static List <int> getConstants(MethodDefinition method) { var list = new List <int>(); if (method == null) { return(list); } int index = 0; var instrs = method.Body.Instructions; var constantsReader = new ConstantsReader(method); while (true) { int val; if (!constantsReader.getNextInt32(ref index, out val)) { break; } if (index < instrs.Count && instrs[index].OpCode.Code != Code.Ret) { list.Add(val); } } return(list); }
bool findIntsCctor(MethodDefinition cctor) { int index = 0; if (!findCallGetFrame(cctor, ref index)) { return(findIntsCctor2(cctor)); } int tmp1, tmp2, tmp3 = 0; var constantsReader = new ConstantsReader(cctor); if (!constantsReader.getNextInt32(ref index, out tmp1)) { return(false); } if (tmp1 == 0 && !constantsReader.getNextInt32(ref index, out tmp1)) { return(false); } if (!constantsReader.getNextInt32(ref index, out tmp2)) { return(false); } index = 0; var instrs = cctor.Body.Instructions; while (index < instrs.Count) { int tmp4; if (!constantsReader.getNextInt32(ref index, out tmp4)) { break; } if (index < instrs.Count && DotNetUtils.isLdloc(instrs[index])) { tmp3 = tmp4; } } i1 = tmp1 ^ tmp2 ^ tmp3; return(true); }
// Compact Framework doesn't have StackFrame bool findIntsCctor2(MethodDefinition cctor) { int index = 0; var instrs = cctor.Body.Instructions; var constantsReader = new ConstantsReader(cctor); while (index >= 0) { int val; if (!constantsReader.getNextInt32(ref index, out val)) { break; } if (index < instrs.Count && instrs[index].OpCode.Code == Code.Add) { i1 = val; return(true); } } return(false); }
bool findConstants(ISimpleDeobfuscator simpleDeobfuscator) { simpleDeobfuscator.deobfuscate(stringMethod); stringMethodConsts = new ConstantsReader(stringMethod); if (!findResource(stringMethod)) { return(false); } hasStringBuilder = new LocalTypes(stringMethod).exists("System.Text.StringBuilder"); checkMinus2 = isV32OrLater || DeobUtils.hasInteger(stringMethod, -2); usePublicKeyToken = callsGetPublicKeyToken(stringMethod); var int64Method = findInt64Method(stringMethod); if (int64Method != null) { decrypterType.Type = int64Method.DeclaringType; } if (!findShorts()) { return(false); } if (!findInt3()) { return(false); } if (!findInt4()) { return(false); } if (checkMinus2 && !findInt5()) { return(false); } dataDecrypterType = findDataDecrypterType(stringMethod); if (dataDecrypterType == null) { return(false); } if (isV32OrLater) { bool initializedAll; if (!findInts(out initializedAll)) { return(false); } var cctor = DotNetUtils.getMethod(stringType, ".cctor"); if (!initializedAll && cctor != null) { simpleDeobfuscator.deobfuscate(cctor); if (!findIntsCctor(cctor)) { return(false); } } if (decrypterType.Detected && !decrypterType.initialize()) { return(false); } } initializeFlags(); initialize(); return(true); }