public override void deobfuscateEnd() { bool canRemoveProxyTypes = proxyCallFixer.CanRemoveTypes; if (CanRemoveStringDecrypterType) { addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type"); } if (!mainType.Detected) { } else if (mainType.Version >= ObfuscatorVersion.V5_0) { if (!proxyCallFixer.FoundProxyType || canRemoveProxyTypes) { addTypeToBeRemoved(mainType.Type, "Main CV type"); } } else { var type = mainType.Type; if (!type.HasNestedTypes && !type.HasProperties && !type.HasEvents && !type.HasFields) { addTypeToBeRemoved(type, "Main CV type"); } else { foreach (var method in type.Methods) { addMethodToBeRemoved(method, "CV main type method"); } } } removeProxyDelegates(proxyCallFixer, canRemoveProxyTypes); if (canRemoveProxyTypes) { addTypeToBeRemoved(proxyCallFixer.IlGeneratorType, "Obfuscator proxy method ILGenerator type"); addTypeToBeRemoved(proxyCallFixer.FieldInfoType, "Obfuscator proxy method FieldInfo type"); addTypeToBeRemoved(proxyCallFixer.MethodInfoType, "Obfuscator proxy method MethodInfo type"); } addMethodsToBeRemoved(InvalidMethodsFinder.findAll(module), "Anti-reflection method"); base.deobfuscateEnd(); }
bool IsTamperDetectionClass(TypeDef type) { if (type.BaseType == null || type.BaseType.FullName != "System.Object") { return(false); } if ((type.Attributes & ~TypeAttributes.Sealed) != TypeAttributes.NestedAssembly) { return(false); } MethodDef cctor = null, initMethod = null; foreach (var method in type.Methods) { if (InvalidMethodsFinder.IsInvalidMethod(method)) { continue; } if (!method.IsStatic || method.Body == null) { return(false); } if (method.Name == ".cctor") { cctor = method; } else if (DotNetUtils.IsMethod(method, "System.Void", "()")) { initMethod = method; } } if (cctor == null || initMethod == null) { return(false); } if (!CallsMainTypeTamperCheckMethod(cctor)) { return(false); } return(true); }