DumpedMethods decryptMethods() { var dumpedMethods = new DumpedMethods(); var peImage = decrypterInfo.peImage; var methodInfos = new MethodInfos(decrypterInfo.mainType, peImage, decrypterInfo.peHeader, decrypterInfo.mcKey); methodInfos.initializeInfos(); var methodDef = peImage.DotNetFile.MetaData.TablesStream.MethodTable; for (uint rid = 1; rid <= methodDef.Rows; rid++) { var dm = new DumpedMethod(); peImage.readMethodTableRowTo(dm, rid); var info = methodInfos.lookup(dm.mdRVA); if (info == null) continue; ushort magic = peImage.readUInt16(dm.mdRVA); if (magic != 0xFFF3) continue; var mbHeader = MethodBodyParser.parseMethodBody(MemoryImageStream.Create(info.body), out dm.code, out dm.extraSections); peImage.updateMethodHeaderInfo(dm, mbHeader); dumpedMethods.add(dm); } return dumpedMethods; }
public bool Decrypt(MyPEImage peImage, ref DumpedMethods dumpedMethods) { dumpedMethods = new DumpedMethods(); bool decrypted = false; var methodDef = peImage.MetaData.TablesStream.MethodTable; for (uint rid = 1; rid <= methodDef.Rows; rid++) { var dm = new DumpedMethod(); peImage.ReadMethodTableRowTo(dm, rid); if (dm.mdRVA == 0) continue; uint bodyOffset = peImage.RvaToOffset(dm.mdRVA); peImage.Reader.Position = bodyOffset; var mbHeader = MethodBodyParser.ParseMethodBody(peImage.Reader, out dm.code, out dm.extraSections); peImage.UpdateMethodHeaderInfo(dm, mbHeader); if (dm.code.Length < 6 || dm.code[0] != 0x2A || dm.code[1] != 0x2A) continue; int seed = BitConverter.ToInt32(dm.code, 2); Array.Copy(newCodeHeader, dm.code, newCodeHeader.Length); if (seed == 0) Decrypt(dm.code); else Decrypt(dm.code, seed); dumpedMethods.Add(dm); decrypted = true; } return decrypted; }
public bool decrypt(ref DumpedMethods dumpedMethods) { dumpedMethods = decryptMethods(); if (dumpedMethods == null) return false; decryptResources(); decryptStrings(); return true; }
public bool Decrypt(MyPEImage peImage, byte[] fileData, ref DumpedMethods dumpedMethods) { if (initMethod == null) return false; switch (version) { case ConfuserVersion.v17_r73404: return Decrypt_v17_r73404(peImage, fileData, ref dumpedMethods); case ConfuserVersion.v17_r73430: return Decrypt_v17_r73404(peImage, fileData, ref dumpedMethods); case ConfuserVersion.v17_r73477: return Decrypt_v17_r73477(peImage, fileData, ref dumpedMethods); case ConfuserVersion.v17_r73479: return Decrypt_v17_r73479(peImage, fileData, ref dumpedMethods); case ConfuserVersion.v17_r74021: return Decrypt_v17_r73479(peImage, fileData, ref dumpedMethods); case ConfuserVersion.v18_r75257: return Decrypt_v17_r73479(peImage, fileData, ref dumpedMethods); case ConfuserVersion.v18_r75288: return Decrypt_v17_r73479(peImage, fileData, ref dumpedMethods); case ConfuserVersion.v18_r75291: return Decrypt_v17_r73479(peImage, fileData, ref dumpedMethods); case ConfuserVersion.v18_r75402: return Decrypt_v18_r75402(peImage, fileData, ref dumpedMethods); case ConfuserVersion.v19_r75725: return Decrypt_v18_r75402(peImage, fileData, ref dumpedMethods); default: throw new ApplicationException("Unknown version"); } }
public bool Decrypt(byte[] fileData, ref DumpedMethods dumpedMethods) { if (decrypter == null) return false; using (var peImage = new MyPEImage(fileData)) { if (peImage.Sections.Count <= 0) return false; var methodsData = FindMethodsData(peImage, fileData); if (methodsData == null) return false; decrypter.Initialize(methodsData); dumpedMethods = CreateDumpedMethods(peImage, fileData, methodsData); if (dumpedMethods == null) return false; } return true; }
