예제 #1
0
        void detectObfuscator(IEnumerable <IDeobfuscator> deobfuscators)
        {
            // The deobfuscators may call methods to deobfuscate control flow and decrypt
            // strings (statically) in order to detect the obfuscator.
            if (!options.ControlFlowDeobfuscation || options.StringDecrypterType == DecrypterType.None)
            {
                savedMethodBodies = new SavedMethodBodies();
            }

            // It's not null if it unpacked a native file
            if (this.deob != null)
            {
                deob.init(module);
                deob.DeobfuscatedFile = this;
                deob.earlyDetect();
                deob.detect();
                return;
            }

            foreach (var deob in deobfuscators)
            {
                deob.init(module);
                deob.DeobfuscatedFile = this;
            }

            if (options.ForcedObfuscatorType != null)
            {
                foreach (var deob in deobfuscators)
                {
                    if (string.Equals(options.ForcedObfuscatorType, deob.Type, StringComparison.OrdinalIgnoreCase))
                    {
                        deob.earlyDetect();
                        this.deob = deob;
                        deob.detect();
                        return;
                    }
                }
            }
            else
            {
                this.deob = earlyDetectObfuscator(deobfuscators);
                if (this.deob == null)
                {
                    this.deob = detectObfuscator2(deobfuscators);
                }
                else
                {
                    this.deob.detect();
                }
            }
        }