public StringDecrypter(StringDecrypterInfo stringDecrypterInfo) {
StringDecrypterInfo = stringDecrypterInfo;
if (stringDecrypterInfo != null) {
if (!stringDecrypterInfo.StringsEncrypted) {
stringOffset = stringDecrypterInfo.StringOffset;
decryptedData = stringDecrypterInfo.StringsResource.GetResourceData();
}
else if (stringDecrypterInfo.CanDecrypt) {
stringOffset = stringDecrypterInfo.StringOffset;
decryptedData = stringDecrypterInfo.Decrypt();
}
stringDecrypterVersion = StringDecrypterInfo.DecrypterVersion;
}
}
public StringDecrypter(StringDecrypterInfo stringDecrypterInfo)
{
StringDecrypterInfo = stringDecrypterInfo;
if (stringDecrypterInfo != null)
{
if (!stringDecrypterInfo.StringsEncrypted)
{
stringOffset = stringDecrypterInfo.StringOffset;
decryptedData = stringDecrypterInfo.StringsResource.CreateReader().ToArray();
}
else if (stringDecrypterInfo.CanDecrypt)
{
stringOffset = stringDecrypterInfo.StringOffset;
decryptedData = stringDecrypterInfo.Decrypt();
}
}
}
void initStringDecrypter(StringDecrypterInfo info)
{
Log.v("Adding string decrypter. Resource: {0}", Utils.toCsharpString(info.StringsResource.Name));
var decrypter = new StringDecrypter(info);
if (decrypter.CanDecrypt)
{
staticStringInliner.add(DotNetUtils.getMethod(info.GetStringDelegate, "Invoke"), (method, args) => {
var fieldDefinition = DotNetUtils.getField(module, (FieldReference)args[0]);
return(decrypter.decrypt(fieldDefinition.MetadataToken.ToInt32(), (int)args[1]));
});
staticStringInliner.add(info.StringDecrypterMethod, (method, args) => {
return(decrypter.decrypt(0, (int)args[0]));
});
}
stringDecrypters.Add(decrypter);
DeobfuscatedFile.stringDecryptersAdded();
}
void InitStringDecrypter(StringDecrypterInfo info)
{
Logger.v("Adding string decrypter. Resource: {0}", Utils.ToCsharpString(info.StringsResource.Name));
var decrypter = new StringDecrypter(info);
if (decrypter.CanDecrypt)
{
var invokeMethod = info.GetStringDelegate?.FindMethod("Invoke");
staticStringInliner.Add(invokeMethod, (method, gim, args) => {
var fieldDef = DotNetUtils.GetField(module, (IField)args[0]);
return(decrypter.Decrypt(fieldDef.MDToken.ToInt32(), (int)args[1]));
});
staticStringInliner.Add(info.StringDecrypterMethod, (method, gim, args) => {
return(decrypter.Decrypt(0, (int)args[0]));
});
}
stringDecrypters.Add(decrypter);
DeobfuscatedFile.StringDecryptersAdded();
}
public StringDecrypter(StringDecrypterInfo stringDecrypterInfo)
{
StringDecrypterInfo = stringDecrypterInfo;
if (stringDecrypterInfo != null)
{
if (!stringDecrypterInfo.StringsEncrypted)
{
stringOffset = stringDecrypterInfo.StringOffset;
decryptedData = stringDecrypterInfo.StringsResource.GetResourceData();
}
else if (stringDecrypterInfo.CanDecrypt)
{
stringOffset = stringDecrypterInfo.StringOffset;
decryptedData = stringDecrypterInfo.Decrypt();
}
stringDecrypterVersion = StringDecrypterInfo.DecrypterVersion;
}
}
void InitStringDecrypter(StringDecrypterInfo info) {
Logger.v("Adding string decrypter. Resource: {0}", Utils.ToCsharpString(info.StringsResource.Name));
var decrypter = new StringDecrypter(info);
if (decrypter.CanDecrypt) {
var invokeMethod = info.GetStringDelegate == null ? null : info.GetStringDelegate.FindMethod("Invoke");
staticStringInliner.Add(invokeMethod, (method, gim, args) => {
var fieldDef = DotNetUtils.GetField(module, (IField)args[0]);
return decrypter.Decrypt(fieldDef.MDToken.ToInt32(), (int)args[1]);
});
staticStringInliner.Add(info.StringDecrypterMethod, (method, gim, args) => {
return decrypter.Decrypt(0, (int)args[0]);
});
}
stringDecrypters.Add(decrypter);
DeobfuscatedFile.StringDecryptersAdded();
}
void InitStringDecrypterInfos() {
var stringEncoderClassFinder = new StringEncoderClassFinder(module, DeobfuscatedFile);
stringEncoderClassFinder.Find();
foreach (var info in stringEncoderClassFinder.StringsEncoderInfos) {
var sinfo = new StringDecrypterInfo(module, info.StringDecrypterClass) {
GetStringDelegate = info.GetStringDelegate,
StringsType = info.StringsType,
CreateStringDelegateMethod = info.CreateStringDelegateMethod,
};
stringDecrypterInfos.Add(sinfo);
}
// There may be more than one string decrypter. The strings in the first one's
// methods may be decrypted by the other string decrypter.
