Exemplo n.º 1
0
        // Token: 0x0600019A RID: 410 RVA: 0x00061B74 File Offset: 0x0005FD74
        private void OnWriterEvent(object sender, ModuleWriterListenerEventArgs e)
        {
            ModuleWriterBase moduleWriterBase = (ModuleWriterBase)sender;
            bool             flag             = e.WriterEvent == ModuleWriterEvent.MDBeginAddResources;

            if (flag)
            {
                this.ctx.Context.CheckCancellation();
                this.ctx.Context.Logger.Debug("Encrypting resources...");
                bool flag2 = this.ctx.Context.Packer != null;
                List <EmbeddedResource> list = this.ctx.Module.Resources.OfType <EmbeddedResource>().ToList <EmbeddedResource>();
                bool flag3 = !flag2;
                if (flag3)
                {
                    this.ctx.Module.Resources.RemoveWhere((Resource res) => res is EmbeddedResource);
                }
                string    text      = this.ctx.Name.RandomName(RenameMode.Letters);
                PublicKey publicKey = null;
                bool      flag4     = moduleWriterBase.TheOptions.StrongNameKey != null;
                if (flag4)
                {
                    publicKey = PublicKeyBase.CreatePublicKey(moduleWriterBase.TheOptions.StrongNameKey.PublicKey);
                }
                AssemblyDefUser assemblyDefUser = new AssemblyDefUser(text, new Version(0, 0), publicKey);
                assemblyDefUser.Modules.Add(new ModuleDefUser(text + ".dll"));
                ModuleDef manifestModule = assemblyDefUser.ManifestModule;
                assemblyDefUser.ManifestModule.Kind = ModuleKind.Dll;
                AssemblyRefUser asmRef = new AssemblyRefUser(manifestModule.Assembly);
                bool            flag5  = !flag2;
                if (flag5)
                {
                    foreach (EmbeddedResource embeddedResource in list)
                    {
                        embeddedResource.Attributes = ManifestResourceAttributes.Public;
                        manifestModule.Resources.Add(embeddedResource);
                        this.ctx.Module.Resources.Add(new AssemblyLinkedResource(embeddedResource.Name, asmRef, embeddedResource.Attributes));
                    }
                }
                byte[] array;
                using (MemoryStream memoryStream = new MemoryStream())
                {
                    manifestModule.Write(memoryStream, new ModuleWriterOptions
                    {
                        StrongNameKey = moduleWriterBase.TheOptions.StrongNameKey
                    });
                    array = memoryStream.ToArray();
                }
                array = this.ctx.Context.Registry.GetService <ICompressionService>().Compress(array, delegate(double progress)
                {
                    this.ctx.Context.Logger.Progress((int)(progress * 10000.0), 10000);
                });
                this.ctx.Context.Logger.EndProgress();
                this.ctx.Context.CheckCancellation();
                uint num = (uint)((array.Length + 3) / 4);
                num = (num + 15u & 4294967280u);
                uint[] array2 = new uint[num];
                Buffer.BlockCopy(array, 0, array2, 0, array.Length);
                Debug.Assert(num % 16u == 0u);
                uint   num2   = this.ctx.Random.NextUInt32() | 16u;
                uint[] array3 = new uint[16];
                uint   num3   = num2;
                for (int i = 0; i < 16; i++)
                {
                    num3     ^= num3 >> 13;
                    num3     ^= num3 << 25;
                    num3     ^= num3 >> 27;
                    array3[i] = num3;
                }
                byte[] array4 = new byte[array2.Length * 4];
                int    j;
                for (j = 0; j < array2.Length; j += 16)
                {
                    uint[] src = this.ctx.ModeHandler.Encrypt(array2, j, array3);
                    for (int k = 0; k < 16; k++)
                    {
                        array3[k] ^= array2[j + k];
                    }
                    Buffer.BlockCopy(src, 0, array4, j * 4, 64);
                }
                Debug.Assert(j == array2.Length);
                uint       num4       = (uint)array4.Length;
                TablesHeap tablesHeap = moduleWriterBase.MetaData.TablesHeap;
                tablesHeap.ClassLayoutTable[moduleWriterBase.MetaData.GetClassLayoutRid(this.ctx.DataType)].ClassSize = num4;
                RawFieldRow rawFieldRow = tablesHeap.FieldTable[moduleWriterBase.MetaData.GetRid(this.ctx.DataField)];
                rawFieldRow.Flags     |= 256;
                this.encryptedResource = moduleWriterBase.Constants.Add(new ByteArrayChunk(array4), 8u);
                MutationHelper.InjectKeys(this.ctx.InitMethod, new int[]
                {
                    0,
                    1
                }, new int[]
                {
                    (int)(num4 / 4u),
                    (int)num2
                });
            }
            else
            {
                bool flag6 = e.WriterEvent == ModuleWriterEvent.EndCalculateRvasAndFileOffsets;
                if (flag6)
                {
                    TablesHeap tablesHeap2 = moduleWriterBase.MetaData.TablesHeap;
                    tablesHeap2.FieldRVATable[moduleWriterBase.MetaData.GetFieldRVARid(this.ctx.DataField)].RVA = (uint)this.encryptedResource.RVA;
                }
            }
        }
Exemplo n.º 2
0
        void OnWriterEvent(object sender, ModuleWriterListenerEventArgs e)
        {
            var writer = (ModuleWriterBase)sender;

            if (e.WriterEvent == ModuleWriterEvent.MDBeginAddResources)
            {
                ctx.Context.CheckCancellation();
                ctx.Context.Logger.Debug("Encrypting resources...");
                bool hasPacker = ctx.Context.Packer != null;

