreach (var tmp in callResults) { var callResult = (MyCallResult)tmp; var handler = stringDecrypters.find(callResult.methodReference); callResult.returnValue = handler((MethodDefinition)callResult.methodReference, callResult.gim, callResult.args); } }
public void add(MethodDefinition method, Func <MethodDefinition, object[], TValue> handler) { if (method == null) { return; } if (decrypterMethods.find(method) != null) { throw new ApplicationException(string.Format("Handler for method {0:X8} has already been added", method.MetadataToken.ToInt32())); } if (method != null) { decrypterMethods.add(method, handler); } }
public void deobfuscate(Blocks blocks) { foreach (var block in blocks.MethodBlocks.getAllBlocks()) { var instrs = block.Instructions; for (int i = 0; i < instrs.Count; i++) { var instr = instrs[i]; if (instr.OpCode.Code != Code.Newobj) { continue; } var ctor = instr.Operand as MethodReference; if (ctor == null) { continue; } var newCtor = resourceManagerCtors.find(ctor); if (newCtor == null) { newCtor = componentManagerCtors.find(ctor); } if (newCtor == null) { continue; } instr.Operand = newCtor; } } }
public void deobfuscate(Blocks blocks) { foreach (var block in blocks.MethodBlocks.getAllBlocks()) { var instrs = block.Instructions; for (int i = 0; i < instrs.Count; i++) { var call = instrs[i]; if (call.OpCode.Code != Code.Call) { continue; } var calledMethod = call.Operand as MethodDefinition; if (calledMethod == null) { continue; } var newMethodInfo = oldToNewMethod.find(calledMethod); if (newMethodInfo == null) { continue; } instrs[i] = new Instr(Instruction.Create(newMethodInfo.opCode, newMethodInfo.method)); } } }
public void add(MethodDefinition method, MethodDefinition methodToBeRemoved) { if (method == null || methodToBeRemoved == null) { return; } checkMethod(methodToBeRemoved); var dict = methodRefInfos.find(method); if (dict == null) { methodRefInfos.add(method, dict = new MethodDefinitionAndDeclaringTypeDict <bool>()); } dict.add(methodToBeRemoved, true); }
void removeCalls(IList <Block> allBlocks, Blocks blocks, MethodDefinitionAndDeclaringTypeDict <bool> info) { var instrsToDelete = new List <int>(); foreach (var block in allBlocks) { instrsToDelete.Clear(); for (int i = 0; i < block.Instructions.Count; i++) { var instr = block.Instructions[i]; if (instr.OpCode != OpCodes.Call) { continue; } var destMethod = instr.Operand as MethodReference; if (destMethod == null) { continue; } if (info.find(destMethod)) { Log.v("Removed call to {0}", Utils.removeNewlines(destMethod)); instrsToDelete.Add(i); } } block.remove(instrsToDelete); } }
protected override bool deobfuscate(Blocks blocks, IList <Block> allBlocks) { var removeInfos = new Dictionary <Block, List <RemoveInfo> >(); foreach (var block in allBlocks) { var instrs = block.Instructions; for (int i = 0; i < instrs.Count; i++) { var instr = instrs[i]; if (instr.OpCode != OpCodes.Call) { continue; } var method = instr.Operand as MethodReference; if (method == null) { continue; } var di = proxyMethodToDelegateInfo.find(method); if (di == null) { continue; } add(removeInfos, block, i, di); } } return(fixProxyCalls(removeInfos)); }
// VB initializes the handlers in the property setter, where it first removes the handler // from the previous control, and then adds the handler to the new control. void initVbEventHandlers(FieldDefinitionAndDeclaringTypeDict <FieldDef> ourFields, MethodDefinitionAndDeclaringTypeDict <MethodDef> ourMethods) { var checker = NameChecker; foreach (var propDef in type.AllProperties) { var setterDef = propDef.SetMethod; if (setterDef == null) { continue; } string eventName; var handler = getVbHandler(setterDef.MethodDefinition, out eventName); if (handler == null) { continue; } var handlerDef = ourMethods.find(handler); if (handlerDef == null) { continue; } if (!checker.isValidEventName(eventName)) { continue; } memberInfos.method(handlerDef).suggestedName = string.Format("{0}_{1}", memberInfos.prop(propDef).newName, eventName); } }
