예제 #1
0
        public bool deobfuscate()
        {
            bool changed = false;

            foreach (var block in allBlocks)
            {
                instructionEmulator.init(blocks);
                var instrs = block.Instructions;
                for (int i = 0; i < instrs.Count; i++)
                {
                    var instr = instrs[i];

                    switch (instr.OpCode.Code)
                    {
                    case Code.Ldarg:
                    case Code.Ldarg_0:
                    case Code.Ldarg_1:
                    case Code.Ldarg_2:
                    case Code.Ldarg_3:
                    case Code.Ldarg_S:
                        changed |= fixLoadInstruction(block, i, instructionEmulator.getArg(DotNetUtils.getParameter(args, instr.Instruction)));
                        break;

                    case Code.Ldloc:
                    case Code.Ldloc_0:
                    case Code.Ldloc_1:
                    case Code.Ldloc_2:
                    case Code.Ldloc_3:
                    case Code.Ldloc_S:
                        changed |= fixLoadInstruction(block, i, instructionEmulator.getLocal(DotNetUtils.getLocalVar(blocks.Locals, instr.Instruction)));
                        break;

                    case Code.Ldarga:
                    case Code.Ldarga_S:
                        instructionEmulator.makeArgUnknown((ParameterDefinition)instr.Operand);
                        break;

                    case Code.Ldloca:
                    case Code.Ldloca_S:
                        instructionEmulator.makeLocalUnknown((VariableDefinition)instr.Operand);
                        break;
                    }

                    try {
                        instructionEmulator.emulate(instr.Instruction);
                    }
                    catch (System.NullReferenceException) {
                        // Here if eg. invalid metadata token in a call instruction (operand is null)
                        break;
                    }
                }
            }
            return(changed);
        }
        protected override bool deobfuscate(Block block)
        {
            bool changed = false;

            instructionEmulator.init(blocks);
            var instrs = block.Instructions;

            for (int i = 0; i < instrs.Count; i++)
            {
                var instr = instrs[i];

                switch (instr.OpCode.Code)
                {
                case Code.Ldarg:
                case Code.Ldarg_0:
                case Code.Ldarg_1:
                case Code.Ldarg_2:
                case Code.Ldarg_3:
                case Code.Ldarg_S:
                    changed |= fixLoadInstruction(block, i, instructionEmulator.getArg(instr.Instruction.GetParameter(args)));
                    break;

                case Code.Ldloc:
                case Code.Ldloc_0:
                case Code.Ldloc_1:
                case Code.Ldloc_2:
                case Code.Ldloc_3:
                case Code.Ldloc_S:
                    changed |= fixLoadInstruction(block, i, instructionEmulator.getLocal(instr.Instruction.GetLocal(blocks.Locals)));
                    break;

                case Code.Ldarga:
                case Code.Ldarga_S:
                    instructionEmulator.makeArgUnknown((Parameter)instr.Operand);
                    break;

                case Code.Ldloca:
                case Code.Ldloca_S:
                    instructionEmulator.makeLocalUnknown((Local)instr.Operand);
                    break;
                }

                try {
                    instructionEmulator.emulate(instr.Instruction);
                }
                catch (NullReferenceException) {
                    // Here if eg. invalid metadata token in a call instruction (operand is null)
                    break;
                }
            }

            return(changed);
        }