public void Deobfuscate(MethodDef method) { Deobfuscate(method, (blocks) => { cflowDeobfuscator.Initialize(blocks); cflowDeobfuscator.Deobfuscate(); }); }
void ISimpleDeobfuscator.Deobfuscate(MethodDef method, bool force) { if (method == null || (!force && Check(method, SimpleDeobFlags.HasDeobfuscated))) return; Deobfuscate(method, "Deobfuscating control flow", (blocks) => { var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators); cflowDeobfuscator.Initialize(blocks); cflowDeobfuscator.Deobfuscate(); }); }
void Deobfuscate(MethodDef method, BlocksCflowDeobfuscator cflowDeobfuscator, MethodPrinter methodPrinter, bool isVerbose, bool isVV) { if (!HasNonEmptyBody(method)) return; var blocks = new Blocks(method); int numRemovedLocals = 0; int oldNumInstructions = method.Body.Instructions.Count; deob.DeobfuscateMethodBegin(blocks); if (options.ControlFlowDeobfuscation) { cflowDeobfuscator.Initialize(blocks); cflowDeobfuscator.Deobfuscate(); } if (deob.DeobfuscateOther(blocks) && options.ControlFlowDeobfuscation) cflowDeobfuscator.Deobfuscate(); if (options.ControlFlowDeobfuscation) { if (CanOptimizeLocals()) numRemovedLocals = blocks.OptimizeLocals(); blocks.RepartitionBlocks(); } DeobfuscateStrings(blocks); deob.DeobfuscateMethodEnd(blocks); IList<Instruction> allInstructions; IList<ExceptionHandler> allExceptionHandlers; blocks.GetCode(out allInstructions, out allExceptionHandlers); DotNetUtils.RestoreBody(method, allInstructions, allExceptionHandlers); if (isVerbose && numRemovedLocals > 0) Logger.v("Removed {0} unused local(s)", numRemovedLocals); int numRemovedInstructions = oldNumInstructions - method.Body.Instructions.Count; if (isVerbose && numRemovedInstructions > 0) Logger.v("Removed {0} dead instruction(s)", numRemovedInstructions); if (isVV) { Logger.Log(LoggerEvent.VeryVerbose, "Deobfuscated code:"); Logger.Instance.Indent(); methodPrinter.Print(LoggerEvent.VeryVerbose, allInstructions, allExceptionHandlers); Logger.Instance.DeIndent(); } }
void Deobfuscate(Blocks blocks) { cflowDeobfuscator.Initialize(blocks); cflowDeobfuscator.Deobfuscate(); }
void ISimpleDeobfuscator.Deobfuscate(MethodDef method, SimpleDeobfuscatorFlags flags) { bool force = (flags & SimpleDeobfuscatorFlags.Force) != 0; if (method == null || (!force && Check(method, SimpleDeobFlags.HasDeobfuscated))) return; Deobfuscate(method, "Deobfuscating control flow", (blocks) => { bool disableNewCFCode = (flags & SimpleDeobfuscatorFlags.DisableConstantsFolderExtraInstrs) != 0; var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators, disableNewCFCode); cflowDeobfuscator.Initialize(blocks); cflowDeobfuscator.Deobfuscate(); }); }