public override void DeobfuscateBegin() { base.DeobfuscateBegin(); staticStringInliner.Add(stringDecrypter.Method, (method, gim, args) => stringDecrypter.Decrypt((string)args[0], (int)args[1])); DeobfuscatedFile.StringDecryptersAdded(); }
void InitializeConstantsDecrypterV18() { if (hasInitializedConstantsDecrypter || constantsDecrypterV18 == null || !constantsDecrypterV18.Detected) { return; } hasInitializedConstantsDecrypter = true; DecryptResources(); constantsDecrypterV18.Initialize(); int32ValueInliner = new Int32ValueInliner(); int64ValueInliner = new Int64ValueInliner(); singleValueInliner = new SingleValueInliner(); doubleValueInliner = new DoubleValueInliner(); foreach (var info in constantsDecrypterV18.Decrypters) { staticStringInliner.Add(info.method, (method, gim, args) => constantsDecrypterV18.DecryptString(method, gim, (uint)args[0], (ulong)args[1])); int32ValueInliner.Add(info.method, (method, gim, args) => constantsDecrypterV18.DecryptInt32(method, gim, (uint)args[0], (ulong)args[1])); int64ValueInliner.Add(info.method, (method, gim, args) => constantsDecrypterV18.DecryptInt64(method, gim, (uint)args[0], (ulong)args[1])); singleValueInliner.Add(info.method, (method, gim, args) => constantsDecrypterV18.DecryptSingle(method, gim, (uint)args[0], (ulong)args[1])); doubleValueInliner.Add(info.method, (method, gim, args) => constantsDecrypterV18.DecryptDouble(method, gim, (uint)args[0], (ulong)args[1])); } DeobfuscatedFile.StringDecryptersAdded(); AddTypesToBeRemoved(constantsDecrypterV18.Types, "Constants decrypter type"); AddFieldsToBeRemoved(constantsDecrypterV18.Fields, "Constants decrypter field"); AddMethodToBeRemoved(constantsDecrypterV18.NativeMethod, "Constants decrypter native method"); AddTypeToBeRemoved(constantsDecrypterV18.LzmaType, "LZMA type"); AddResourceToBeRemoved(constantsDecrypterV18.Resource, "Encrypted constants"); }
public override void DeobfuscateBegin() { base.DeobfuscateBegin(); if (options.RestoreFields) { fieldsRestorer = new FieldsRestorer(module); fieldsRestorer.Initialize(); } foreach (var method in stringDecrypter.DecrypterMethods) { staticStringInliner.Add(method, (method2, gim, args) => { return(stringDecrypter.Decrypt(method2, args)); }); } DeobfuscatedFile.StringDecryptersAdded(); resourceResolver.Initialize(); DecryptResources(); DumpEmbeddedAssemblies(); startedDeobfuscating = true; }
public override void DeobfuscateBegin() { base.DeobfuscateBegin(); stringDecrypter = new StringDecrypter(decrypterInfo); stringDecrypter.Find(); if (stringDecrypter.Detected) { stringDecrypter.Initialize(GetEncoding(options.StringCodePage)); staticStringInliner.Add(stringDecrypter.Method, (method, gim, args) => stringDecrypter.Decrypt((uint)args[0])); DeobfuscatedFile.StringDecryptersAdded(); } else { FreePEImage(); } foreach (var method in mainType.InitMethods) { AddCctorInitCallToBeRemoved(method); } AddTypeToBeRemoved(mainType.Type, "Obfuscator type"); RemoveDuplicateEmbeddedResources(); RemoveInvalidResources(); }
public override void DeobfuscateBegin() { base.DeobfuscateBegin(); stringDecrypter.Initialize(DeobfuscatedFile); staticStringInliner.Add(stringDecrypter.RealMethod, (method2, gim, args) => { return(stringDecrypter.Decrypt((int)args[0])); }); DeobfuscatedFile.StringDecryptersAdded(); assemblyResolver.Initialize(DeobfuscatedFile, this); assemblyResolver.InitializeEmbeddedFiles(); AddModuleCctorInitCallToBeRemoved(assemblyResolver.InitMethod); resourceResolver.Initialize(DeobfuscatedFile, this); foreach (var info in resourceResolver.MergeResources()) { AddResourceToBeRemoved(info.Resource, "Encrypted resources"); } AddModuleCctorInitCallToBeRemoved(resourceResolver.InitMethod); resourceMethodsRestorer = new ResourceMethodsRestorer(Module); if ((Operations.RenamerFlags & (RenamerFlags.RenameTypes | RenamerFlags.RenameNamespaces)) != 0) { resourceMethodsRestorer.Find(DeobfuscatedFile, this); } DumpEmbeddedAssemblies(); }
