public void Initialize(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) { if (resolverType == null) { return; } encryptedResource = BabelUtils.FindEmbeddedResource(module, resolverType, simpleDeobfuscator, deob); if (encryptedResource == null) { Logger.w("Could not find embedded assemblies resource"); return; } var decrypted = resourceDecrypter.Decrypt(encryptedResource.GetReader().ToArray()); var reader = new BinaryReader(new MemoryStream(decrypted)); int numAssemblies = reader.ReadInt32(); embeddedAssemblyInfos = new EmbeddedAssemblyInfo[numAssemblies]; for (int i = 0; i < numAssemblies; i++) { string name = reader.ReadString(); var data = reader.ReadBytes(reader.ReadInt32()); var mod = ModuleDefMD.Load(data); embeddedAssemblyInfos[i] = new EmbeddedAssemblyInfo(name, DeobUtils.GetExtension(mod.Kind), data); } }
public void Initialize(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) { if (methodsDecrypter == null) { return; } encryptedResource = BabelUtils.FindEmbeddedResource(module, methodsDecrypter, simpleDeobfuscator, deob); if (encryptedResource != null) { AddImageReader("", resourceDecrypter.Decrypt(encryptedResource.CreateReader().ToArray())); } }
public void Find() { var requiredTypes = new string[] { "System.Reflection.Assembly", "System.Object", "System.Int32", "System.String[]", }; foreach (var type in module.Types) { if (type.HasEvents) { continue; } if (!new FieldTypes(type).All(requiredTypes)) { continue; } MethodDef regMethod, handler; if (!BabelUtils.FindRegisterMethod(type, out regMethod, out handler)) { continue; } var resource = BabelUtils.FindEmbeddedResource(module, type); if (resource == null) { continue; } var decryptMethod = FindDecryptMethod(type); if (decryptMethod == null) { throw new ApplicationException("Couldn't find resource type decrypt method"); } resourceDecrypter.DecryptMethod = ResourceDecrypter.FindDecrypterMethod(decryptMethod); InitXorKeys(decryptMethod); resolverType = type; registerMethod = regMethod; encryptedResource = resource; return; } }
public void Initialize(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) { if (decrypterType == null) { return; } encryptedResource = BabelUtils.FindEmbeddedResource(module, decrypterType, simpleDeobfuscator, deob); if (encryptedResource == null) { Logger.w("Could not find encrypted constants resource"); return; } var decrypted = resourceDecrypter.Decrypt(encryptedResource.Data.ReadAllBytes()); var reader = new BinaryReader(new MemoryStream(decrypted)); int count; count = reader.ReadInt32(); decryptedInts = new int[count]; while (count-- > 0) { decryptedInts[count] = reader.ReadInt32(); } count = reader.ReadInt32(); decryptedLongs = new long[count]; while (count-- > 0) { decryptedLongs[count] = reader.ReadInt64(); } count = reader.ReadInt32(); decryptedFloats = new float[count]; while (count-- > 0) { decryptedFloats[count] = reader.ReadSingle(); } count = reader.ReadInt32(); decryptedDoubles = new double[count]; while (count-- > 0) { decryptedDoubles[count] = reader.ReadDouble(); } }
public void Initialize() { if (decrypterType == null) { return; } if (encryptedResource != null) { return; } if (decrypterInfo.NeedsResource) { encryptedResource = BabelUtils.FindEmbeddedResource(module, decrypterType); if (encryptedResource == null) { return; } } decrypterInfo.Initialize(module, encryptedResource); }