예제 #1
0
        public static void MarkMember(object member, object parentMember = null, string ID = null)
        {
            if (member == null)
            {
                return;
            }

            if (Globals.DeobContext.MarkedMembers.Any(mm => mm.Member == member))
            {
                return;
            }

            var tmpMember = new DeobfuscatorContext.MarkedMember {
                Member = member
            };

            if (member is TypeDefinition)
            {
                tmpMember.Type = DeobfuscatorContext.MemberType.Type;
            }
            else if (member is MethodDefinition)
            {
                tmpMember.Type = DeobfuscatorContext.MemberType.Method;
            }
            else if (member is FieldDefinition)
            {
                tmpMember.Type = DeobfuscatorContext.MemberType.Field;
            }
            else if (member is Delegate)
            {
                tmpMember.Type = DeobfuscatorContext.MemberType.Delegate;
            }
            else if (member is PropertyDefinition)
            {
                tmpMember.Type = DeobfuscatorContext.MemberType.Property;
            }
            else if (member is EmbeddedResource)
            {
                tmpMember.Type = DeobfuscatorContext.MemberType.Resource;
            }
            else if (member is CustomAttribute)
            {
                tmpMember.Type = DeobfuscatorContext.MemberType.Attribute;
            }
            else if (member is Instruction)
            {
                tmpMember.Type = DeobfuscatorContext.MemberType.Instruction;
            }
            else if (member is AssemblyNameReference)
            {
                tmpMember.Type = DeobfuscatorContext.MemberType.AssemblyReference;
            }

            tmpMember.ID           = ID ?? "";
            tmpMember.ParentMember = parentMember;
            Globals.DeobContext.MarkedMembers.Add(tmpMember);
        }
예제 #2
0
        private static bool RemoveMembers()
        {
            var tmp = new DeobfuscatorContext.MarkedMember();

            try
            {
                foreach (var member in Globals.DeobContext.MarkedMembers)
                {
                    switch (member.Type)
                    {
                    case DeobfuscatorContext.MemberType.Type:
                        Logger.VLog("[Remove(Type)] " + (member.Member as TypeDefinition).Name.Truncate(10));
                        AsmDef.MainModule.Types.Remove(member.Member as TypeDefinition);
                        break;

                    case DeobfuscatorContext.MemberType.Method:
                        Logger.VLog("[Remove(Method)] " + (member.Member as MethodDefinition).Name);
                        (member.Member as MethodDefinition).DeclaringType.Methods.Remove(
                            member.Member as MethodDefinition);
                        break;

                    case DeobfuscatorContext.MemberType.Field:
                        Logger.VLog("[Remove(Field)] " + (member.Member as FieldDefinition).Name);
                        (member.Member as FieldDefinition).DeclaringType.Fields.Remove(
                            member.Member as FieldDefinition);
                        break;

                    case DeobfuscatorContext.MemberType.Property:
                        Logger.VLog("[Remove(Property)] " + (member.Member as PropertyDefinition).Name);
                        (member.Member as PropertyDefinition).DeclaringType.Properties.Remove(
                            member.Member as PropertyDefinition);
                        break;

                    case DeobfuscatorContext.MemberType.Resource:
                        Logger.VLog("[Remove(Resource)] " +
                                    ((member.Member as EmbeddedResource).Name.Truncate(10)));
                        AsmDef.MainModule.Resources.Remove(member.Member as EmbeddedResource);
                        break;

                    case DeobfuscatorContext.MemberType.Attribute:
                        Logger.VLog("[Remove(Attribute)] " + (member.Member as CustomAttribute).AttributeType.Name);
                        (member.ParentMember as ModuleDefinition).CustomAttributes.Remove(
                            member.Member as CustomAttribute);
                        break;

                    case DeobfuscatorContext.MemberType.Instruction:
                        Logger.VLog("[Remove(Instruction)] " + (member.Member as Instruction).OpCode);
                        (member.ParentMember as MethodDefinition).Body.Instructions.Remove(
                            member.Member as Instruction);
                        break;

                    case DeobfuscatorContext.MemberType.AssemblyReference:
                        Logger.VLog("[Remove(AssemblyReference)] " + (member.Member as AssemblyNameReference).MetadataToken.ToInt32());
                        AsmDef.MainModule.AssemblyReferences.Remove(member.Member as AssemblyNameReference);
                        break;
                    }

                    tmp = member;
                }
            }
            catch (Exception e)
            {
                if (tmp == null)
                {
                    return(true);
                }

                ThrowPhaseError("Failed to clean up member!", 0, false);
            }

            var totalNum = Globals.DeobContext.MarkedMembers.Sum(member => member.Member.CalcChildMembers());

            Logger.VSLog(string.Format("{0} members cleaned from assembly...", totalNum));
            return(true);
        }