protected override object checkCctor(TypeDefinition type, MethodDefinition cctor) { var instructions = cctor.Body.Instructions; for (int i = 0; i < instructions.Count; i++) { TypeReference delegateType; FieldReference delegateField; MethodReference createMethod; int methodToken, declaringTypeToken; var instrs = DotNetUtils.getInstructions(instructions, i, OpCodes.Ldtoken, OpCodes.Ldc_I4, OpCodes.Ldc_I4, OpCodes.Ldtoken, OpCodes.Call); if (instrs != null) { delegateType = instrs[0].Operand as TypeReference; methodToken = DotNetUtils.getLdcI4Value(instrs[1]); declaringTypeToken = DotNetUtils.getLdcI4Value(instrs[2]); delegateField = instrs[3].Operand as FieldReference; createMethod = instrs[4].Operand as MethodReference; } else if ((instrs = DotNetUtils.getInstructions(instructions, i, OpCodes.Ldtoken, OpCodes.Ldc_I4, OpCodes.Ldtoken, OpCodes.Call)) != null) { delegateType = instrs[0].Operand as TypeReference; methodToken = DotNetUtils.getLdcI4Value(instrs[1]); declaringTypeToken = -1; delegateField = instrs[2].Operand as FieldReference; createMethod = instrs[3].Operand as MethodReference; } else { continue; } if (delegateType == null) { continue; } if (delegateField == null) { continue; } if (createMethod == null) { continue; } var proxyCreatorType = methodToType.find(createMethod); if (proxyCreatorType == ProxyCreatorType.None) { continue; } return(new Context(delegateType, methodToken, declaringTypeToken, proxyCreatorType)); } return(null); }
static bool checkAllMethodsUnused(MethodDefinitionAndDeclaringTypeDict <bool> unused, TypeDefinition type) { foreach (var method in type.Methods) { if (!unused.find(method)) { return(false); } } return(true); }
protected Info getInfo(MethodDefinition method) { var info = decrypterMethods.find(method); if (info == null) { return(null); } info.referenced = true; return(info); }
public bool exists(MethodReference method) { if (method == null) { return(false); } if (method.DeclaringType != null && types.find(method.DeclaringType)) { return(true); } return(methods.find(method)); }
public void deobfuscate(Blocks blocks) { foreach (var block in blocks.MethodBlocks.getAllBlocks()) { var instrs = block.Instructions; for (int i = 0; i < instrs.Count; i++) { var call = instrs[i]; if (call.OpCode.Code != Code.Call) { continue; } var realInstanceMethod = classMethods.find(call.Operand as MethodReference); if (realInstanceMethod == null) { continue; } call.Operand = realInstanceMethod; } } }
// VB initializes the handlers in the property setter, where it first removes the handler // from the previous control, and then adds the handler to the new control. void initVbEventHandlers(FieldDefinitionAndDeclaringTypeDict<FieldDef> ourFields, MethodDefinitionAndDeclaringTypeDict<MethodDef> ourMethods) { var checker = NameChecker; foreach (var propDef in type.AllProperties) { var setterDef = propDef.SetMethod; if (setterDef == null) continue; string eventName; var handler = getVbHandler(setterDef.MethodDefinition, out eventName); if (handler == null) continue; var handlerDef = ourMethods.find(handler); if (handlerDef == null) continue; if (!checker.isValidEventName(eventName)) continue; memberInfos.method(handlerDef).suggestedName = string.Format("{0}_{1}", memberInfos.prop(propDef).newName, eventName); } }
