Exemplo n.º 1
0
        public bool decrypt(PeImage peImage, ISimpleDeobfuscator simpleDeobfuscator, ref Dictionary<uint, DumpedMethod> dumpedMethods, Dictionary<uint,byte[]> tokenToNativeCode)
        {
            if (encryptedResource.Method == null)
                return false;

            encryptedResource.init(simpleDeobfuscator);
            if (!encryptedResource.FoundResource)
                return false;
            var methodsData = encryptedResource.decrypt();

            bool hooksJitter = findDnrCompileMethod(encryptedResource.Method.DeclaringType) != null;

            xorKey = getXorKey();
            xorEncrypt(methodsData);

            var methodsDataReader = new BinaryReader(new MemoryStream(methodsData));
            int patchCount = methodsDataReader.ReadInt32();
            int mode = methodsDataReader.ReadInt32();

            int tmp = methodsDataReader.ReadInt32();
            methodsDataReader.BaseStream.Position -= 4;
            if ((tmp & 0xFF000000) == 0x06000000) {
                // It's method token + rva. DNR 3.7.0.3 (and earlier?) - 3.9.0.1
                methodsDataReader.BaseStream.Position += 8L * patchCount;
                patchCount = methodsDataReader.ReadInt32();
                mode = methodsDataReader.ReadInt32();

                patchDwords(peImage, methodsDataReader, patchCount);
                while (methodsDataReader.BaseStream.Position < methodsData.Length - 1) {
                    uint token = methodsDataReader.ReadUInt32();
                    int numDwords = methodsDataReader.ReadInt32();
                    patchDwords(peImage, methodsDataReader, numDwords / 2);
                }
            }
            else if (!hooksJitter || mode == 1) {
                // DNR 3.9.8.0, 4.0, 4.1, 4.2, 4.3, 4.4
                patchDwords(peImage, methodsDataReader, patchCount);
                while (methodsDataReader.BaseStream.Position < methodsData.Length - 1) {
                    uint rva = methodsDataReader.ReadUInt32();
                    uint token = methodsDataReader.ReadUInt32();	// token, unknown, or index
                    int size = methodsDataReader.ReadInt32();
                    if (size > 0)
                        peImage.dotNetSafeWrite(rva, methodsDataReader.ReadBytes(size));
                }
            }
            else {
                // DNR 4.0 - 4.4 (jitter is hooked)

                var metadataTables = peImage.Cor20Header.createMetadataTables();
                var methodDef = metadataTables.getMetadataType(PE.MetadataIndex.iMethodDef);
                var rvaToIndex = new Dictionary<uint, int>((int)methodDef.rows);
                uint offset = methodDef.fileOffset;
                for (int i = 0; i < methodDef.rows; i++) {
                    uint rva = peImage.offsetReadUInt32(offset);
                    offset += methodDef.totalSize;
                    if (rva == 0)
                        continue;

                    if ((peImage.readByte(rva) & 3) == 2)
                        rva++;
                    else
                        rva += (uint)(4 * (peImage.readByte(rva + 1) >> 4));
                    rvaToIndex[rva] = i;
                }

                patchDwords(peImage, methodsDataReader, patchCount);
                int count = methodsDataReader.ReadInt32();
                dumpedMethods = new Dictionary<uint, DumpedMethod>();
                while (methodsDataReader.BaseStream.Position < methodsData.Length - 1) {
                    uint rva = methodsDataReader.ReadUInt32();
                    uint index = methodsDataReader.ReadUInt32();
                    bool isNativeCode = index >= 0x70000000;
                    int size = methodsDataReader.ReadInt32();
                    var methodData = methodsDataReader.ReadBytes(size);

                    int methodIndex;
                    if (!rvaToIndex.TryGetValue(rva, out methodIndex)) {
                        Log.w("Could not find method having code RVA {0:X8}", rva);
                        continue;
                    }
                    uint methodToken = 0x06000001 + (uint)methodIndex;

                    if (isNativeCode) {
                        totalEncryptedNativeMethods++;
                        if (tokenToNativeCode != null)
                            tokenToNativeCode[methodToken] = methodData;

                        // Convert return true / false methods. The others are converted to
                        // throw 0xDEADCODE.
                        if (DeobUtils.isCode(nativeLdci4, methodData)) {
                            uint val = BitConverter.ToUInt32(methodData, 4);
                            // ldc.i4 XXXXXXXXh / ret
                            methodData = new byte[] { 0x20, 0, 0, 0, 0, 0x2A };
                            methodData[1] = (byte)val;
                            methodData[2] = (byte)(val >> 8);
                            methodData[3] = (byte)(val >> 16);
                            methodData[4] = (byte)(val >> 24);
                        }
                        else if (DeobUtils.isCode(nativeLdci4_0, methodData)) {
                            // ldc.i4.0 / ret
                            methodData = new byte[] { 0x16, 0x2A };
                        }
                        else {
                            tokenToNativeMethod[methodToken] = methodData;