public override void DeobfuscateBegin() { base.DeobfuscateBegin(); if (options.DecryptResources) { AddCctorInitCallToBeRemoved(resourceResolver.InitMethod); AddTypeToBeRemoved(resourceResolver.Type, "Resource resolver type"); } DecryptResources(); stringDecrypter.Initialize(); if (Operations.DecryptStrings != OpDecryptString.None) { if (stringDecrypter.Resource != null) { Logger.v("Adding string decrypter. Resource: {0}", Utils.ToCsharpString(stringDecrypter.Resource.Name)); } staticStringInliner.Add(stringDecrypter.DecryptMethod, (method, gim, args) => { return(stringDecrypter.Decrypt(args)); }); DeobfuscatedFile.StringDecryptersAdded(); } if (options.DumpEmbeddedAssemblies) { assemblyResolver.Initialize(DeobfuscatedFile, this); // Need to dump the assemblies before decrypting methods in case there's a reference // in the encrypted code to one of these assemblies. DumpEmbeddedAssemblies(); } if (options.DecryptMethods) { methodsDecrypter.Initialize(DeobfuscatedFile, this); methodsDecrypter.decrypt(); } if (options.DecryptConstants) { constantsDecrypter.Initialize(DeobfuscatedFile, this); AddTypeToBeRemoved(constantsDecrypter.Type, "Constants decrypter type"); AddResourceToBeRemoved(constantsDecrypter.Resource, "Encrypted constants"); int32ValueInliner = new Int32ValueInliner(); int32ValueInliner.Add(constantsDecrypter.Int32Decrypter, (method, gim, args) => constantsDecrypter.DecryptInt32((int)args[0])); int64ValueInliner = new Int64ValueInliner(); int64ValueInliner.Add(constantsDecrypter.Int64Decrypter, (method, gim, args) => constantsDecrypter.DecryptInt64((int)args[0])); singleValueInliner = new SingleValueInliner(); singleValueInliner.Add(constantsDecrypter.SingleDecrypter, (method, gim, args) => constantsDecrypter.DecryptSingle((int)args[0])); doubleValueInliner = new DoubleValueInliner(); doubleValueInliner.Add(constantsDecrypter.DoubleDecrypter, (method, gim, args) => constantsDecrypter.DecryptDouble((int)args[0])); } proxyCallFixer.Find(); startedDeobfuscating = true; }
public override void DeobfuscateBegin() { base.DeobfuscateBegin(); cliSecureRtType.FindStringDecrypterMethod(); stringDecrypter.AddDecrypterInfos(cliSecureRtType.StringDecrypterInfos); stringDecrypter.Initialize(); AddAttributesToBeRemoved(cliSecureAttributes, "Obfuscator attribute"); if (options.DecryptResources) { DecryptResources(resourceDecrypter); AddCctorInitCallToBeRemoved(resourceDecrypter.RsrcRrrMethod); } stackFrameHelper = new StackFrameHelper(Module); stackFrameHelper.Find(); foreach (var type in Module.Types) { if (type.FullName == "InitializeDelegate" && DotNetUtils.DerivesFromDelegate(type)) { this.AddTypeToBeRemoved(type, "Obfuscator type"); } } proxyCallFixer.Find(); foreach (var info in stringDecrypter.StringDecrypterInfos) { staticStringInliner.Add(info.Method, (method, gim, args) => stringDecrypter.Decrypt((string)args[0])); } DeobfuscatedFile.StringDecryptersAdded(); if (options.DecryptMethods) { AddCctorInitCallToBeRemoved(cliSecureRtType.InitializeMethod); AddCctorInitCallToBeRemoved(cliSecureRtType.PostInitializeMethod); FindPossibleNamesToRemove(cliSecureRtType.LoadMethod); } if (options.RestoreVmCode && (csvmV1.Detected || csvmV2.Detected)) { if (csvmV1.Detected && csvmV1.Restore()) { AddResourceToBeRemoved(csvmV1.Resource, "CSVM data resource"); } else if (csvmV2.Detected && csvmV2.Restore()) { AddResourceToBeRemoved(csvmV2.Resource, "CSVM data resource"); } else { Logger.e("Couldn't restore VM methods. Use --dont-rename or it will not run"); PreserveTokensAndTypes(); } } }
