public unsafe DecrypterV2_0_13_0_Base(DynamicMethodsDecrypter dmd) { this.dmd = dmd; invoker = (Delegate)dmd.invokerFieldInfo.GetValue(null); byte* p = (byte*)DecrypterBaseV2_0_12_x.GetStateAddr(invoker.Target); byte* pis = GetAddr(*(byte**)p); p = *(byte**)pis; byte* pam = *(byte**)(p + IntPtr.Size * 2); p = *(byte**)(p + ((Environment.Version.Major - 2) / 2 * IntPtr.Size)); p += IntPtr.Size * 8 + 0x18; p = LookUp(p, AppDomain.CurrentDomain.Id); p = *(byte**)(p + IntPtr.Size * 16 + 0x18); byte* pd = p + IntPtr.Size * 2; p = *(byte**)(p + IntPtr.Size * 13); getCallerMethodAsILByteArrayDelegate = GetCallerMethodAsILByteArray; decryptCallbackDelegate = DecryptCallback; ignoreDelegate = IgnoreMethod; byte* pm = p + 0x28 * IntPtr.Size; *(IntPtr*)(p + 0x29 * IntPtr.Size) = Marshal.GetFunctionPointerForDelegate(getCallerMethodAsILByteArrayDelegate); *(IntPtr*)(p + 0x2A * IntPtr.Size) = Marshal.GetFunctionPointerForDelegate(decryptCallbackDelegate); if (IntPtr.Size == 4) *(IntPtr*)(p + 0x2B * IntPtr.Size) = Marshal.GetFunctionPointerForDelegate(ignoreDelegate); InitCode(GetModuleHandle(pis), pam, pd, pm); }
public DecrypterV2_0_0_0(DynamicMethodsDecrypter dmd, FieldDef delegateField) : base(dmd) { var addr = GetDelegateAddress(delegateField); decryptMethod = (DecryptMethod)Marshal.GetDelegateForFunctionPointer(addr, typeof(DecryptMethod)); }
public unsafe DecrypterV2_0_12_3(DynamicMethodsDecrypter dmd) : base(dmd) { getCallerMethodAsILByteArrayDelegate = GetCallerMethodAsILByteArray; decryptCallbackDelegate = DecryptCallback; *(IntPtr*)pGetILBytes = Marshal.GetFunctionPointerForDelegate(getCallerMethodAsILByteArrayDelegate); *(IntPtr*)pDecryptCallback = Marshal.GetFunctionPointerForDelegate(decryptCallbackDelegate); }
public DecrypterV2_0_8_5(DynamicMethodsDecrypter dmd, FieldDef delegateField) : base(dmd) { IntPtr addr = GetDelegateAddress(delegateField); decryptMethod = (DecryptMethod)Marshal.GetDelegateForFunctionPointer(addr, typeof(DecryptMethod)); PatchRuntime(addr); }
IList<DecryptedMethodInfo> DecryptMethods(IList<int> methodIds) { using (var decrypter = new DynamicMethodsDecrypter(obfModule, reflObfModule)) { decrypter.Initialize(); var infos = new List<DecryptedMethodInfo>(); for (int i = 0; i < methodIds.Count; i += 2) infos.Add(decrypter.Decrypt(methodIds[i], (uint)methodIds[i + 1])); return infos; } }
protected unsafe DecrypterBaseV2_0_12_x(DynamicMethodsDecrypter dmd) { this.dmd = dmd; invoker = (Delegate)dmd.invokerFieldInfo.GetValue(null); byte* p = (byte*)GetStateAddr(invoker.Target); p += IntPtr.Size * 3; p = *(byte**)p; p += 8 + IntPtr.Size * 8; p = *(byte**)p; p += IntPtr.Size * 3; p = *(byte**)p; pGetILBytes = new IntPtr(p + IntPtr.Size * 39); pDecryptCallback = new IntPtr(p + IntPtr.Size * 40); }
IList <DecryptedMethodInfo> DecryptMethods(IList <int> methodIds) { using (var decrypter = new DynamicMethodsDecrypter(obfModule, reflObfModule)) { decrypter.Initialize(); var infos = new List <DecryptedMethodInfo>(); for (int i = 0; i < methodIds.Count; i += 2) { infos.Add(decrypter.Decrypt(methodIds[i], (uint)methodIds[i + 1])); } return(infos); } }
public DecrypterBase(DynamicMethodsDecrypter dmd) { this.dmd = dmd; this.appDomainId = AppDomain.CurrentDomain.Id; this.asmHashCode = dmd.reflectionModule.Assembly.GetHashCode(); }
public DecrypterV2_0_9_0(DynamicMethodsDecrypter dmd, FieldDef delegateField) : base(dmd) { IntPtr addr = GetDelegateAddress(delegateField); decryptMethod = (DecryptMethod)Marshal.GetDelegateForFunctionPointer(addr, typeof(DecryptMethod)); PatchRuntime(addr); }
public unsafe DecrypterV2_0_13_1(DynamicMethodsDecrypter dmd) : base(dmd) { }
public DecrypterBase(DynamicMethodsDecrypter dmd) { this.dmd = dmd; appDomainId = AppDomain.CurrentDomain.Id; asmHashCode = dmd.reflectionModule.Assembly.GetHashCode(); }
public unsafe DecrypterV2_0_13_0_Base(DynamicMethodsDecrypter dmd) { this.dmd = dmd; this.invoker = (Delegate)dmd.invokerFieldInfo.GetValue(null); byte* p = (byte*)DecrypterBaseV2_0_12_x.GetStateAddr(invoker.Target); byte* pis = GetAddr(*(byte**)p); p = *(byte**)pis; byte* pam = *(byte**)(p + IntPtr.Size * 2); p = *(byte**)(p + ((Environment.Version.Major - 2) / 2 * IntPtr.Size)); p += IntPtr.Size * 8 + 0x18; p = LookUp(p, AppDomain.CurrentDomain.Id); p = *(byte**)(p + IntPtr.Size * 16 + 0x18); byte* pd = p + IntPtr.Size * 2; p = *(byte**)(p + IntPtr.Size * 13); getCallerMethodAsILByteArrayDelegate = GetCallerMethodAsILByteArray; decryptCallbackDelegate = DecryptCallback; ignoreDelegate = IgnoreMethod; byte* pm = p + 0x28 * IntPtr.Size; *(IntPtr*)(p + 0x29 * IntPtr.Size) = Marshal.GetFunctionPointerForDelegate(getCallerMethodAsILByteArrayDelegate); *(IntPtr*)(p + 0x2A * IntPtr.Size) = Marshal.GetFunctionPointerForDelegate(decryptCallbackDelegate); if (IntPtr.Size == 4) *(IntPtr*)(p + 0x2B * IntPtr.Size) = Marshal.GetFunctionPointerForDelegate(ignoreDelegate); InitCode(GetModuleHandle(pis), pam, pd, pm); }
protected unsafe DecrypterBaseV2_0_12_x(DynamicMethodsDecrypter dmd) { this.dmd = dmd; this.invoker = (Delegate)dmd.invokerFieldInfo.GetValue(null); byte* p = (byte*)GetStateAddr(invoker.Target); p += IntPtr.Size * 3; p = *(byte**)p; p += 8 + IntPtr.Size * 8; p = *(byte**)p; p += IntPtr.Size * 3; p = *(byte**)p; pGetILBytes = new IntPtr(p + IntPtr.Size * 39); pDecryptCallback = new IntPtr(p + IntPtr.Size * 40); }