DumpedMethods CreateDumpedMethods(MyPEImage peImage, byte[] fileData, byte[] methodsData) { var dumpedMethods = new DumpedMethods(); var methodsDataReader = MemoryImageStream.Create(methodsData); var fileDataReader = MemoryImageStream.Create(fileData); var methodDef = peImage.MetaData.TablesStream.MethodTable; for (uint rid = 1; rid <= methodDef.Rows; rid++) { var dm = new DumpedMethod(); peImage.ReadMethodTableRowTo(dm, rid); if (dm.mdRVA == 0) continue; uint bodyOffset = peImage.RvaToOffset(dm.mdRVA); byte b = peImage.OffsetReadByte(bodyOffset); uint codeOffset; if ((b & 3) == 2) { if (b != 2) continue; // not zero byte code size dm.mhFlags = 2; dm.mhMaxStack = 8; dm.mhLocalVarSigTok = 0; codeOffset = bodyOffset + 1; } else { if (peImage.OffsetReadUInt32(bodyOffset + 4) != 0) continue; // not zero byte code size dm.mhFlags = peImage.OffsetReadUInt16(bodyOffset); dm.mhMaxStack = peImage.OffsetReadUInt16(bodyOffset + 2); dm.mhLocalVarSigTok = peImage.OffsetReadUInt32(bodyOffset + 8); codeOffset = bodyOffset + (uint)(dm.mhFlags >> 12) * 4; } fileDataReader.Position = codeOffset; if (!decrypter.Decrypt(fileDataReader, dm)) continue; dumpedMethods.Add(dm); } return dumpedMethods; }
DumpedMethods Decrypt_v17_r73404(MyPEImage peImage, byte[] fileData) { var dumpedMethods = new DumpedMethods(); var methodDef = peImage.MetaData.TablesStream.MethodTable; for (uint rid = 1; rid <= methodDef.Rows; rid++) { var dm = new DumpedMethod(); peImage.ReadMethodTableRowTo(dm, rid); if (dm.mdRVA == 0) continue; uint bodyOffset = peImage.RvaToOffset(dm.mdRVA); if (!IsEncryptedMethod(fileData, (int)bodyOffset)) continue; int key = BitConverter.ToInt32(fileData, (int)bodyOffset + 6); int mdOffs = BitConverter.ToInt32(fileData, (int)bodyOffset + 2) ^ key; int len = BitConverter.ToInt32(fileData, (int)bodyOffset + 11) ^ ~key; var codeData = DecryptMethodData_v17_r73404(methodsData, mdOffs + 2, (uint)key, len); var reader = MemoryImageStream.Create(codeData); var mbHeader = MethodBodyParser.ParseMethodBody(reader, out dm.code, out dm.extraSections); if (reader.Position != reader.Length) throw new ApplicationException("Invalid method data"); peImage.UpdateMethodHeaderInfo(dm, mbHeader); dumpedMethods.Add(dm); } return dumpedMethods; }
public override bool GetDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) { if (count != 0) return false; fileData = ModuleBytes ?? DeobUtils.ReadModule(module); peImage = new MyPEImage(fileData); if (!options.DecryptMethods) return false; var tokenToNativeCode = new Dictionary<uint,byte[]>(); if (!methodsDecrypter.Decrypt(peImage, DeobfuscatedFile, ref dumpedMethods, tokenToNativeCode, unpackedNativeFile)) return false; newFileData = fileData; return true; }
DumpedMethodsRestorer CreateDumpedMethodsRestorer(DumpedMethods dumpedMethods) { if (dumpedMethods == null || dumpedMethods.Count == 0) return null; return new DumpedMethodsRestorer(dumpedMethods); }
bool decryptModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) { if (!methodsDecrypter.Detected) return false; byte[] fileData = ModuleBytes ?? DeobUtils.readModule(module); using (var peImage = new MyPEImage(fileData)) { if (!methodsDecrypter.decrypt(peImage, ref dumpedMethods)) return false; } newFileData = fileData; return true; }