void initTypeEventHandlers(FieldDefinitionAndDeclaringTypeDict<FieldDef> ourFields, MethodDefinitionAndDeclaringTypeDict<MethodDef> ourMethods) { var checker = NameChecker; foreach (var methodDef in type.AllMethods) { if (methodDef.MethodDefinition.Body == null) continue; if (methodDef.MethodDefinition.IsStatic) continue; var method = methodDef.MethodDefinition; var instructions = method.Body.Instructions; for (int i = 0; i < instructions.Count - 5; i++) { // ldarg.0 // ldarg.0 / dup // ldarg.0 / dup // ldvirtftn handler // newobj event handler ctor // call add_Xyz if (DotNetUtils.getArgIndex(instructions[i]) != 0) continue; int index = i + 1; if (!isThisOrDup(instructions[index++])) continue; MethodReference handler; if (instructions[index].OpCode.Code == Code.Ldftn) { handler = instructions[index++].Operand as MethodReference; } else { if (!isThisOrDup(instructions[index++])) continue; var instr = instructions[index++]; if (instr.OpCode.Code != Code.Ldvirtftn) continue; handler = instr.Operand as MethodReference; } if (handler == null) continue; var handlerDef = ourMethods.find(handler); if (handlerDef == null) continue; var newobj = instructions[index++]; if (newobj.OpCode.Code != Code.Newobj) continue; if (!isEventHandlerCtor(newobj.Operand as MethodReference)) continue; var call = instructions[index++]; if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt) continue; var addMethod = call.Operand as MethodReference; if (addMethod == null) continue; if (!Utils.StartsWith(addMethod.Name, "add_", StringComparison.Ordinal)) continue; var eventName = addMethod.Name.Substring(4); if (!checker.isValidEventName(eventName)) continue; memberInfos.method(handlerDef).suggestedName = string.Format("{0}_{1}", newName, eventName); } } }
void initializeWindowsFormsFieldsAndProps() { var checker = NameChecker; var ourFields = new FieldDefinitionAndDeclaringTypeDict<FieldDef>(); foreach (var fieldDef in type.AllFields) ourFields.add(fieldDef.FieldDefinition, fieldDef); var ourMethods = new MethodDefinitionAndDeclaringTypeDict<MethodDef>(); foreach (var methodDef in type.AllMethods) ourMethods.add(methodDef.MethodDefinition, methodDef); foreach (var methodDef in type.AllMethods) { if (methodDef.MethodDefinition.Body == null) continue; if (methodDef.MethodDefinition.IsStatic || methodDef.MethodDefinition.IsVirtual) continue; var instructions = methodDef.MethodDefinition.Body.Instructions; for (int i = 2; i < instructions.Count; i++) { var call = instructions[i]; if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt) continue; if (!isWindowsFormsSetNameMethod(call.Operand as MethodReference)) continue; var ldstr = instructions[i - 1]; if (ldstr.OpCode.Code != Code.Ldstr) continue; var fieldName = ldstr.Operand as string; if (fieldName == null || !checker.isValidFieldName(fieldName)) continue; var instr = instructions[i - 2]; FieldReference fieldRef = null; if (instr.OpCode.Code == Code.Call || instr.OpCode.Code == Code.Callvirt) { var calledMethod = instr.Operand as MethodReference; if (calledMethod == null) continue; var calledMethodDef = ourMethods.find(calledMethod); if (calledMethodDef == null) continue; fieldRef = getFieldReference(calledMethodDef.MethodDefinition); var propDef = calledMethodDef.Property; if (propDef == null) continue; memberInfos.prop(propDef).suggestedName = fieldName; fieldName = "_" + fieldName; } else if (instr.OpCode.Code == Code.Ldfld) { fieldRef = instr.Operand as FieldReference; } if (fieldRef == null) continue; var fieldDef = ourFields.find(fieldRef); if (fieldDef == null) continue; var fieldInfo = memberInfos.field(fieldDef); if (fieldInfo.renamed) continue; fieldInfo.suggestedName = variableNameState.getNewFieldName(fieldInfo.oldName, new NameCreator2(fieldName)); } } }
