public static string[] FindKeys(FourDepack.FourDots_PackedApplication packedAppInfo, SearchType keySearchType) // If a decryption method is called, it adds the string present just before to the found keys array and returns the final array. { string callOperandStringCompare = "CryptoHelper::Encrypt"; if (keySearchType == SearchType.DecryptionKeys) { callOperandStringCompare = "CryptoHelper::Decrypt"; } List <string> foundDecryptionKeys = new List <string>(); foreach (TypeDef t_ in packedAppInfo.PackedApplication_ModuleMD.Types) { foreach (MethodDef methods in t_.Methods) { if (!methods.HasBody) { continue; } for (int x = 0; x < methods.Body.Instructions.Count - 1; x++) { Instruction inst = methods.Body.Instructions[x]; if (inst.OpCode == OpCodes.Call && methods.Body.Instructions[x - 1].OpCode == OpCodes.Ldstr) { int tempInt = 0; for (int x_ = x; x_ > 0; x_--) { Instruction inst_ = methods.Body.Instructions[x_]; if (inst_.OpCode == OpCodes.Ldstr) { tempInt = x_; break; } } if (inst.Operand.ToString().Contains(callOperandStringCompare)) { foundDecryptionKeys.Add(methods.Body.Instructions[tempInt].Operand.ToString()); } } } } } return(foundDecryptionKeys.ToArray()); }
public Protections(string path) { PackedApplication_GlobalInfo = new FourDepack.FourDots_PackedApplication(path); }