public override void DeobfuscateBegin() { base.DeobfuscateBegin(); foreach (var info in stringDecrypter.StringDecrypterInfos) { staticStringInliner.Add(info.method, (method, gim, args) => stringDecrypter.Decrypt(method, (string)args[0], (int)args[1])); } DeobfuscatedFile.StringDecryptersAdded(); }
public override void DeobfuscateBegin() { base.DeobfuscateBegin(); proxyCallFixer = new ProxyCallFixer(Module); proxyCallFixer.Find(); localsRestorer = new LocalsRestorer(Module); if (options.RestoreLocals) { localsRestorer.Find(); } logicalExpressionFixer = new LogicalExpressionFixer(); stringDecrypter.Initialize(); integerDecrypter.Initialize(); arrayDecrypter.Initialize(); if (options.DecryptIntegers) { int32ValueInliner = new Int32ValueInliner(); foreach (var method in integerDecrypter.GetMethods()) { int32ValueInliner.Add(method, (method2, gim, args) => { return(integerDecrypter.Decrypt(method2)); }); } } if (options.DecryptArrays) { arrayValueInliner = new ArrayValueInliner(Module, initializedDataCreator); foreach (var method in arrayDecrypter.GetMethods()) { arrayValueInliner.Add(method, (method2, gim, args) => { return(arrayDecrypter.Decrypt(method2)); }); } } foreach (var method in stringDecrypter.GetMethods()) { staticStringInliner.Add(method, (method2, gim, args) => { return(stringDecrypter.Decrypt(method2)); }); DeobfuscatedFile.StringDecryptersAdded(); } if (options.RemoveAntiStrongName) { AddTypeToBeRemoved(strongNameChecker.Type, "Strong name checker type"); } startedDeobfuscating = true; }
public override void DeobfuscateBegin() { base.DeobfuscateBegin(); staticStringInliner.Add(stringDecrypter.Method, (method, gim, args) => stringDecrypter.Decrypt((string)args[0])); DeobfuscatedFile.StringDecryptersAdded(); proxyCallFixer.Find(); cfMethodCallInliner = new CfMethodCallInliner(proxyCallFixer); DumpEmbeddedAssemblies(); }
void InitializeStringDecrypter() { if (hasInitializedStringDecrypter || stringDecrypter == null || !stringDecrypter.Detected) { return; } hasInitializedStringDecrypter = true; DecryptResources(); stringDecrypter.Initialize(); staticStringInliner.Add(stringDecrypter.Method, (method, gim, args) => stringDecrypter.Decrypt(staticStringInliner.Method, (int)args[0])); DeobfuscatedFile.StringDecryptersAdded(); }
void InitializeStringDecrypter() { if (hasInitializedStringDecrypter) { return; } stringDecrypter.Initialize(DeobfuscatedFile); foreach (var info in stringDecrypter.Infos) { staticStringInliner.Add(info.Method, (method, gim, args) => stringDecrypter.Decrypt(method, (int)args[0], (int)args[1], (int)args[2])); } DeobfuscatedFile.StringDecryptersAdded(); hasInitializedStringDecrypter = true; }
public override void DeobfuscateBegin() { base.DeobfuscateBegin(); AddTypeToBeRemoved(killType, "KILL type"); mainType.Initialize(); foreach (var initMethod in mainType.OtherInitMethods) { AddCctorInitCallToBeRemoved(initMethod); AddCtorInitCallToBeRemoved(initMethod); } if (Operations.DecryptStrings != OpDecryptString.None) { stringDecrypter.Initialize(); staticStringInliner.Add(stringDecrypter.DecryptMethod, (method, gim, args) => { return(stringDecrypter.Decrypt((int)args[0])); }); DeobfuscatedFile.StringDecryptersAdded(); AddModuleCctorInitCallToBeRemoved(stringDecrypter.InitMethod); AddCallToBeRemoved(mainType.GetInitStringDecrypterMethod(stringDecrypter.InitMethod), stringDecrypter.InitMethod); } assemblyResolver = new