void initFieldEventHandlers(FieldDefinitionAndDeclaringTypeDict<FieldDef> ourFields, MethodDefinitionAndDeclaringTypeDict<MethodDef> ourMethods) { var checker = NameChecker; foreach (var methodDef in type.AllMethods) { if (methodDef.MethodDefinition.Body == null) continue; if (methodDef.MethodDefinition.IsStatic) continue; var instructions = methodDef.MethodDefinition.Body.Instructions; for (int i = 0; i < instructions.Count - 6; i++) { // We're looking for this code pattern: // ldarg.0 // ldfld field // ldarg.0 // ldftn method / ldarg.0 + ldvirtftn // newobj event_handler_ctor // callvirt add_SomeEvent if (DotNetUtils.getArgIndex(instructions[i]) != 0) continue; int index = i + 1; var ldfld = instructions[index++]; if (ldfld.OpCode.Code != Code.Ldfld) continue; var fieldRef = ldfld.Operand as FieldReference; if (fieldRef == null) continue; var fieldDef = ourFields.find(fieldRef); if (fieldDef == null) continue; if (DotNetUtils.getArgIndex(instructions[index++]) != 0) continue; MethodReference methodRef; var instr = instructions[index + 1]; if (instr.OpCode.Code == Code.Ldvirtftn) { if (!isThisOrDup(instructions[index++])) continue; var ldvirtftn = instructions[index++]; methodRef = ldvirtftn.Operand as MethodReference; } else { var ldftn = instructions[index++]; if (ldftn.OpCode.Code != Code.Ldftn) continue; methodRef = ldftn.Operand as MethodReference; } if (methodRef == null) continue; var handlerMethod = ourMethods.find(methodRef); if (handlerMethod == null) continue; var newobj = instructions[index++]; if (newobj.OpCode.Code != Code.Newobj) continue; if (!isEventHandlerCtor(newobj.Operand as MethodReference)) continue; var call = instructions[index++]; if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt) continue; var addHandler = call.Operand as MethodReference; if (addHandler == null) continue; if (!Utils.StartsWith(addHandler.Name, "add_", StringComparison.Ordinal)) continue; var eventName = addHandler.Name.Substring(4); if (!checker.isValidEventName(eventName)) continue; memberInfos.method(handlerMethod).suggestedName = string.Format("{0}_{1}", memberInfos.field(fieldDef).newName, eventName); } } }
void restoreMethodBodies() { var methodToOrigMethods = new MethodDefinitionAndDeclaringTypeDict<List<MethodDefinition>>(); foreach (var t in module.Types) { var types = new List<TypeDefinition>(TypeDefinition.GetTypes(new List<TypeDefinition> { t })); foreach (var type in types) { if (methodsTypes.find(type)) continue; foreach (var method in type.Methods) { if (method.Name == ".ctor" || method.Name == ".cctor") continue; MethodDefinition calledMethod; if (!checkRestoreBody(method, out calledMethod)) continue; if (!checkSameMethods(method, calledMethod)) continue; if (!methodsTypes.find(calledMethod.DeclaringType)) continue; if (types.IndexOf(calledMethod.DeclaringType) < 0) continue; var list = methodToOrigMethods.find(calledMethod); if (list == null) methodToOrigMethods.add(calledMethod, list = new List<MethodDefinition>()); list.Add(method); } } } foreach (var calledMethod in methodToOrigMethods.getKeys()) { var list = methodToOrigMethods.find(calledMethod); var method = list[0]; Log.v("Restored method body {0:X8} from method {1:X8}", method.MetadataToken.ToInt32(), calledMethod.MetadataToken.ToInt32()); DotNetUtils.copyBodyFromTo(calledMethod, method); classMethods.add(calledMethod, method); } }
void restoreMethodBodies() { var methodToOrigMethods = new MethodDefinitionAndDeclaringTypeDict <List <MethodDefinition> >(); foreach (var t in module.Types) { var types = new List <TypeDefinition>(TypeDefinition.GetTypes(new List <TypeDefinition> { t })); foreach (var type in types) { if (methodsTypes.find(type)) { continue; } foreach (var method in type.Methods) { if (method.Name == ".ctor" || method.Name == ".cctor") { continue; } MethodDefinition calledMethod; if (!checkRestoreBody(method, out calledMethod)) { continue; } if (!checkSameMethods(method, calledMethod)) { continue; } if (!methodsTypes.find(calledMethod.DeclaringType)) { continue; } if (types.IndexOf(calledMethod.DeclaringType) < 0) { continue; } var list = methodToOrigMethods.find(calledMethod); if (list == null) { methodToOrigMethods.add(calledMethod, list = new List <MethodDefinition>()); } list.Add(method); } } } foreach (var calledMethod in methodToOrigMethods.getKeys()) { var list = methodToOrigMethods.find(calledMethod); var method = list[0]; Log.v("Restored method body {0:X8} from method {1:X8}", method.MetadataToken.ToInt32(), calledMethod.MetadataToken.ToInt32()); DotNetUtils.copyBodyFromTo(calledMethod, method); classMethods.add(calledMethod, method); } }
