public void FindDelegateCreator(ModuleDefMD module)
        {
            var callCounter = new CallCounter();

            foreach (var type in module.Types)
            {
                if (type.Namespace != "" || !DotNetUtils.DerivesFromDelegate(type))
                {
                    continue;
                }
                var cctor = type.FindStaticConstructor();
                if (cctor == null)
                {
                    continue;
                }
                foreach (var method in DotNetUtils.GetMethodCalls(cctor))
                {
                    callCounter.Add(method);
                }
            }

            var mostCalls = callCounter.Most();

            if (mostCalls == null)
            {
                return;
            }

            SetDelegateCreatorMethod(DotNetUtils.GetMethod(module, mostCalls));
        }
예제 #2
0
        public void Find()
        {
            var additionalTypes = new string[] {
                "System.IntPtr",
//				"System.Reflection.Assembly",		//TODO: Not in unknown DNR version with jitter support
            };
            var checkedMethods = new Dictionary <IMethod, bool>(MethodEqualityComparer.CompareDeclaringTypes);
            var callCounter    = new CallCounter();
            int typesLeft      = 30;

            foreach (var type in module.GetTypes())
            {
                var cctor = type.FindStaticConstructor();
                if (cctor == null || cctor.Body == null)
                {
                    continue;
                }
                if (typesLeft-- <= 0)
                {
                    break;
                }

                foreach (var method in DotNetUtils.GetCalledMethods(module, cctor))
                {
                    if (!checkedMethods.ContainsKey(method))
                    {
                        checkedMethods[method] = false;
                        if (method.DeclaringType.BaseType == null || method.DeclaringType.BaseType.FullName != "System.Object")
                        {
                            continue;
                        }
                        if (!DotNetUtils.IsMethod(method, "System.Void", "()"))
                        {
                            continue;
                        }
                        if (!encryptedResource.CouldBeResourceDecrypter(method, additionalTypes))
                        {
                            continue;
                        }
                        checkedMethods[method] = true;
                    }
                    else if (!checkedMethods[method])
                    {
                        continue;
                    }
                    callCounter.Add(method);
                }
            }

            encryptedResource.Method = (MethodDef)callCounter.Most();
        }
예제 #3
0
        void Initialize()
        {
            var callCounter = new CallCounter();
            int count       = 0;

            foreach (var type in module.GetTypes())
            {
                if (count >= 40)
                {
                    break;
                }
                foreach (var method in type.Methods)
                {
                    if (method.Name != ".ctor" && method.Name != ".cctor" && module.EntryPoint != method)
                    {
                        continue;
                    }
                    foreach (var calledMethod in DotNetUtils.GetCalledMethods(module, method))
                    {
                        if (!calledMethod.IsStatic || calledMethod.Body == null)
                        {
                            continue;
                        }
                        if (!DotNetUtils.IsMethod(calledMethod, "System.Void", "()"))
                        {
                            continue;
                        }
                        if (IsEmptyClass(calledMethod))
                        {
                            callCounter.Add(calledMethod);
                            count++;
                        }
                    }
                }
            }

            int numCalls;
            var theMethod = (MethodDef)callCounter.Most(out numCalls);

            if (numCalls >= 10)
            {
                emptyMethod = theMethod;
            }
        }