AssemblyResolver(module); assemblyResolver.Initialize(); DumpEmbeddedAssemblies(); RemoveTamperDetection(); proxyCallFixer.Initialize(); proxyCallFixer.Find(); resourceDecrypter = new ResourceDecrypter(module); resourceDecrypter.Initialize(); resourceDecrypter.Decrypt(); if (resourceDecrypter.CanRemoveTypes) { AddTypeToBeRemoved(resourceDecrypter.ResourceFlagsType, "Obfuscator ResourceFlags type"); AddTypeToBeRemoved(resourceDecrypter.ResType, "Obfuscator Res type"); AddTypeToBeRemoved(resourceDecrypter.ResourceEnumeratorType, "Obfuscator ResourceEnumerator type"); AddTypeToBeRemoved(resourceDecrypter.EncryptedResourceReaderType, "Obfuscator EncryptedResourceReader type"); AddTypeToBeRemoved(resourceDecrypter.EncryptedResourceSetType, "Obfuscator EncryptedResourceSet type"); AddTypeToBeRemoved(resourceDecrypter.EncryptedResourceStreamType, "Obfuscator EncryptedResourceStream type"); } }
void Initialize(ConstantsDecrypterBase constDecrypter, ref bool hasInitialized) { if (hasInitialized || constDecrypter == null || !constDecrypter.Detected) { return; } hasInitializedConstantsDecrypter15 = true; DecryptResources(); constDecrypter.Initialize(); int32ValueInliner = new Int32ValueInliner(); int64ValueInliner = new Int64ValueInliner(); singleValueInliner = new SingleValueInliner(); doubleValueInliner = new DoubleValueInliner(); foreach (var info in constDecrypter.DecrypterInfos) { staticStringInliner.Add(info.decryptMethod, (method, gim, args) => constDecrypter.DecryptString(staticStringInliner.Method, method, args)); int32ValueInliner.Add(info.decryptMethod, (method, gim, args) => constDecrypter.DecryptInt32(int32ValueInliner.Method, method, args)); int64ValueInliner.Add(info.decryptMethod, (method, gim, args) => constDecrypter.DecryptInt64(int64ValueInliner.Method, method, args)); singleValueInliner.Add(info.decryptMethod, (method, gim, args) => constDecrypter.DecryptSingle(singleValueInliner.Method, method, args)); doubleValueInliner.Add(info.decryptMethod, (method, gim, args) => constDecrypter.DecryptDouble(doubleValueInliner.Method, method, args)); } int32ValueInliner.RemoveUnbox = true; int64ValueInliner.RemoveUnbox = true; singleValueInliner.RemoveUnbox = true; doubleValueInliner.RemoveUnbox = true; DeobfuscatedFile.StringDecryptersAdded(); AddFieldsToBeRemoved(constDecrypter.Fields, "Constants decrypter field"); var moduleType = DotNetUtils.GetModuleType(Module); foreach (var info in constDecrypter.DecrypterInfos) { if (info.decryptMethod.DeclaringType == moduleType) { AddMethodToBeRemoved(info.decryptMethod, "Constants decrypter method"); } else { AddTypeToBeRemoved(info.decryptMethod.DeclaringType, "Constants decrypter type"); } } AddMethodToBeRemoved(constDecrypter.NativeMethod, "Constants decrypter native method"); AddResourceToBeRemoved(constDecrypter.Resource, "Encrypted constants"); }
void InitStringDecrypter(StringDecrypterInfo info) { Logger.v("Adding string decrypter. Resource: {0}", Utils.ToCsharpString(info.StringsResource.Name)); var decrypter = new StringDecrypter(info); if (decrypter.CanDecrypt) { var invokeMethod = info.GetStringDelegate?.FindMethod("Invoke"); staticStringInliner.Add(invokeMethod, (method, gim, args) => { var fieldDef = DotNetUtils.GetField(module, (IField)args[0]); return(decrypter.Decrypt(fieldDef.MDToken.ToInt32(), (int)args[1])); }); staticStringInliner.Add(info.StringDecrypterMethod, (method, gim, args) => { return(decrypter.Decrypt(0, (int)args[0])); }); } stringDecrypters.Add(decrypter); DeobfuscatedFile.StringDecryptersAdded(); }