public override bool GetDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) { if (count != 0 || version == Version.Unknown) return false; byte[] fileData = ModuleBytes ?? DeobUtils.ReadModule(module); byte[] decompressed; using (var peImage = new MyPEImage(fileData)) { var section = peImage.Sections[peImage.Sections.Count - 1]; var offset = section.PointerToRawData; offset += 16; byte[] compressed; int compressedLen; switch (version) { case Version.V0x: compressedLen = fileData.Length - (int)offset; compressed = peImage.OffsetReadBytes(offset, compressedLen); decompressed = Lzmat.DecompressOld(compressed); if (decompressed == null) throw new ApplicationException("LZMAT decompression failed"); break; case Version.V1x_217: case Version.V218: if (peImage.PEImage.ImageNTHeaders.FileHeader.Machine == Machine.AMD64 && version == Version.V218) offset = section.PointerToRawData + section.VirtualSize; int decompressedLen = (int)peImage.OffsetReadUInt32(offset); compressedLen = fileData.Length - (int)offset - 4; compressed = peImage.OffsetReadBytes(offset + 4, compressedLen); decompressed = new byte[decompressedLen]; uint decompressedLen2; if (Lzmat.Decompress(decompressed, out decompressedLen2, compressed) != LzmatStatus.OK) throw new ApplicationException("LZMAT decompression failed"); break; default: throw new ApplicationException("Unknown MPRESS version"); } } newFileData = decompressed; return true; }
public override bool GetDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) { if (count != 0 || !NeedsPatching()) return false; var fileData = ModuleBytes ?? DeobUtils.ReadModule(module); if (!decrypterType.Patch(fileData)) return false; newFileData = fileData; return true; }
public bool Decrypt(MyPEImage peImage, ISimpleDeobfuscator simpleDeobfuscator, ref DumpedMethods dumpedMethods, Dictionary<uint, byte[]> tokenToNativeCode, bool unpackedNativeFile) { if (encryptedResource.Method == null) return false; encryptedResource.Initialize(simpleDeobfuscator); if (!encryptedResource.FoundResource) return false; var methodsData = encryptedResource.Decrypt(); bool hooksJitter = FindDnrCompileMethod(encryptedResource.Method.DeclaringType) != null; xorKey = GetXorKey(); XorEncrypt(methodsData); var methodsDataReader = MemoryImageStream.Create(methodsData); int patchCount = methodsDataReader.ReadInt32(); int mode = methodsDataReader.ReadInt32(); int tmp = methodsDataReader.ReadInt32(); methodsDataReader.Position -= 4; if ((tmp & 0xFF000000) == 0x06000000) { // It's method token + rva. DNR 3.7.0.3 (and earlier?) - 3.9.0.1 methodsDataReader.Position += 8L * patchCount; patchCount = methodsDataReader.ReadInt32(); mode = methodsDataReader.ReadInt32(); PatchDwords(peImage, methodsDataReader, patchCount); while (methodsDataReader.Position < methodsData.Length - 1) { uint token = methodsDataReader.ReadUInt32(); int numDwords = methodsDataReader.ReadInt32(); PatchDwords(peImage, methodsDataReader, numDwords / 2); } } else if (!hooksJitter || mode == 1) { // DNR 3.9.8.0, 4.0+ PatchDwords(peImage, methodsDataReader, patchCount); bool oldCode = !IsNewer45Decryption(encryptedResource.Method); while (methodsDataReader.Position < methodsData.Length - 1) { uint rva = methodsDataReader.ReadUInt32(); int size; if (oldCode) { methodsDataReader.ReadUInt32(); // token, unknown, or index size = methodsDataReader.ReadInt32(); } else size = methodsDataReader.ReadInt32() * 4; var newData = methodsDataReader.ReadBytes(size); if (unpackedNativeFile) peImage.DotNetSafeWriteOffset(rva, newData); else peImage.DotNetSafeWrite(rva, newData); } } else { // DNR 4.0+ (jitter is hooked) var methodDef = peImage.MetaData.TablesStream.MethodTable; var rvaToIndex = new Dictionary<uint, int>((int)methodDef.Rows); uint offset = (uint)methodDef.StartOffset; for (int i = 0; i < methodDef.Rows; i++) { uint rva = peImage.OffsetReadUInt32(offset); offset += methodDef.RowSize; if (rva == 0) continue; if ((peImage.ReadByte(rva) & 3) == 2) rva++; else rva += (uint)(4 * (peImage.ReadByte(rva + 1) >> 4)); rvaToIndex[rva] = i; } PatchDwords(peImage, methodsDataReader, patchCount); int count = methodsDataReader.ReadInt32(); dumpedMethods = new