void DumpEmbeddedAssemblies() { foreach (var info in assemblyResolver.AssemblyInfos) { DeobfuscatedFile.CreateAssemblyFile(info.Data, info.SimpleName, info.Extension); AddResourceToBeRemoved(info.Resource, string.Format("Embedded assembly: {0}", info.AssemblyFullName)); } }
void DumpUnpackedFiles() { foreach (var unpackedFile in unpackedFiles) { DeobfuscatedFile.CreateAssemblyFile(unpackedFile.data, Win32Path.GetFileNameWithoutExtension(unpackedFile.filename), Win32Path.GetExtension(unpackedFile.filename)); } }
void DumpEmbeddedAssemblies() { assemblyResolver.ResolveResources(); foreach (var tuple in assemblyResolver.GetDecryptedResources()) { DeobfuscatedFile.CreateAssemblyFile(tuple.Item2, tuple.Item1.simpleName, null); AddResourceToBeRemoved(tuple.Item1.resource, $"Embedded assembly: {tuple.Item1.assemblyName}"); } }
void DumpEmbeddedAssemblies() { foreach (var info in assemblyResolver.AssemblyInfos) { DeobfuscatedFile.CreateAssemblyFile(info.data, info.simpleName, info.extension); } AddResourceToBeRemoved(assemblyResolver.BundleDataResource, "Embedded assemblies resource"); AddResourceToBeRemoved(assemblyResolver.BundleXmlFileResource, "Embedded assemblies XML file resource"); AddTypesToBeRemoved(assemblyResolver.BundleTypes, "Obfuscator assembly bundle types"); }
void DumpEmbeddedAssemblies() { if (!options.DumpEmbeddedAssemblies) { return; } foreach (var info in assemblyResolver.GetEmbeddedAssemblies(DeobfuscatedFile, this)) { var simpleName = Utils.GetAssemblySimpleName(info.name); DeobfuscatedFile.CreateAssemblyFile(info.resource.GetResourceData(), simpleName, null); AddResourceToBeRemoved(info.resource, string.Format("Embedded assembly: {0}", info.name)); } }
void DumpEmbeddedAssemblies() { if (!options.DumpEmbeddedAssemblies) { return; } foreach (var info in assemblyResolver.GetEmbeddedAssemblies(DeobfuscatedFile, this)) { var simpleName = Utils.GetAssemblySimpleName(info.name); DeobfuscatedFile.CreateAssemblyFile(info.resource.CreateReader().ToArray(), simpleName, null); AddResourceToBeRemoved(info.resource, $"Embedded assembly: {info.name}"); } }
void DumpEmbeddedAssemblies() { if (!options.DumpEmbeddedAssemblies) { return; } foreach (var info in assemblyResolver.EmbeddedAssemblyInfos) { DeobfuscatedFile.CreateAssemblyFile(info.data, Utils.GetAssemblySimpleName(info.fullname), info.extension); } AddTypeToBeRemoved(assemblyResolver.Type, "Assembly resolver type"); AddCctorInitCallToBeRemoved(assemblyResolver.InitMethod); AddResourceToBeRemoved(assemblyResolver.EncryptedResource, "Embedded encrypted assemblies"); }
void DumpResourceFiles() { foreach (var resource in libAssemblyResolver.Resources) { var mod = ModuleDefMD.Load(resource.Data.ReadAllBytes()); AddResourceToBeRemoved(resource, string.Format("Embedded assembly: {0}", mod.Assembly.FullName)); DeobfuscatedFile.CreateAssemblyFile(resource.GetResourceData(), Utils.GetAssemblySimpleName(mod.Assembly.FullName), DeobUtils.GetExtension(mod.Kind)); } RemoveInitCall(libAssemblyResolver.InitMethod); AddCallToBeRemoved(module.EntryPoint, libAssemblyResolver.InitMethod); AddTypeToBeRemoved(libAssemblyResolver.Type, "Assembly resolver type (library mode)"); }
void DumpEmbeddedAssemblies() { if (assemblyDecrypter.MainAssemblyHasAssemblyResolver && !options.DumpEmbeddedAssemblies) { return; } foreach (var info in assemblyDecrypter.GetAssemblyInfos(DeobfuscatedFile, this)) { DeobfuscatedFile.CreateAssemblyFile(info.data, info.asmSimpleName, info.extension); AddResourceToBeRemoved(info.resource, string.Format("Embedded assembly: {0}", info.asmFullName)); } AddCctorInitCallToBeRemoved(assemblyDecrypter.InitMethod); AddCallToBeRemoved(module.EntryPoint, assemblyDecrypter.InitMethod); AddTypeToBeRemoved(assemblyDecrypter.Type, "Assembly resolver type"); }
void DumpEmbeddedAssemblies() { if (assemblyDecrypter == null) { return; } foreach (var info in assemblyDecrypter.AssemblyInfos) { var asmName = info.assemblySimpleName; if (info.isEntryPointAssembly) { asmName += "_real"; } DeobfuscatedFile.CreateAssemblyFile(info.data, asmName, info.extension); } }
void DumpEmbeddedAssemblies() { if (mainAsmInfo != null) { var asm = Module.Assembly; var name = (asm == null ? Module.Name : asm.Name).String; DeobfuscatedFile.CreateAssemblyFile(mainAsmInfo.data, name + "_real", mainAsmInfo.extension); AddResourceToBeRemoved(mainAsmInfo.resource, string.Format("Embedded assembly: {0}", mainAsmInfo.asmFullName)); } foreach (var info in embeddedAssemblyInfos) { if (Module.Assembly == null || info.asmFullName != Module.Assembly.FullName) { DeobfuscatedFile.CreateAssemblyFile(info.data, info.asmSimpleName, info.extension); } AddResourceToBeRemoved(info.resource, string.Format("Embedded assembly: {0}", info.asmFullName)); } embeddedAssemblyInfos.Clear(); }
void DumpEmbeddedAssemblies() { if (!options.DumpEmbeddedAssemblies) { return; } foreach (var info in assemblyResolver.GetAssemblyInfos()) { if (info.resource != null && info.resource == resourceResolver.Resource) { continue; } DeobfuscatedFile.CreateAssemblyFile(info.data, info.simpleName, info.extension); AddResourceToBeRemoved(info.resource, $"Embedded assembly: {info.fullName}"); } AddCctorInitCallToBeRemoved(assemblyResolver.InitMethod); AddCallToBeRemoved(module.EntryPoint, assemblyResolver.InitMethod); AddMethodToBeRemoved(assemblyResolver.InitMethod, "Assembly resolver init method"); AddMethodToBeRemoved(assemblyResolver.HandlerMethod, "Assembly resolver handler method"); AddMethodToBeRemoved(assemblyResolver.DecryptMethod, "Assembly resolver decrypt method"); }
void DumpEmbeddedFile(EmbeddedResource resource, string assemblyName, string extension, string reason) { DeobfuscatedFile.CreateAssemblyFile(resourceDecrypter.Decrypt(resource.GetResourceStream()), Utils.GetAssemblySimpleName(assemblyName), extension); AddResourceToBeRemoved(resource, reason); }