static uint GetStructSize(McKey mcKey) { uint magicLo = mcKey.ReadUInt32(0x8C0); uint magicHi = mcKey.ReadUInt32(0x8C4); // Key reader of McKey8C0h keys(untested). // Print MagicLo from McKey8C0h Logger.vv("The MagicLo from McKey8C0h is"); Logger.Instance.Indent(); Logger.vv("MagicLo = 0x" + magicLo.ToString("X")); Logger.Instance.DeIndent(); // Print MagicHi from McKey8C0h Logger.vv("The MagicHi from McKey8C0h is"); Logger.Instance.Indent(); Logger.vv("MagicHi = 0x" + magicHi.ToString("X")); Logger.Instance.DeIndent(); Logger.vv("If keys are new, add them with version info into EncryptionInfo[] McKey8C0h in de4dot.code\\deobfuscators\\MaxtoCode\\EncryptionInfos.cs, then publish your code."); foreach (var info in EncryptionInfos.McKey8C0h) { if (magicLo == info.MagicLo && magicHi == info.MagicHi) { Logger.vv("Keys in McKey8C0h infos is used."); return(0xC + 6 * ENCRYPTED_DATA_INFO_SIZE); } } return(0xC + 3 * ENCRYPTED_DATA_INFO_SIZE); }
static uint GetStructSize(McKey mcKey) { uint magicLo = mcKey.ReadUInt32(0x8C0); uint magicHi = mcKey.ReadUInt32(0x8C4); foreach (var info in EncryptionInfos.McKey8C0h) { if (magicLo == info.MagicLo && magicHi == info.MagicHi) return 0xC + 6 * ENCRYPTED_DATA_INFO_SIZE; } return 0xC + 3 * ENCRYPTED_DATA_INFO_SIZE; }
static uint GetStructSize(McKey mcKey) { uint magicLo = mcKey.ReadUInt32(0x8C0); uint magicHi = mcKey.ReadUInt32(0x8C4); foreach (var info in EncryptionInfos.McKey8C0h) { if (magicLo == info.MagicLo && magicHi == info.MagicHi) { return(0xC + 6 * ENCRYPTED_DATA_INFO_SIZE); } } return(0xC + 3 * ENCRYPTED_DATA_INFO_SIZE); }
public MethodInfos(ModuleDef module, MainType mainType, MyPEImage peImage, PeHeader peHeader, McKey mcKey) { this.module = module; this.mainType = mainType; this.peImage = peImage; this.peHeader = peHeader; this.mcKey = mcKey; structSize = GetStructSize(mcKey); uint methodInfosRva = peHeader.GetRva(0x0FF8, mcKey.ReadUInt32(0x005A)); uint encryptedDataRva = peHeader.GetRva(0x0FF0, mcKey.ReadUInt32(0x0046)); methodInfosOffset = peImage.RvaToOffset(methodInfosRva); encryptedDataOffset = peImage.RvaToOffset(encryptedDataRva); }
public MethodInfos(ModuleDef module, MainType mainType, MyPEImage peImage, PeHeader peHeader, McKey mcKey) { this.module = module; this.mainType = mainType; this.peImage = peImage; this.peHeader = peHeader; this.mcKey = mcKey; structSize = GetStructSize(mcKey); uint methodInfosRva = peHeader.GetRva(0x0FF8, mcKey.ReadUInt32(0x005A)); uint encryptedDataRva = peHeader.GetRva(0x0FF0, mcKey.ReadUInt32(0x0046)); methodInfosOffset = peImage.RvaToOffset(methodInfosRva); encryptedDataOffset = peImage.RvaToOffset(encryptedDataRva); }
EncryptionVersion GetVersion() { if (peHeader.EncryptionVersion != EncryptionVersion.Unknown) { // Print EncryptionVersion Logger.vv("The EncryptionVersion is"); Logger.Instance.Indent(); Logger.vv("Version = EncryptionVersion." + peHeader.EncryptionVersion.ToString()); Logger.vv("Add this version info with new keys into EncryptionInfo[] Rva900h and EncryptionInfo[] McKey8C0h in de4dot.code\\deobfuscators\\MaxtoCode\\EncryptionInfos.cs, then publish your code."); Logger.Instance.DeIndent(); return(peHeader.EncryptionVersion); } uint m2lo = mcKey.ReadUInt32(0x8C0); uint m2hi = mcKey.ReadUInt32(0x8C4); foreach (var info in EncryptionInfos.McKey8C0h) { if (info.MagicLo == m2lo && info.MagicHi == m2hi) { return(info.Version); } } Logger.w("Could not detect MC version. Magic2: {0:X8} {1:X8}", m2lo, m2hi); return(EncryptionVersion.Unknown); }
EncryptionVersion GetVersion() { if (peHeader.EncryptionVersion != EncryptionVersion.Unknown) { return(peHeader.EncryptionVersion); } uint m2lo = mcKey.ReadUInt32(0x8C0); uint m2hi = mcKey.ReadUInt32(0x8C4); foreach (var info in EncryptionInfos.McKey8C0h) { if (info.MagicLo == m2lo && info.MagicHi == m2hi) { return(info.Version); } } Logger.w("Could not detect MC version. Magic2: {0:X8} {1:X8}", m2lo, m2hi); return(EncryptionVersion.Unknown); }