var initd = new Dictionary<StringDecrypterInfo, bool>(stringDecrypterInfos.Count);
while (initd.Count != stringDecrypterInfos.Count) {
StringDecrypterInfo initdInfo = null;
for (int i = 0; i < 2; i++) {
foreach (var info in stringDecrypterInfos) {
if (initd.ContainsKey(info))
continue;
if (info.Initialize(this, DeobfuscatedFile)) {
resourceDecrypterInfo.SetSimpleZipType(info.SimpleZipTypeMethod, DeobfuscatedFile);
initdInfo = info;
break;
}
}
if (initdInfo != null)
break;
assemblyResolverInfo.FindTypes();
resourceResolverInfo.FindTypes();
DecryptResources();
}
if (initdInfo == null)
break;
initd[initdInfo] = true;
InitStringDecrypter(initdInfo);
}
// Sometimes there could be a string decrypter present that isn't called by anyone.
foreach (var info in stringDecrypterInfos) {
if (initd.ContainsKey(info))
continue;
Logger.v("String decrypter not initialized. Token {0:X8}", info.StringsEncodingClass.MDToken.ToInt32());
}
}
void initStringDecrypter(StringDecrypterInfo info)
{
Log.v("Adding string decrypter. Resource: {0}", Utils.toCsharpString(info.StringsResource.Name));
var decrypter = new StringDecrypter(info);
if (decrypter.CanDecrypt) {
staticStringDecrypter.add(DotNetUtils.getMethod(info.GetStringDelegate, "Invoke"), (method, args) => {
var fieldDefinition = DotNetUtils.getField(module, (FieldReference)args[0]);
return decrypter.decrypt(fieldDefinition.MetadataToken.ToInt32(), (int)args[1]);
});
staticStringDecrypter.add(info.StringDecrypterMethod, (method, args) => {
return decrypter.decrypt(0, (int)args[0]);
});
}
stringDecrypters.Add(decrypter);
DeobfuscatedFile.stringDecryptersAdded();
}
void InitStringDecrypterInfos()
{
var stringEncoderClassFinder = new StringEncoderClassFinder(module, DeobfuscatedFile);
stringEncoderClassFinder.Find();
foreach (var info in stringEncoderClassFinder.StringsEncoderInfos)
{
var sinfo = new StringDecrypterInfo(module, info.StringDecrypterClass)
{
GetStringDelegate = info.GetStringDelegate,
StringsType = info.StringsType,
CreateStringDelegateMethod = info.CreateStringDelegateMethod,
};
stringDecrypterInfos.Add(sinfo);
}
// There may be more than one string decrypter. The strings in the first one's
// methods may be decrypted by the other string decrypter.
var initd = new Dictionary <StringDecrypterInfo, bool>(stringDecrypterInfos.Count);
while (initd.Count != stringDecrypterInfos.Count)
{
StringDecrypterInfo initdInfo = null;
for (int i = 0; i < 2; i++)
{
foreach (var info in stringDecrypterInfos)
{
if (initd.ContainsKey(info))
{
continue;
}
if (info.Initialize(this, DeobfuscatedFile))
{
resourceDecrypterInfo.SetSimpleZipType(info.SimpleZipTypeMethod, DeobfuscatedFile);
initdInfo = info;
break;
}
}
if (initdInfo != null)
{
break;
}
assemblyResolverInfo.FindTypes();
resourceResolverInfo.FindTypes();
DecryptResources();
}
if (initdInfo == null)
{
break;
}
initd[initdInfo] = true;
InitStringDecrypter(initdInfo);
}
// Sometimes there could be a string decrypter present that isn't called by anyone.
foreach (var info in stringDecrypterInfos)
{
if (initd.ContainsKey(info))
{
continue;
}
Logger.v("String decrypter not initialized. Token {0:X8}", info.StringsEncodingClass.MDToken.ToInt32());
}
}
