コード例 #1
0
        bool remove(Blocks blocks, Block block)
        {
            var instrs = block.Instructions;
            const int numInstrsToRemove = 11;
            if (instrs.Count < numInstrsToRemove)
                return false;
            int startIndex = instrs.Count - numInstrsToRemove;
            int index = startIndex;

            if (instrs[index++].OpCode.Code != Code.Ldtoken)
                return false;
            if (!checkCall(instrs[index++], "System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)"))
                return false;
            if (!checkCall(instrs[index++], "System.Reflection.Assembly System.Type::get_Assembly()"))
                return false;
            if (!checkCall(instrs[index++], "System.Reflection.AssemblyName System.Reflection.Assembly::GetName()"))
                return false;
            if (!checkCall(instrs[index++], "System.Byte[] System.Reflection.AssemblyName::GetPublicKeyToken()"))
                return false;
            if (!checkCall(instrs[index++], "System.String System.Convert::ToBase64String(System.Byte[])"))
                return false;
            if (instrs[index++].OpCode.Code != Code.Ldstr)
                return false;
            if (!checkCall(instrs[index++], "System.String", "(System.String,System.String)"))
                return false;
            if (instrs[index++].OpCode.Code != Code.Ldstr)
                return false;
            if (!checkCall(instrs[index++], "System.Boolean System.String::op_Inequality(System.String,System.String)"))
                return false;
            if (!instrs[index++].isBrfalse())
                return false;

            var badBlock = block.FallThrough;
            var goodblock = block.Targets[0];
            if (badBlock == null)
                return false;

            if (badBlock == goodblock) {
                // All of the bad block was removed by the cflow deobfuscator. It was just a useless
                // calculation (div by zero).
                block.replaceLastInstrsWithBranch(numInstrsToRemove, goodblock);
            }
            else if (badBlock.Sources.Count == 1) {
                instrs = badBlock.Instructions;
                if (instrs.Count != 12)
                    return false;
                index = 0;
                if (!instrs[index++].isLdcI4())
                    return false;
                if (!instrs[index].isStloc())
                    return false;
                var local = Instr.getLocalVar(blocks.Locals, instrs[index++]);
                if (local == null)
                    return false;
                if (!checkLdloc(blocks.Locals, instrs[index++], local))
                    return false;
                if (!checkLdloc(blocks.Locals, instrs[index++], local))
                    return false;
                if (instrs[index++].OpCode.Code != Code.Sub)
                    return false;
                if (instrs[index++].OpCode.Code != Code.Conv_U1)
                    return false;
                if (!checkStloc(blocks.Locals, instrs[index++], local))
                    return false;
                if (!checkLdloc(blocks.Locals, instrs[index++], local))
                    return false;
                if (!checkLdloc(blocks.Locals, instrs[index++], local))
                    return false;
                if (instrs[index++].OpCode.Code != Code.Div)
                    return false;
                if (instrs[index++].OpCode.Code != Code.Conv_U1)
                    return false;
                if (!checkStloc(blocks.Locals, instrs[index++], local))
                    return false;

                block.replaceLastInstrsWithBranch(numInstrsToRemove, goodblock);
                badBlock.Parent.removeDeadBlock(badBlock);
            }
            else
                return false;

            return true;
        }