public void initialize(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) { if (resolverType == null) { return; } encryptedResource = BabelUtils.findEmbeddedResource(module, resolverType, simpleDeobfuscator, deob); if (encryptedResource == null) { Logger.w("Could not find embedded assemblies resource"); return; } var decrypted = resourceDecrypter.decrypt(encryptedResource.Data.ReadAllBytes()); var reader = new BinaryReader(new MemoryStream(decrypted)); int numAssemblies = reader.ReadInt32(); embeddedAssemblyInfos = new EmbeddedAssemblyInfo[numAssemblies]; for (int i = 0; i < numAssemblies; i++) { string name = reader.ReadString(); var data = reader.ReadBytes(reader.ReadInt32()); var mod = ModuleDefMD.Load(data); embeddedAssemblyInfos[i] = new EmbeddedAssemblyInfo(name, DeobUtils.getExtension(mod.Kind), data); } }
public void initialize(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) { if (methodsDecrypter == null) { return; } encryptedResource = BabelUtils.findEmbeddedResource(module, methodsDecrypter, simpleDeobfuscator, deob); if (encryptedResource != null) { addImageReader("", resourceDecrypter.decrypt(encryptedResource.GetResourceData())); } }
public void initialize(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) { if (methodsDecrypter == null) { return; } encryptedResource = BabelUtils.findEmbeddedResource(module, methodsDecrypter, simpleDeobfuscator, deob); if (encryptedResource == null) { Log.w("Could not find encrypted methods resource"); return; } addImageReader("", new ResourceDecrypter(module).decrypt(encryptedResource.GetResourceData())); }
public void initialize(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) { if (decrypterType == null) { return; } encryptedResource = BabelUtils.findEmbeddedResource(module, decrypterType, simpleDeobfuscator, deob); if (encryptedResource == null) { Log.w("Could not find encrypted constants resource"); return; } var decrypted = resourceDecrypter.decrypt(encryptedResource.GetResourceData()); var reader = new BinaryReader(new MemoryStream(decrypted)); int count; count = reader.ReadInt32(); decryptedInts = new int[count]; while (count-- > 0) { decryptedInts[count] = reader.ReadInt32(); } count = reader.ReadInt32(); decryptedLongs = new long[count]; while (count-- > 0) { decryptedLongs[count] = reader.ReadInt64(); } count = reader.ReadInt32(); decryptedFloats = new float[count]; while (count-- > 0) { decryptedFloats[count] = reader.ReadSingle(); } count = reader.ReadInt32(); decryptedDoubles = new double[count]; while (count-- > 0) { decryptedDoubles[count] = reader.ReadDouble(); } }
public void find() { var requiredTypes = new string[] { "System.Reflection.Assembly", "System.Object", "System.Int32", "System.String[]", }; foreach (var type in module.Types) { if (type.HasEvents) { continue; } if (!new FieldTypes(type).all(requiredTypes)) { continue; } MethodDefinition regMethod, handler; if (!BabelUtils.findRegisterMethod(type, out regMethod, out handler)) { continue; } var resource = BabelUtils.findEmbeddedResource(module, type); if (resource == null) { continue; } var decryptMethod = findDecryptMethod(type); if (decryptMethod == null) { throw new ApplicationException("Couldn't find resource type decrypt method"); } resourceDecrypter.DecryptMethod = ResourceDecrypter.findDecrypterMethod(decryptMethod); initXorKeys(decryptMethod); resolverType = type; registerMethod = regMethod; encryptedResource = resource; return; } }
public void initialize() { if (decrypterType == null) { return; } if (encryptedResource != null) { return; } if (decrypterInfo.NeedsResource) { encryptedResource = BabelUtils.findEmbeddedResource(module, decrypterType); if (encryptedResource == null) { return; } } decrypterInfo.initialize(module, encryptedResource); }
public void find() { var requiredTypes = new string[] { "System.Reflection.Assembly", "System.Object", "System.Int32", "System.String[]", }; foreach (var type in module.Types) { if (type.HasEvents) { continue; } if (!new FieldTypes(type).exactly(requiredTypes)) { continue; } MethodDefinition regMethod, handler; if (!BabelUtils.findRegisterMethod(type, out regMethod, out handler)) { continue; } var resource = BabelUtils.findEmbeddedResource(module, type); if (resource == null) { continue; } resolverType = type; registerMethod = regMethod; encryptedResource = resource; return; } }