public DecrypterInfo(MainType mainType, byte[] fileData) { this.mainType = mainType; this.peImage = new MyPEImage(fileData); this.peHeader = new PeHeader(mainType, peImage); this.mcKey = new McKey(peImage, peHeader); this.fileData = fileData; }
static uint GetStructSize(McKey mcKey) { uint magicLo = mcKey.ReadUInt32(0x8C0); uint magicHi = mcKey.ReadUInt32(0x8C4); foreach (var info in EncryptionInfos.McKey8C0h) { if (magicLo == info.MagicLo && magicHi == info.MagicHi) return 0xC + 6 * ENCRYPTED_DATA_INFO_SIZE; } return 0xC + 3 * ENCRYPTED_DATA_INFO_SIZE; }
public MethodInfos(ModuleDef module, MainType mainType, MyPEImage peImage, PeHeader peHeader, McKey mcKey) { this.module = module; this.mainType = mainType; this.peImage = peImage; this.peHeader = peHeader; this.mcKey = mcKey; structSize = GetStructSize(mcKey); uint methodInfosRva = peHeader.GetRva(0x0FF8, mcKey.ReadUInt32(0x005A)); uint encryptedDataRva = peHeader.GetRva(0x0FF0, mcKey.ReadUInt32(0x0046)); methodInfosOffset = peImage.RvaToOffset(methodInfosRva); encryptedDataOffset = peImage.RvaToOffset(encryptedDataRva); }
public MethodInfos(MainType mainType, PeImage peImage, PeHeader peHeader, McKey mcKey) { this.mainType = mainType; this.peImage = peImage; this.peHeader = peHeader; this.mcKey = mcKey; structSize = getStructSize(mcKey); uint methodInfosRva = peHeader.getRva2(0x0FF8, mcKey.readUInt32(0x005A)); uint encryptedDataRva = peHeader.getRva2(0x0FF0, mcKey.readUInt32(0x0046)); methodInfosOffset = peImage.rvaToOffset(methodInfosRva); encryptedDataOffset = peImage.rvaToOffset(encryptedDataRva); }
public bool decrypt(byte[] fileData, ref DumpedMethods dumpedMethods) { peImage = new PeImage(fileData); peHeader = new PeHeader(mainType, peImage); mcKey = new McKey(peImage, peHeader); this.fileData = fileData; dumpedMethods = decryptMethods(); if (dumpedMethods == null) return false; decryptResources(); decryptStrings(); return true; }
public MethodInfos(MainType mainType, MyPEImage peImage, PeHeader peHeader, McKey mcKey) { this.mainType = mainType; this.peImage = peImage; this.peHeader = peHeader; this.mcKey = mcKey; decryptHandlersV1 = new Decrypt[] { decrypt1a, decrypt4a, decrypt2a, decrypt3a, decrypt5, decrypt6, decrypt7 }; decryptHandlersV2 = new Decrypt[] { decrypt3a, decrypt2a, decrypt1a, decrypt4a, decrypt5, decrypt6, decrypt7 }; decryptHandlersV3 = new Decrypt[] { decrypt1a, decrypt2a, decrypt3a, decrypt4a, decrypt5, decrypt6, decrypt7 }; decryptHandlersV4 = new Decrypt[] { decrypt2a, decrypt1a, decrypt3a, decrypt4a, decrypt5, decrypt6, decrypt7 }; decryptHandlersV5a = new Decrypt[] { decrypt4a, decrypt2a, decrypt3a, decrypt1a, decrypt5, decrypt6, decrypt7 }; decryptHandlersV5b = new Decrypt[] { decrypt4b, decrypt2b, decrypt3b, decrypt1b, decrypt6, decrypt7, decrypt5 }; decryptHandlersV5c = new Decrypt[] { decrypt4c, decrypt2c, decrypt3c, decrypt1c, decrypt6, decrypt7, decrypt5 }; decryptHandlersV6a = new Decrypt[] { decrypt4d, decrypt2d, decrypt3d, decrypt1d, decrypt6, decrypt7, decrypt5 }; structSize = getStructSize(mcKey); uint methodInfosRva = peHeader.getRva(0x0FF8, mcKey.readUInt32(0x005A)); uint encryptedDataRva = peHeader.getRva(0x0FF0, mcKey.readUInt32(0x0046)); methodInfosOffset = peImage.rvaToOffset(methodInfosRva); encryptedDataOffset = peImage.rvaToOffset(encryptedDataRva); }