예제 #1
0
        // 4.0.4, 4.1+
        Version checkHandlerV404_41(MethodDef handler, out List <FieldInfo> fieldInfos, out MethodDef decryptMethod)
        {
            Version version = Version.Unknown;

            fieldInfos    = new List <FieldInfo>();
            decryptMethod = null;

            var instrs = handler.Body.Instructions;

            for (int i = 0; i < instrs.Count - 6; i++)
            {
                int index = i;

                var ldci4_len = instrs[index++];
                if (!ldci4_len.IsLdcI4())
                {
                    continue;
                }
                if (instrs[index++].OpCode.Code != Code.Newarr)
                {
                    continue;
                }
                if (!instrs[index++].IsStloc())
                {
                    continue;
                }
                if (!instrs[index++].IsLdloc())
                {
                    continue;
                }

                var ldtoken = instrs[index++];
                if (ldtoken.OpCode.Code != Code.Ldtoken)
                {
                    continue;
                }
                var field = ldtoken.Operand as FieldDef;
                if (field == null || field.InitialValue == null || field.InitialValue.Length == 0)
                {
                    continue;
                }

                var call1 = instrs[index++];
                if (call1.OpCode.Code != Code.Call)
                {
                    continue;
                }
                if (!DotNetUtils.isMethod(call1.Operand as IMethod, "System.Void", "(System.Array,System.RuntimeFieldHandle)"))
                {
                    continue;
                }

                int callIndex = getCallDecryptMethodIndex(instrs, index);
                if (callIndex < 0)
                {
                    continue;
                }
                var args = DsUtils.getArgValues(instrs, callIndex);
                if (args == null)
                {
                    continue;
                }
                var decryptMethodTmp = instrs[callIndex].Operand as MethodDef;
                if (decryptMethodTmp == null)
                {
                    continue;
                }
                int     magic;
                Version versionTmp;
                getMagic(decryptMethodTmp, args, out versionTmp, out magic);

                version       = versionTmp;
                decryptMethod = decryptMethodTmp;
                fieldInfos.Add(new FieldInfo(field, magic));
            }

            return(version);
        }