예제 #1
0
        public override void deobfuscateBegin()
        {
            base.deobfuscateBegin();

            addTypeToBeRemoved(killType, "KILL type");

            mainType.initialize();
            foreach (var initMethod in mainType.OtherInitMethods)
            {
                addCctorInitCallToBeRemoved(initMethod);
                addCtorInitCallToBeRemoved(initMethod);
            }

            if (Operations.DecryptStrings != OpDecryptString.None)
            {
                stringDecrypter.initialize();
                staticStringInliner.add(stringDecrypter.DecryptMethod, (method, gim, args) => {
                    return(stringDecrypter.decrypt((int)args[0]));
                });
                DeobfuscatedFile.stringDecryptersAdded();
                addModuleCctorInitCallToBeRemoved(stringDecrypter.InitMethod);
                addCallToBeRemoved(mainType.getInitStringDecrypterMethod(stringDecrypter.InitMethod), stringDecrypter.InitMethod);
            }

            assemblyResolver = new AssemblyResolver(module);
            assemblyResolver.initialize();
            dumpEmbeddedAssemblies();

            removeTamperDetection();

            proxyCallFixer.initialize();
            proxyCallFixer.find();

            resourceDecrypter = new ResourceDecrypter(module);
            resourceDecrypter.initialize();
            resourceDecrypter.decrypt();
            if (resourceDecrypter.CanRemoveTypes)
            {
                addTypeToBeRemoved(resourceDecrypter.ResourceFlagsType, "Obfuscator ResourceFlags type");
                addTypeToBeRemoved(resourceDecrypter.ResType, "Obfuscator Res type");
                addTypeToBeRemoved(resourceDecrypter.ResourceEnumeratorType, "Obfuscator ResourceEnumerator type");
                addTypeToBeRemoved(resourceDecrypter.EncryptedResourceReaderType, "Obfuscator EncryptedResourceReader type");
                addTypeToBeRemoved(resourceDecrypter.EncryptedResourceSetType, "Obfuscator EncryptedResourceSet type");
                addTypeToBeRemoved(resourceDecrypter.EncryptedResourceStreamType, "Obfuscator EncryptedResourceStream type");
            }
        }