public override byte[] decrypt(MethodInfo methodInfo) { byte[] data = peImage.offsetReadBytes(endOfMetadata + methodInfo.codeOffs, (int)methodInfo.codeSize); int numQwords = (int)(methodInfo.codeSize / 8); for (int i = 0; i < numQwords; i++) { int offset = i * 8; uint q0 = be_readUint32(data, offset); uint q1 = be_readUint32(data, offset + 4); const uint magic = 0x9E3779B8; uint val = 0xC6EF3700; // magic * 0x20 for (int j = 0; j < 32; j++) { q1 -= ((q0 << 4) + key[2]) ^ (val + q0) ^ ((q0 >> 5) + key[3]); q0 -= ((q1 << 4) + key[0]) ^ (val + q1) ^ ((q1 >> 5) + key[1]); val -= magic; } be_writeUint32(data, offset, q0); be_writeUint32(data, offset + 4, q1); } return getCodeBytes(data); }
public override byte[] decrypt(MethodInfo methodInfo) { byte[] data = peImage.offsetReadBytes(endOfMetadata + methodInfo.codeOffs, (int)methodInfo.codeSize); for (int i = 0; i < data.Length; i++) { byte b = data[i]; b ^= codeHeader.decryptionKey[(methodInfo.codeOffs - 0x30 + i) % 16]; b ^= codeHeader.decryptionKey[(methodInfo.codeOffs - 0x30 + i + 7) % 16]; data[i] = b; } return getCodeBytes(data); }
public abstract byte[] decrypt(MethodInfo methodInfo);
public abstract MethodBodyHeader decrypt(MethodInfo methodInfo, out byte[] code, out byte[] extraSections);
public override MethodBodyHeader decrypt(MethodInfo methodInfo, out byte[] code, out byte[] extraSections) { byte[] data = peImage.offsetReadBytes(endOfMetadata + methodInfo.codeOffs, (int)methodInfo.codeSize); for (int i = 0; i < data.Length; i++) { byte b = data[i]; b ^= codeHeader.decryptionKey[(methodInfo.codeOffs - codeHeaderSize + i) % 16]; b ^= codeHeader.decryptionKey[(methodInfo.codeOffs - codeHeaderSize + i + 7) % 16]; data[i] = b; } return getCodeBytes(data, out code, out extraSections); }
public override MethodBodyHeader decrypt(MethodInfo methodInfo, out byte[] code, out byte[] extraSections) { peImage.Reader.BaseStream.Position = endOfMetadata + methodInfo.codeOffs; return MethodBodyParser.parseMethodBody(peImage.Reader, out code, out extraSections); }