public void TryDecryptString(byte[] contents, Func <byte[], bool> validate, bool ascii) { if (cryptoLocked) { currentEncryption.Decrypt(contents); return; } // Get score of data for each crypto var results = new DecryptedString[cryptos.Length]; for (var i = 0; i < cryptos.Length; i++) { var crypto = cryptos[i]; var copy = GetCopy(contents); crypto.Decrypt(copy); var score = getScoreForString(ascii ? Encoding.ASCII.GetString(copy) : Encoding.Unicode.GetString(copy), ascii); if (crypto == currentEncryption) { score += 5; } results[i] = new DecryptedString { decrypted = copy, score = score, crypto = crypto, }; } var orderedResults = results.OrderByDescending(x => x.score); // Take a wild guess, pick the first one var best = orderedResults.First(); currentEncryption = best.crypto; PutCurrentInFront(); best.decrypted.CopyTo(contents, 0); }
private Dictionary <MethodBase, List <DecryptedString> > GetDecryptedStrings(MethodInfo decryptionMethod) { ParameterInfo[] decryptionParameters = decryptionMethod.GetParameters(); Dictionary <MethodBase, List <DecryptedString> > stringsPerMethod = new Dictionary <MethodBase, List <DecryptedString> >(); var mc = AnalysisManager.Instance.GetMemberCache(decryptionMethod); IEnumerable <MemberInfo> methodsToInspect; if (specificMethod != null) { methodsToInspect = new MemberInfo[] { specificMethod } } ; else { methodsToInspect = mc.UsedBy.Select(entry => entry.Member); } foreach (MemberInfo mUsing in methodsToInspect) { if (mUsing is MethodBase) { List <DecryptedString> decryptedStrings = new List <DecryptedString>(); try { var instructions = ((MethodBase)mUsing).GetILInstructions(); var instructionsCallingDecrypt = instructions.Where(i => object.Equals(i.Operand, decryptionMethod)); foreach (var call in instructionsCallingDecrypt) { object[] parameterValues = new object[decryptionParameters.Length]; var curInstruction = call.Previous; int curParamIndex = decryptionParameters.Length - 1; while (curInstruction != null && curParamIndex >= 0) { object valuePutOnStackForInstruction = curInstruction.ConstantValuePutOnStack; if (valuePutOnStackForInstruction != null && decryptionParameters[curParamIndex].ParameterType.IsAssignableFrom(valuePutOnStackForInstruction.GetType())) { parameterValues[curParamIndex] = valuePutOnStackForInstruction; curParamIndex--; } curInstruction = curInstruction.Previous; } if (curParamIndex < 0) { string decryptedString = (string)decryptionMethod.Invoke(null, parameterValues); DecryptedString ds = new DecryptedString() { Decrypted = decryptedString, Encrypted = parameterValues.Where(p => p is string).FirstOrDefault() + "", ILOffset = call.Offset }; decryptedStrings.Add(ds); } } } catch (Exception ex) { decryptedStrings.Add(new DecryptedString() { Decrypted = "#ERROR: Unable to decrypt strings, " + ex.GetType().FullName + " - " + ex.Message, Encrypted = "", ILOffset = 0 }); } stringsPerMethod.Add((MethodBase)mUsing, decryptedStrings); } } return(stringsPerMethod); }