public string decrypt(MethodReference method, object[] args) { var info = methodToInfo.find(method); return(info.decrypt(args)); }
void initializeWindowsFormsFieldsAndProps() { var checker = NameChecker; var ourFields = new FieldDefinitionAndDeclaringTypeDict <FieldDef>(); foreach (var fieldDef in type.AllFields) { ourFields.add(fieldDef.FieldDefinition, fieldDef); } var ourMethods = new MethodDefinitionAndDeclaringTypeDict <MethodDef>(); foreach (var methodDef in type.AllMethods) { ourMethods.add(methodDef.MethodDefinition, methodDef); } foreach (var methodDef in type.AllMethods) { if (methodDef.MethodDefinition.Body == null) { continue; } if (methodDef.MethodDefinition.IsStatic || methodDef.MethodDefinition.IsVirtual) { continue; } var instructions = methodDef.MethodDefinition.Body.Instructions; for (int i = 2; i < instructions.Count; i++) { var call = instructions[i]; if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt) { continue; } if (!isWindowsFormsSetNameMethod(call.Operand as MethodReference)) { continue; } var ldstr = instructions[i - 1]; if (ldstr.OpCode.Code != Code.Ldstr) { continue; } var fieldName = ldstr.Operand as string; if (fieldName == null || !checker.isValidFieldName(fieldName)) { continue; } var instr = instructions[i - 2]; FieldReference fieldRef = null; if (instr.OpCode.Code == Code.Call || instr.OpCode.Code == Code.Callvirt) { var calledMethod = instr.Operand as MethodReference; if (calledMethod == null) { continue; } var calledMethodDef = ourMethods.find(calledMethod); if (calledMethodDef == null) { continue; } fieldRef = getFieldReference(calledMethodDef.MethodDefinition); var propDef = calledMethodDef.Property; if (propDef == null) { continue; } memberInfos.prop(propDef).suggestedName = fieldName; fieldName = "_" + fieldName; } else if (instr.OpCode.Code == Code.Ldfld) { fieldRef = instr.Operand as FieldReference; } if (fieldRef == null) { continue; } var fieldDef = ourFields.find(fieldRef); if (fieldDef == null) { continue; } var fieldInfo = memberInfos.field(fieldDef); if (fieldInfo.renamed) { continue; } fieldInfo.suggestedName = variableNameState.getNewFieldName(fieldInfo.oldName, new NameCreator2(fieldName)); } } }
void initTypeEventHandlers(FieldDefinitionAndDeclaringTypeDict <FieldDef> ourFields, MethodDefinitionAndDeclaringTypeDict <MethodDef> ourMethods) { var checker = NameChecker; foreach (var methodDef in type.AllMethods) { if (methodDef.MethodDefinition.Body == null) { continue; } if (methodDef.MethodDefinition.IsStatic) { continue; } var method = methodDef.MethodDefinition; var instructions = method.Body.Instructions; for (int i = 0; i < instructions.Count - 5; i++) { // ldarg.0 // ldarg.0 / dup // ldarg.0 / dup // ldvirtftn handler // newobj event handler ctor // call add_Xyz if (DotNetUtils.getArgIndex(instructions[i]) != 0) { continue; } int index = i + 1; if (!isThisOrDup(instructions[index++])) { continue; } MethodReference handler; if (instructions[index].OpCode.Code == Code.Ldftn) { handler = instructions[index++].Operand as MethodReference; } else { if (!isThisOrDup(instructions[index++])) { continue; } var instr = instructions[index++]; if (instr.OpCode.Code != Code.Ldvirtftn) { continue; } handler = instr.Operand as MethodReference; } if (handler == null) { continue; } var handlerDef = ourMethods.find(handler); if (handlerDef == null) { continue; } var newobj = instructions[index++]; if (newobj.OpCode.Code != Code.Newobj) { continue; } if (!isEventHandlerCtor(newobj.Operand as MethodReference)) { continue; } var call = instructions[index++]; if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt) { continue; } var addMethod = call.Operand as MethodReference; if (addMethod == null) { continue; } if (!Utils.StartsWith(addMethod.Name, "add_", StringComparison.Ordinal)) { continue; } var eventName = addMethod.Name.Substring(4); if (!checker.isValidEventName(eventName)) { continue; } memberInfos.method(handlerDef).suggestedName = string.Format("{0}_{1}", newName, eventName); } } }
public string decrypt(MethodDefinition method) { var info = methodToInfo.find(method); return(Encoding.Unicode.GetString(decryptedData, info.offset, info.length)); }
protected virtual bool isExceptionLogger(MethodReference method) { return(exceptionLoggerMethods.find(method)); }
void initFieldEventHandlers(FieldDefinitionAndDeclaringTypeDict <FieldDef> ourFields, MethodDefinitionAndDeclaringTypeDict <MethodDef> ourMethods) { var checker = NameChecker; foreach (var methodDef in type.AllMethods) { if (methodDef.MethodDefinition.Body == null) { continue; } if (methodDef.MethodDefinition.IsStatic) { continue; } var instructions = methodDef.MethodDefinition.Body.Instructions; for (int i = 0; i < instructions.Count - 6; i++) { // We're looking for this code pattern: // ldarg.0 // ldfld field // ldarg.0 // ldftn method / ldarg.0 + ldvirtftn // newobj event_handler_ctor // callvirt add_SomeEvent if (DotNetUtils.getArgIndex(instructions[i]) != 0) { continue; } int index = i + 1; var ldfld = instructions[index++]; if (ldfld.OpCode.Code != Code.Ldfld) { continue; } var fieldRef = ldfld.Operand as FieldReference; if (fieldRef == null) { continue; } var fieldDef = ourFields.find(fieldRef); if (fieldDef == null) { continue; } if (DotNetUtils.getArgIndex(instructions[index++]) != 0) { continue; } MethodReference methodRef; var instr = instructions[index + 1]; if (instr.OpCode.Code == Code.Ldvirtftn) { if (!isThisOrDup(instructions[index++])) { continue; } var ldvirtftn = instructions[index++]; methodRef = ldvirtftn.Operand as MethodReference; } else { var ldftn = instructions[index++]; if (ldftn.OpCode.Code != Code.Ldftn) { continue; } methodRef = ldftn.Operand as MethodReference; } if (methodRef == null) { continue; } var handlerMethod = ourMethods.find(methodRef); if (handlerMethod == null) { continue; } var newobj = instructions[index++]; if (newobj.OpCode.Code != Code.Newobj) { continue; } if (!isEventHandlerCtor(newobj.Operand as MethodReference)) { continue; } var call = instructions[index++]; if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt) { continue; } var addHandler = call.Operand as MethodReference; if (addHandler == null) { continue; } if (!Utils.StartsWith(addHandler.Name, "add_", StringComparison.Ordinal)) { continue; } var eventName = addHandler.Name.Substring(4); if (!checker.isValidEventName(eventName)) { continue; } memberInfos.method(handlerMethod).suggestedName = string.Format("{0}_{1}", memberInfos.field(fieldDef).newName, eventName); } } }
static bool checkAllMethodsUnused(MethodDefinitionAndDeclaringTypeDict<bool> unused, TypeDefinition type) { foreach (var method in type.Methods) { if (!unused.find(method)) return false; } return true; }
public string decrypt(MethodDefinition method, int magic1, int magic2, int magic3) { var info = stringEncrypterInfos.find(method); return(info.decrypt(magic1, magic2, magic3)); }
public bool isProxyTargetMethod(MethodReference method) { return(proxyTargetMethods.find(method)); }