public StringDecrypter(ModuleDefMD module, MainType mainType, StringDecrypter oldOne) { this.module = module; this.mainType = mainType; this.decrypterType = lookup(oldOne.decrypterType, "Could not find string decrypter type"); this.stringDataField = lookup(oldOne.stringDataField, "Could not find string data field"); this.initMethod = lookup(oldOne.initMethod, "Could not find string decrypter init method"); this.decrypterMethod = lookup(oldOne.decrypterMethod, "Could not find string decrypter method"); }
public ProxyCallFixer(ModuleDefMD module, MainType mainType, ProxyCallFixer oldOne) : base(module, oldOne) { this.mainType = mainType; info.proxyType = Lookup(oldOne.info.proxyType, "Could not find proxyType"); info.initMethod = Lookup(oldOne.info.initMethod, "Could not find initMethod"); info.dataField = Lookup(oldOne.info.dataField, "Could not find dataField"); info.ilgeneratorType = Lookup(oldOne.info.ilgeneratorType, "Could not find ilgeneratorType"); info.fieldInfoType = Lookup(oldOne.info.fieldInfoType, "Could not find fieldInfoType"); info.methodInfoType = Lookup(oldOne.info.methodInfoType, "Could not find methodInfoType"); }
public MainType(ModuleDefMD module, MainType oldOne) { this.module = module; this.theType = lookup(oldOne.theType, "Could not find main type"); this.initMethod = lookup(oldOne.initMethod, "Could not find main type init method"); this.tamperCheckMethod = lookup(oldOne.tamperCheckMethod, "Could not find tamper detection method"); this.obfuscatorVersion = oldOne.obfuscatorVersion; this.rvas = oldOne.rvas; foreach (var otherInitMethod in otherInitMethods) { otherInitMethods.Add(lookup(otherInitMethod, "Could not find otherInitMethod")); } }
protected override void scanForObfuscator() { findKillType(); mainType = new MainType(module); mainType.find(); proxyCallFixer = new ProxyCallFixer(module, mainType); proxyCallFixer.findDelegateCreator(); methodsDecrypter = new MethodsDecrypter(mainType); methodsDecrypter.find(); stringDecrypter = new StringDecrypter(module, mainType); stringDecrypter.find(); var version = detectVersion(); if (!string.IsNullOrEmpty(version)) { obfuscatorName = obfuscatorName + " " + version; } }
public StringDecrypter(ModuleDefMD module, MainType mainType) { this.module = module; this.mainType = mainType; }
public MethodsDecrypter(MainType mainType, MethodsDecrypter oldOne) { this.mainType = mainType; }
public TamperDetection(ModuleDefMD module, MainType mainType) { this.module = module; this.mainType = mainType; }
public ProxyCallFixer(ModuleDefMD module, MainType mainType) : base(module) { this.mainType = mainType; }
public MethodsDecrypter(MainType mainType) => this.mainType = mainType;
public ProxyDelegateFinder(ModuleDefinition module, MainType mainType) : base(module) { this.mainType = mainType; }