public override void DeobfuscateBegin() { base.DeobfuscateBegin(); methodCallInliner.Initialize(DeobfuscatedFile); if (options.RestoreResourceNames) { resourceNamesRestorer = new ResourceNamesRestorer(Module); resourceNamesRestorer.Find(); } stringDecrypter.Initialize(); foreach (var info in stringDecrypter.DecrypterInfos) { staticStringInliner.Add(info.method, (method2, gim, args) => { return(stringDecrypter.Decrypt(method2)); }); } DeobfuscatedFile.StringDecryptersAdded(); startedDeobfuscating = true; }
public override void DeobfuscateBegin() { base.DeobfuscateBegin(); antiStrongName = new AntiStrongName(); staticStringInliner.Add(decrypterType.StringDecrypter1, (method2, gim, args) => { return(decrypterType.Decrypt1((string)args[0])); }); staticStringInliner.Add(decrypterType.StringDecrypter2, (method2, gim, args) => { return(decrypterType.Decrypt2((string)args[0])); }); DeobfuscatedFile.StringDecryptersAdded(); libAssemblyResolver = new LibAssemblyResolver(module); libAssemblyResolver.Find(DeobfuscatedFile, this); if (Operations.DecryptStrings == OpDecryptString.None) { canRemoveDecrypterType = false; } RemoveInitCall(nativeLibSaver.InitMethod); AddResourceToBeRemoved(nativeLibSaver.Resource, "Native lib resource"); AddTypeToBeRemoved(nativeLibSaver.Type, "Native lib saver type"); foreach (var initMethod in decrypterType.InitMethods) { RemoveInitCall(initMethod); } DumpUnpackedFiles(); DumpResourceFiles(); startedDeobfuscating = true; }
public override void DeobfuscateBegin() { base.DeobfuscateBegin(); proxyCallFixer = new ProxyCallFixer(Module, DeobfuscatedFile); proxyCallFixer.FindDelegateCreator(); proxyCallFixer.Find(); stringDecrypter.Initialize(peImage, fileData, DeobfuscatedFile); if (!stringDecrypter.Detected) { FreePEImage(); } booleanDecrypter.Initialize(fileData, DeobfuscatedFile); booleanValueInliner = new BooleanValueInliner(); emptyClass = new EmptyClass(Module); if (options.DecryptBools) { booleanValueInliner.Add(booleanDecrypter.Method, (method, gim, args) => { return(booleanDecrypter.Decrypt((int)args[0])); }); } foreach (var info in stringDecrypter.DecrypterInfos) { staticStringInliner.Add(info.method, (method2, gim, args) => { return(stringDecrypter.Decrypt(method2, (int)args[0])); }); } if (stringDecrypter.OtherStringDecrypter != null) { staticStringInliner.Add(stringDecrypter.OtherStringDecrypter, (method2, gim, args) => { return(stringDecrypter.Decrypt((string)args[0])); }); } DeobfuscatedFile.StringDecryptersAdded(); metadataTokenObfuscator = new MetadataTokenObfuscator(Module); antiStrongname = new AntiStrongName(GetDecrypterType()); bool removeResourceResolver = false; if (options.DecryptResources) { resourceResolver.Initialize(DeobfuscatedFile, this); DecryptResources(); if (options.InlineMethods) { AddTypeToBeRemoved(resourceResolver.Type, "Resource decrypter type"); removeResourceResolver = true; } AddEntryPointCallToBeRemoved(resourceResolver.InitMethod); AddCctorInitCallToBeRemoved(resourceResolver.InitMethod); } if (resourceResolver.Detected && !removeResourceResolver && !resourceResolver.FoundResource) { canRemoveDecrypterType = false; // There may be calls to its .ctor } if (Operations.DecryptStrings != OpDecryptString.None) { AddResourceToBeRemoved(stringDecrypter.Resource, "Encrypted strings"); } else { canRemoveDecrypterType = false; } if (options.DecryptMethods && !methodsDecrypter.HasNativeMethods) { AddResourceToBeRemoved(methodsDecrypter.Resource, "Encrypted methods"); AddCctorInitCallToBeRemoved(methodsDecrypter.Method); } else { canRemoveDecrypterType = false; } if (options.DecryptBools) { AddResourceToBeRemoved(booleanDecrypter.Resource, "Encrypted booleans"); } else { canRemoveDecrypterType = false; } if (!options.RemoveAntiStrongName) { canRemoveDecrypterType = false; } // The inlined methods may contain calls to the decrypter class if (!options.InlineMethods) { canRemoveDecrypterType = false; } if (options.DumpEmbeddedAssemblies) { if (options.InlineMethods) { AddTypeToBeRemoved(assemblyResolver.Type, "Assembly resolver"); } AddEntryPointCallToBeRemoved(assemblyResolver.InitMethod); AddCctorInitCallToBeRemoved(assemblyResolver.InitMethod); DumpEmbeddedAssemblies(); } if (options.InlineMethods) { AddTypeToBeRemoved(metadataTokenObfuscator.Type, "Metadata token obfuscator"); } AddCctorInitCallToBeRemoved(emptyClass.Method); AddCtorInitCallToBeRemoved(emptyClass.Method); AddEntryPointCallToBeRemoved(emptyClass.Method); if (options.InlineMethods) { AddTypeToBeRemoved(emptyClass.Type, "Empty class"); } startedDeobfuscating = true; }
public override void DeobfuscateBegin() { base.DeobfuscateBegin(); resourceDecrypter = new ResourceDecrypter(module, DeobfuscatedFile); resourceResolver = new ResourceResolver(module, resourceDecrypter); assemblyResolver = new AssemblyResolver(module); resourceResolver.Find(); assemblyResolver.Find(DeobfuscatedFile); DecryptResources(); stringDecrypter.Initialize(resourceDecrypter); if (stringDecrypter.Method != null) { staticStringInliner.Add(stringDecrypter.Method, (method, gim, args) => { return(stringDecrypter.Decrypt((int)args[0])); }); DeobfuscatedFile.StringDecryptersAdded(); } methodsDecrypter.Decrypt(resourceDecrypter, DeobfuscatedFile); if (methodsDecrypter.Detected) { if (!assemblyResolver.Detected) { assemblyResolver.Find(DeobfuscatedFile); } if (!tamperDetection.Detected) { tamperDetection.Find(); } } antiDebugger = new AntiDebugger(module, DeobfuscatedFile, this); antiDebugger.Find(); if (options.DecryptConstants) { constantsDecrypter.Initialize(resourceDecrypter); int32ValueInliner = new Int32ValueInliner(); int32ValueInliner.Add(constantsDecrypter.Int32Decrypter, (method, gim, args) => constantsDecrypter.DecryptInt32((int)args[0])); int64ValueInliner = new Int64ValueInliner(); int64ValueInliner.Add(constantsDecrypter.Int64Decrypter, (method, gim, args) => constantsDecrypter.DecryptInt64((int)args[0])); singleValueInliner = new SingleValueInliner(); singleValueInliner.Add(constantsDecrypter.SingleDecrypter, (method, gim, args) => constantsDecrypter.DecryptSingle((int)args[0])); doubleValueInliner = new DoubleValueInliner(); doubleValueInliner.Add(constantsDecrypter.DoubleDecrypter, (method, gim, args) => constantsDecrypter.DecryptDouble((int)args[0])); AddTypeToBeRemoved(constantsDecrypter.Type, "Constants decrypter type"); AddResourceToBeRemoved(constantsDecrypter.Resource, "Encrypted constants"); } AddModuleCctorInitCallToBeRemoved(resourceResolver.Method); AddModuleCctorInitCallToBeRemoved(assemblyResolver.Method); AddCallToBeRemoved(module.EntryPoint, tamperDetection.Method); AddModuleCctorInitCallToBeRemoved(tamperDetection.Method); AddCallToBeRemoved(module.EntryPoint, antiDebugger.Method); AddModuleCctorInitCallToBeRemoved(antiDebugger.Method); AddTypeToBeRemoved(resourceResolver.Type, "Resource resolver type"); AddTypeToBeRemoved(assemblyResolver.Type, "Assembly resolver type"); AddTypeToBeRemoved(tamperDetection.Type, "Tamper detection type"); AddTypeToBeRemoved(antiDebugger.Type, "Anti-debugger type"); AddTypeToBeRemoved(methodsDecrypter.Type, "Methods decrypter type"); AddTypesToBeRemoved(methodsDecrypter.DelegateTypes, "Methods decrypter delegate type"); AddResourceToBeRemoved(methodsDecrypter.Resource, "Encrypted methods"); proxyCallFixer.Find(); DumpEmbeddedAssemblies(); startedDeobfuscating = true; }