public void Find(ISimpleDeobfuscator simpleDeobfuscator) { if (module.Assembly == null) { return; } var pkt = module.Assembly.PublicKeyToken; bool hasPublicKeyToken = !PublicKeyBase.IsNullOrEmpty2(pkt); foreach (var type in module.GetTypes()) { var cctor = type.FindStaticConstructor(); if (cctor == null) { continue; } bool deobfuscatedCctor = false; bool?v13State = null, v40State = null, v41State = null; foreach (var method in type.Methods) { if (!method.IsStatic || method.Body == null) { continue; } IDecrypterInfo info = null; if (DecrypterInfo13.IsPossibleDecrypterMethod(method, ref v13State)) { DeobfuscateCctor(simpleDeobfuscator, cctor, ref deobfuscatedCctor, hasPublicKeyToken); simpleDeobfuscator.Deobfuscate(method); info = GetInfoV13(cctor, method); } else if (DecrypterInfo40.IsPossibleDecrypterMethod(method, ref v40State)) { DeobfuscateCctor(simpleDeobfuscator, cctor, ref deobfuscatedCctor, hasPublicKeyToken); simpleDeobfuscator.Deobfuscate(method); info = GetInfoV40(cctor, method); } else if (DecrypterInfo41.IsPossibleDecrypterMethod(method, ref v41State)) { DeobfuscateCctor(simpleDeobfuscator, cctor, ref deobfuscatedCctor, hasPublicKeyToken); simpleDeobfuscator.Deobfuscate(method); info = GetInfoV41(cctor, method); } if (info == null) { continue; } methodToInfo.Add(method, info); version = info.Version; } } }
public void find(ISimpleDeobfuscator simpleDeobfuscator) { if (module.Assembly == null) { return; } bool hasPublicKeyToken = module.Assembly.Name.PublicKeyToken != null && module.Assembly.Name.PublicKeyToken.Length != 0; foreach (var type in module.GetTypes()) { var cctor = DotNetUtils.getMethod(type, ".cctor"); if (cctor == null) { continue; } bool deobfuscatedCctor = false; foreach (var method in type.Methods) { if (!method.IsStatic || method.Body == null) { continue; } IDecrypterInfo info = null; if (DecrypterInfo13.isPossibleDecrypterMethod(method)) { deobfuscateCctor(simpleDeobfuscator, cctor, ref deobfuscatedCctor, hasPublicKeyToken); simpleDeobfuscator.deobfuscate(method); info = getInfoV13(cctor, method); } else if (DecrypterInfo40.isPossibleDecrypterMethod(method)) { deobfuscateCctor(simpleDeobfuscator, cctor, ref deobfuscatedCctor, hasPublicKeyToken); simpleDeobfuscator.deobfuscate(method); info = getInfoV40(cctor, method); } else if (DecrypterInfo41.isPossibleDecrypterMethod(method)) { deobfuscateCctor(simpleDeobfuscator, cctor, ref deobfuscatedCctor, hasPublicKeyToken); simpleDeobfuscator.deobfuscate(method); info = getInfoV41(cctor, method); } if (info == null) { continue; } methodToInfo.add(method, info); version = info.Version; } } }
public void find(ISimpleDeobfuscator simpleDeobfuscator) { if (module.Assembly == null) { return; } bool hasPublicKeyToken = module.Assembly.Name.PublicKeyToken != null && module.Assembly.Name.PublicKeyToken.Length != 0; foreach (var type in module.GetTypes()) { if (!checkFields(type.Fields)) { continue; } var cctor = DotNetUtils.getMethod(type, ".cctor"); if (cctor == null) { continue; } if (!hasPublicKeyToken) { simpleDeobfuscator.deobfuscate(cctor); } foreach (var method in type.Methods) { if (method.Body == null) { continue; } IDecrypterInfo info = null; if (DotNetUtils.isMethod(method, "System.String", "(System.Int32)")) { simpleDeobfuscator.deobfuscate(method); info = getInfoV3(cctor, method); } else if (DotNetUtils.isMethod(method, "System.String", "(System.Int32,System.Int32)")) { simpleDeobfuscator.deobfuscate(method); info = getInfoV4(cctor, method); } if (info == null) { continue; } methodToInfo.add(method, info); version = info.Version; } } }
public void find() { foreach (var type in module.Types) { var info = checkDecrypterType(type); if (info == null) { continue; } decrypterType = type; decrypterInfo = info; return; } }
public void Find(ISimpleDeobfuscator simpleDeobfuscator) { this.simpleDeobfuscator = simpleDeobfuscator; foreach (var type in module.Types) { var info = CheckDecrypterType(type); if (info == null) { continue; } decrypterType = type; decrypterInfo = info; return; } }
public void Find(ISimpleDeobfuscator simpleDeobfuscator) { this.simpleDeobfuscator = simpleDeobfuscator; foreach (var type in module.Types) { var info = CheckDecrypterType(type); if (info == null) continue; decrypterType = type; decrypterInfo = info; return; } }
public void find() { foreach (var type in module.Types) { var info = checkDecrypterType(type); if (info == null) continue; decrypterType = type; decrypterInfo = info; return; } }