                            // ldc.i4 0xDEADCODE / conv.u4 / throw
                            methodData = new byte[] { 0x20, 0xDE, 0xC0, 0xAD, 0xDE, 0x6D, 0x7A };
                        }
                    }

                    var dm = new DumpedMethod();
                    dm.token = methodToken;
                    dm.code = methodData;

                    offset = methodDef.fileOffset + (uint)(methodIndex * methodDef.totalSize);
                    rva = peImage.offsetReadUInt32(offset);
                    dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDef.fields[1].offset);
                    dm.mdFlags = peImage.offsetReadUInt16(offset + (uint)methodDef.fields[2].offset);
                    dm.mdName = peImage.offsetRead(offset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size);
                    dm.mdSignature = peImage.offsetRead(offset + (uint)methodDef.fields[4].offset, methodDef.fields[4].size);
                    dm.mdParamList = peImage.offsetRead(offset + (uint)methodDef.fields[5].offset, methodDef.fields[5].size);

                    if ((peImage.readByte(rva) & 3) == 2) {
                        dm.mhFlags = 2;
                        dm.mhMaxStack = 8;
                        dm.mhCodeSize = (uint)dm.code.Length;
                        dm.mhLocalVarSigTok = 0;
                    }
                    else {
                        dm.mhFlags = peImage.readUInt16(rva);
                        dm.mhMaxStack = peImage.readUInt16(rva + 2);
                        dm.mhCodeSize = (uint)dm.code.Length;
                        dm.mhLocalVarSigTok = peImage.readUInt32(rva + 8);
                    }

                    dumpedMethods[dm.token] = dm;
                }
            }

            return true;
        }
Exemplo n.º 2
0
        public bool decrypt(PeImage peImage, ref DumpedMethods dumpedMethods)
        {
            this.peImage = peImage;

            uint offset = peImage.rvaToOffset(peImage.Cor20Header.metadataDirectory.virtualAddress + peImage.Cor20Header.metadataDirectory.size);
            if (!readCodeHeader(offset))
                return false;

            var metadataTables = peImage.Cor20Header.createMetadataTables();
            var methodDefTable = metadataTables.getMetadataType(PE.MetadataIndex.iMethodDef);
            if (methodDefTable.totalSize != codeHeader.methodDefElemSize)
                return false;

            var methodInfos = getMethodInfos(offset + 0x30 + codeHeader.totalCodeSize);

            offset = methodDefTable.fileOffset - methodDefTable.totalSize;
            foreach (var methodInfo in methodInfos) {
                offset += methodDefTable.totalSize;
                if (methodInfo.flags == 0 || methodInfo.codeOffs == 0)
                    continue;
                uint rva = peImage.offsetReadUInt32(offset);
                peImage.writeUint16(rva, (ushort)methodInfo.flags);
                peImage.writeUint32(rva + 8, methodInfo.localVarSigTok);
            }

            dumpedMethods = new DumpedMethods();
            offset = methodDefTable.fileOffset;
            for (int i = 0; i < methodInfos.Count; i++, offset += methodDefTable.totalSize) {
                var methodInfo = methodInfos[i];
                if (methodInfo.codeOffs == 0)
                    continue;

                var dm = new DumpedMethod();
                dm.token = 0x06000001 + (uint)i;

                uint rva = peImage.offsetReadUInt32(offset);
                dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[1].offset);
                dm.mdFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[2].offset);
                dm.mdName = peImage.offsetRead(offset + (uint)methodDefTable.fields[3].offset, methodDefTable.fields[3].size);
                dm.mdSignature = peImage.offsetRead(offset + (uint)methodDefTable.fields[4].offset, methodDefTable.fields[4].size);
                dm.mdParamList = peImage.offsetRead(offset + (uint)methodDefTable.fields[5].offset, methodDefTable.fields[5].size);

                dm.code = decrypter.decrypt(methodInfo);

                if ((peImage.readByte(rva) & 3) == 2) {
                    dm.mhFlags = 2;
                    dm.mhMaxStack = 8;
                    dm.mhCodeSize = (uint)dm.code.Length;
                    dm.mhLocalVarSigTok = 0;
                }
                else {
                    dm.mhFlags = peImage.readUInt16(rva);
                    dm.mhMaxStack = peImage.readUInt16(rva + 2);
                    dm.mhCodeSize = (uint)dm.code.Length;
                    dm.mhLocalVarSigTok = peImage.readUInt32(rva + 8);
                }

                dumpedMethods.add(dm);
            }

            return true;
        }