DumpedMethods(); while (methodsDataReader.Position < methodsData.Length - 1) { uint rva = methodsDataReader.ReadUInt32(); uint index = methodsDataReader.ReadUInt32(); bool isNativeCode = index >= 0x70000000; int size = methodsDataReader.ReadInt32(); var methodData = methodsDataReader.ReadBytes(size); int methodIndex; if (!rvaToIndex.TryGetValue(rva, out methodIndex)) { Logger.w("Could not find method having code RVA {0:X8}", rva); continue; } uint methodToken = 0x06000001 + (uint)methodIndex; if (isNativeCode) { totalEncryptedNativeMethods++; if (tokenToNativeCode != null) tokenToNativeCode[methodToken] = methodData; // Convert return true / false methods. The others are converted to // throw 0xDEADCODE. if (DeobUtils.IsCode(nativeLdci4, methodData)) { uint val = BitConverter.ToUInt32(methodData, 4); // ldc.i4 XXXXXXXXh / ret methodData = new byte[] { 0x20, 0, 0, 0, 0, 0x2A }; methodData[1] = (byte)val; methodData[2] = (byte)(val >> 8); methodData[3] = (byte)(val >> 16); methodData[4] = (byte)(val >> 24); } else if (DeobUtils.IsCode(nativeLdci4_0, methodData)) { // ldc.i4.0 / ret methodData = new byte[] { 0x16, 0x2A }; } else { tokenToNativeMethod[methodToken] = methodData; // ldc.i4 0xDEADCODE / conv.u4 / throw methodData = new byte[] { 0x20, 0xDE, 0xC0, 0xAD, 0xDE, 0x6D, 0x7A }; } } var dm = new DumpedMethod(); peImage.ReadMethodTableRowTo(dm, MDToken.ToRID(methodToken)); dm.code = methodData; var codeReader = peImage.Reader; codeReader.Position = peImage.RvaToOffset(dm.mdRVA); byte[] code; var mbHeader = MethodBodyParser.ParseMethodBody(codeReader, out code, out dm.extraSections); peImage.UpdateMethodHeaderInfo(dm, mbHeader); dumpedMethods.Add(dm); } } return true; }
bool Decrypt_v17_r73479(MyPEImage peImage, byte[] fileData, ref DumpedMethods dumpedMethods) { methodsData = DecryptMethodsData_v17_r73404(peImage); dumpedMethods = Decrypt_v17_r73479(peImage, fileData); return dumpedMethods != null; }
bool Decrypt_v18_r75402(MyPEImage peImage, byte[] fileData, ref DumpedMethods dumpedMethods) { if (peImage.OptionalHeader.CheckSum == 0) return false; methodsData = DecryptMethodsData_v17_r73404(peImage); dumpedMethods = Decrypt_v18_r75402(peImage, fileData); return dumpedMethods != null; }
public override bool GetDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) { hasUnpacked = false; byte[] fileData = GetFileData(); using (var peImage = new MyPEImage(fileData)) { if ((decryptState & DecryptState.CanDecryptMethods) != 0) { bool decrypted = false; if (jitMethodsDecrypter != null && jitMethodsDecrypter.Detected) { jitMethodsDecrypter.Initialize(); if (!jitMethodsDecrypter.Decrypt(peImage, fileData, ref dumpedMethods)) return false; decrypted = true; } else if (memoryMethodsDecrypter != null && memoryMethodsDecrypter.Detected) { memoryMethodsDecrypter.Initialize(); if (!memoryMethodsDecrypter.Decrypt(peImage, fileData)) return false; decrypted = true; } if (decrypted) { decryptState &= ~DecryptState.CanDecryptMethods; decryptState |= DecryptState.CanUnpack; newFileData = fileData; ModuleBytes = newFileData; return true; } } } if ((decryptState & DecryptState.CanUnpack) != 0) { if (unpacker != null && unpacker.Detected) { if (options.DecryptMainAsm) { decryptState |= DecryptState.CanDecryptMethods | DecryptState.CanUnpack; var mainInfo = unpacker.UnpackMainAssembly(true); newFileData = mainInfo.data; realAssemblyInfo = mainInfo.realAssemblyInfo; embeddedAssemblyInfos.AddRange(unpacker.GetEmbeddedAssemblyInfos()); ModuleBytes = newFileData; hasUnpacked = true; return true; } else { decryptState &= ~DecryptState.CanUnpack; mainAsmInfo = unpacker.UnpackMainAssembly(false); embeddedAssemblyInfos.AddRange(unpacker.GetEmbeddedAssemblyInfos()); return false; } } } return false; }
