예제 #1
0
        public override void deobfuscateBegin()
        {
            base.deobfuscateBegin();

            cliSecureRtType.findStringDecrypterMethod();
            stringDecrypter.Method = cliSecureRtType.StringDecrypterMethod;

            addAttributesToBeRemoved(cliSecureAttributes, "Obfuscator attribute");

            if (options.DecryptResources)
            {
                decryptResources(resourceDecrypter);
                addCctorInitCallToBeRemoved(resourceDecrypter.RsrcRrrMethod);
            }

            stackFrameHelper = new StackFrameHelper(module);
            stackFrameHelper.find();

            foreach (var type in module.Types)
            {
                if (type.FullName == "InitializeDelegate" && DotNetUtils.derivesFromDelegate(type))
                {
                    this.addTypeToBeRemoved(type, "Obfuscator type");
                }
            }

            proxyCallFixer.find();

            staticStringInliner.add(stringDecrypter.Method, (method, gim, args) => stringDecrypter.decrypt((string)args[0]));
            DeobfuscatedFile.stringDecryptersAdded();

            if (options.DecryptMethods)
            {
                addCctorInitCallToBeRemoved(cliSecureRtType.InitializeMethod);
                addCctorInitCallToBeRemoved(cliSecureRtType.PostInitializeMethod);
                findPossibleNamesToRemove(cliSecureRtType.LoadMethod);
            }

            if (options.RestoreVmCode)
            {
                csvm.restore();
                addAssemblyReferenceToBeRemoved(csvm.VmAssemblyReference, "CSVM assembly reference");
                addResourceToBeRemoved(csvm.Resource, "CSVM data resource");
            }
        }