                List <EmbeddedResource> resources = ctx.Module.Resources.OfType <EmbeddedResource>().ToList();
                if (!hasPacker)
                {
                    ctx.Module.Resources.RemoveWhere(res => res is EmbeddedResource);
                }

                // move resources
                string    asmName = ctx.Name.RandomName(RenameMode.Letters);
                PublicKey pubKey  = null;
                if (writer.TheOptions.StrongNameKey != null)
                {
                    pubKey = PublicKeyBase.CreatePublicKey(writer.TheOptions.StrongNameKey.PublicKey);
                }
                var assembly = new AssemblyDefUser(asmName, new Version(0, 0), pubKey);
                assembly.Modules.Add(new ModuleDefUser(asmName + ".dll"));
                ModuleDef module = assembly.ManifestModule;
                assembly.ManifestModule.Kind = ModuleKind.Dll;
                var asmRef = new AssemblyRefUser(module.Assembly);
                if (!hasPacker)
                {
                    foreach (EmbeddedResource res in resources)
                    {
                        res.Attributes = ManifestResourceAttributes.Public;
                        module.Resources.Add(res);
                        ctx.Module.Resources.Add(new AssemblyLinkedResource(res.Name, asmRef, res.Attributes));
                    }
                }
                byte[] moduleBuff;
                using (var ms = new MemoryStream()) {
                    module.Write(ms, new ModuleWriterOptions {
                        StrongNameKey = writer.TheOptions.StrongNameKey
                    });
                    moduleBuff = ms.ToArray();
                }

                // compress
                moduleBuff = ctx.Context.Registry.GetService <ICompressionService>().Compress(
                    moduleBuff,
                    progress => ctx.Context.Logger.Progress((int)(progress * 10000), 10000));
                ctx.Context.Logger.EndProgress();
                ctx.Context.CheckCancellation();

                uint compressedLen = (uint)(moduleBuff.Length + 3) / 4;
                compressedLen = (compressedLen + 0xfu) & ~0xfu;
                var compressedBuff = new uint[compressedLen];
                Buffer.BlockCopy(moduleBuff, 0, compressedBuff, 0, moduleBuff.Length);
                Debug.Assert(compressedLen % 0x10 == 0);

                // encrypt
                uint keySeed = ctx.Random.NextUInt32() | 0x10;
                var  key     = new uint[0x10];
                uint state   = keySeed;
                for (int i = 0; i < 0x10; i++)
                {
                    state ^= state >> 13;
                    state ^= state << 25;
                    state ^= state >> 27;
                    key[i] = state;
                }

                var encryptedBuffer = new byte[compressedBuff.Length * 4];
                int buffIndex       = 0;
                while (buffIndex < compressedBuff.Length)
                {
                    uint[] enc = ctx.ModeHandler.Encrypt(compressedBuff, buffIndex, key);
                    for (int j = 0; j < 0x10; j++)
                    {
                        key[j] ^= compressedBuff[buffIndex + j];
                    }
                    Buffer.BlockCopy(enc, 0, encryptedBuffer, buffIndex * 4, 0x40);
                    buffIndex += 0x10;
                }
                Debug.Assert(buffIndex == compressedBuff.Length);
                var size = (uint)encryptedBuffer.Length;

                TablesHeap tblHeap = writer.MetaData.TablesHeap;
                tblHeap.ClassLayoutTable[writer.MetaData.GetClassLayoutRid(ctx.DataType)].ClassSize = size;
                tblHeap.FieldTable[writer.MetaData.GetRid(ctx.DataField)].Flags |= (ushort)FieldAttributes.HasFieldRVA;
                encryptedResource = writer.Constants.Add(new ByteArrayChunk(encryptedBuffer), 8);

                // inject key values
                MutationHelper.InjectKeys(ctx.InitMethod,
                                          new[] { 0, 1 },
                                          new[] { (int)(size / 4), (int)(keySeed) });
            }
            else if (e.WriterEvent == ModuleWriterEvent.EndCalculateRvasAndFileOffsets)
            {
                TablesHeap tblHeap = writer.MetaData.TablesHeap;
                tblHeap.FieldRVATable[writer.MetaData.GetFieldRVARid(ctx.DataField)].RVA = (uint)encryptedResource.RVA;
            }
        }