DumpedMethods Decrypt(MyPEImage peImage, byte[] fileData, DecryptMethodData decrypter) { var dumpedMethods = new DumpedMethods(); var methodDef = peImage.MetaData.TablesStream.MethodTable; for (uint rid = 1; rid <= methodDef.Rows; rid++) { var dm = new DumpedMethod(); peImage.ReadMethodTableRowTo(dm, rid); if (dm.mdRVA == 0) continue; uint bodyOffset = peImage.RvaToOffset(dm.mdRVA); if (!IsEncryptedMethod(fileData, (int)bodyOffset)) continue; int key = BitConverter.ToInt32(fileData, (int)bodyOffset + 6); int mdOffs = BitConverter.ToInt32(fileData, (int)bodyOffset + 2) ^ key; int len = BitConverter.ToInt32(fileData, (int)bodyOffset + 11) ^ ~key; int methodDataOffset = mdOffs + 2; uint[] methodData; byte[] codeData; decrypter.Decrypt(methodsData, methodDataOffset, (uint)key, len, out methodData, out codeData); dm.mhFlags = 0x03; int maxStack = (int)methodData[methodDataIndexes.maxStack]; dm.mhMaxStack = (ushort)maxStack; dm.mhLocalVarSigTok = methodData[methodDataIndexes.localVarSigTok]; if (dm.mhLocalVarSigTok != 0 && (dm.mhLocalVarSigTok >> 24) != 0x11) throw new ApplicationException("Invalid local var sig token"); int numExceptions = (int)methodData[methodDataIndexes.ehs]; uint options = methodData[methodDataIndexes.options]; int codeSize = (int)methodData[methodDataIndexes.codeSize]; var codeDataReader = MemoryImageStream.Create(codeData); if (decrypter.IsCodeFollowedByExtraSections(options)) { dm.code = codeDataReader.ReadBytes(codeSize); dm.extraSections = ReadExceptionHandlers(codeDataReader, numExceptions); } else { dm.extraSections = ReadExceptionHandlers(codeDataReader, numExceptions); dm.code = codeDataReader.ReadBytes(codeSize); } if (codeDataReader.Position != codeDataReader.Length) throw new ApplicationException("Invalid method data"); if (dm.extraSections != null) dm.mhFlags |= 8; dm.mhCodeSize = (uint)dm.code.Length; // Figure out if the original method was tiny or not. bool isTiny = dm.code.Length <= 0x3F && dm.mhLocalVarSigTok == 0 && dm.extraSections == null && dm.mhMaxStack == 8; if (isTiny) dm.mhFlags |= 0x10; // Set 'init locals' dm.mhFlags |= (ushort)(options & 0x10); // copy 'init locals' bit dumpedMethods.Add(dm); } return dumpedMethods; }
public override bool GetDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) { if (count != 0 || !assemblyDecrypter.EncryptedDetected) return false; newFileData = assemblyDecrypter.Decrypt(); return newFileData != null; }
public bool Decrypt(MyPEImage peImage, ModuleDefMD module, CliSecureRtType csRtType, ref DumpedMethods dumpedMethods) { this.peImage = peImage; this.csRtType = csRtType; this.module = module; switch (Decrypt2(ref dumpedMethods)) { case DecryptResult.Decrypted: return true; case DecryptResult.NotEncrypted: return false; case DecryptResult.Error: Logger.n("Using dynamic method decryption"); byte[] moduleCctorBytes = GetModuleCctorBytes(csRtType); dumpedMethods = de4dot.code.deobfuscators.MethodsDecrypter.Decrypt(module, moduleCctorBytes); return true; default: throw new ApplicationException("Invalid DecryptResult"); } }
public override bool GetDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) { if (count != 0 || !methodsDecrypter.Detected) return false; var fileData = DeobUtils.ReadModule(module); if (!methodsDecrypter.Decrypt(fileData, ref dumpedMethods)) return false; newFileData = fileData; return true; }
DecryptResult Decrypt2(ref DumpedMethods dumpedMethods) { uint codeHeaderOffset = InitializeCodeHeader(); if (sigType == SigType.Unknown) return DecryptResult.NotEncrypted; var methodDefTable = peImage.MetaData.TablesStream.MethodTable; foreach (var version in GetCsHeaderVersions(codeHeaderOffset, methodDefTable)) { try { if (version == CsHeaderVersion.V10) DecryptMethodsOld(methodDefTable, ref dumpedMethods); else DecryptMethods(codeHeaderOffset, methodDefTable, CreateCsHeader(version), ref dumpedMethods); return DecryptResult.Decrypted; } catch { } } return DecryptResult.Error; }
void ReloadModule(byte[] newModuleData, DumpedMethods dumpedMethods) { Logger.v("Reloading decrypted assembly (original filename: {0})", Filename); simpleDeobfuscatorFlags.Clear(); using (var oldModule = module) { module = assemblyModule.Reload(newModuleData, CreateDumpedMethodsRestorer(dumpedMethods), deob as IStringDecrypter); deob = deob.ModuleReloaded(module); } InitializeDeobfuscator(); deob.DeobfuscatedFile = this; UpdateDynamicStringInliner(); }
void DecryptMethodsOld(MDTable methodDefTable, ref DumpedMethods dumpedMethods) { dumpedMethods = new DumpedMethods(); var decrypter = new Decrypter10(peImage, codeHeader.decryptionKey); for (uint rid = 1; rid <= methodDefTable.Rows; rid++) { var dm = new DumpedMethod(); var method = (MethodDef)module.ResolveMethod(rid); if (method == null || method.DeclaringType == module.GlobalType) continue; peImage.ReadMethodTableRowTo(dm, rid); if (dm.mdRVA == 0) continue; uint bodyOffset = peImage.RvaToOffset(dm.mdRVA); var mbHeader = decrypter.Decrypt(bodyOffset, out dm.code, out dm.extraSections); peImage.UpdateMethodHeaderInfo(dm, mbHeader); dumpedMethods.Add(dm); } }
public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) { if ((decryptState & DecryptState.CanDecryptMethods) != 0) { if (decryptModule(ref newFileData, ref dumpedMethods)) { ModuleBytes = newFileData; decryptState &= ~DecryptState.CanDecryptMethods; return true; } } if (options.DecryptMainAsm && (decryptState & DecryptState.CanGetMainAssembly) != 0) { newFileData = getMainAssemblyBytes(); if (newFileData != null) { ModuleBytes = newFileData; decryptState &= ~DecryptState.CanGetMainAssembly; decryptState |= DecryptState.CanDecryptMethods; return true; } } return false; }
void DecryptMethods(uint codeHeaderOffset, MDTable methodDefTable, ICsHeader csHeader, ref DumpedMethods dumpedMethods) { var methodInfos = csHeader.GetMethodInfos(codeHeaderOffset); csHeader.PatchMethodTable(methodDefTable, methodInfos); dumpedMethods = new DumpedMethods(); decrypter = csHeader.CreateDecrypter(); for (uint rid = 1; rid <= (uint)methodInfos.Count; rid++) { var methodInfo = methodInfos[(int)rid - 1]; if (methodInfo.codeOffs == 0) continue; var dm = new DumpedMethod(); peImage.ReadMethodTableRowTo(dm, rid); var mbHeader = decrypter.Decrypt(methodInfo, out dm.code, out dm.extraSections); peImage.UpdateMethodHeaderInfo(dm, mbHeader); dumpedMethods.Add(dm); } }
public override bool GetDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) { if (count != 0 || !options.DecryptMethods) return false; byte[] fileData = ModuleBytes ?? DeobUtils.ReadModule(module); using (var peImage = new MyPEImage(fileData)) { if (!new MethodsDecrypter().Decrypt(peImage, module, cliSecureRtType, ref dumpedMethods)) { Logger.v("Methods aren't encrypted or invalid signature"); return false; } } newFileData = fileData; return true; }
public override bool GetDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) { if (count != 0 || !mainType.Detected) return false; var fileData = DeobUtils.ReadModule(module); decrypterInfo = new DecrypterInfo(mainType, fileData); var methodsDecrypter = new MethodsDecrypter(module, decrypterInfo); if (!methodsDecrypter.Decrypt(ref dumpedMethods)) return false; newFileData = fileData; return true; }