Пример #1
0
        byte[] getKeyData()
        {
            isNet1x = false;
            for (int i = 0; i < baseOffsets.Length; i++)
            {
                var code = peImage.offsetReadBytes(baseOffsets[i], decryptMethodPattern.Length);
                if (DeobUtils.isCode(decryptMethodPattern, code))
                {
                    return(getKeyData(baseOffsets[i]));
                }
            }

            var net1xCode = peImage.offsetReadBytes(0x207E0, startMethodNet1xPattern.Length);

            if (DeobUtils.isCode(startMethodNet1xPattern, net1xCode))
            {
                isNet1x = true;
                return(new byte[6] {
                    0x34, 0x38, 0x63, 0x65, 0x7A, 0x35
                });
            }

            return(null);
        }
Пример #2
0
        public bool decrypt(PeImage peImage, ISimpleDeobfuscator simpleDeobfuscator, ref DumpedMethods dumpedMethods, Dictionary <uint, byte[]> tokenToNativeCode)
        {
            if (encryptedResource.Method == null)
            {
                return(false);
            }

            encryptedResource.init(simpleDeobfuscator);
            if (!encryptedResource.FoundResource)
            {
                return(false);
            }
            var methodsData = encryptedResource.decrypt();

            bool hooksJitter = findDnrCompileMethod(encryptedResource.Method.DeclaringType) != null;

            xorKey = getXorKey();
            xorEncrypt(methodsData);

            var methodsDataReader = new BinaryReader(new MemoryStream(methodsData));
            int patchCount        = methodsDataReader.ReadInt32();
            int mode = methodsDataReader.ReadInt32();

            int tmp = methodsDataReader.ReadInt32();

            methodsDataReader.BaseStream.Position -= 4;
            if ((tmp & 0xFF000000) == 0x06000000)
            {
                // It's method token + rva. DNR 3.7.0.3 (and earlier?) - 3.9.0.1
                methodsDataReader.BaseStream.Position += 8L * patchCount;
                patchCount = methodsDataReader.ReadInt32();
                mode       = methodsDataReader.ReadInt32();

                patchDwords(peImage, methodsDataReader, patchCount);
                while (methodsDataReader.BaseStream.Position < methodsData.Length - 1)
                {
                    uint token     = methodsDataReader.ReadUInt32();
                    int  numDwords = methodsDataReader.ReadInt32();
                    patchDwords(peImage, methodsDataReader, numDwords / 2);
                }
            }
            else if (!hooksJitter || mode == 1)
            {
                // DNR 3.9.8.0, 4.0, 4.1, 4.2, 4.3, 4.4
                patchDwords(peImage, methodsDataReader, patchCount);
                while (methodsDataReader.BaseStream.Position < methodsData.Length - 1)
                {
                    uint rva   = methodsDataReader.ReadUInt32();
                    uint token = methodsDataReader.ReadUInt32();                        // token, unknown, or index
                    int  size  = methodsDataReader.ReadInt32();
                    if (size > 0)
                    {
                        peImage.dotNetSafeWrite(rva, methodsDataReader.ReadBytes(size));
                    }
                }
            }
            else
            {
                // DNR 4.0 - 4.4 (jitter is hooked)

                var  metadataTables = peImage.Cor20Header.createMetadataTables();
                var  methodDef      = metadataTables.getMetadataType(MetadataIndex.iMethodDef);
                var  rvaToIndex     = new Dictionary <uint, int>((int)methodDef.rows);
                uint offset         = methodDef.fileOffset;
                for (int i = 0; i < methodDef.rows; i++)
                {
                    uint rva = peImage.offsetReadUInt32(offset);
                    offset += methodDef.totalSize;
                    if (rva == 0)
                    {
                        continue;
                    }

                    if ((peImage.readByte(rva) & 3) == 2)
                    {
                        rva++;
                    }
                    else
                    {
                        rva += (uint)(4 * (peImage.readByte(rva + 1) >> 4));
                    }
                    rvaToIndex[rva] = i;
                }

                patchDwords(peImage, methodsDataReader, patchCount);
                int count = methodsDataReader.ReadInt32();
                dumpedMethods = new DumpedMethods();
                while (methodsDataReader.BaseStream.Position < methodsData.Length - 1)
                {
                    uint rva          = methodsDataReader.ReadUInt32();
                    uint index        = methodsDataReader.ReadUInt32();
                    bool isNativeCode = index >= 0x70000000;
                    int  size         = methodsDataReader.ReadInt32();
                    var  methodData   = methodsDataReader.ReadBytes(size);

                    int methodIndex;
                    if (!rvaToIndex.TryGetValue(rva, out methodIndex))
                    {
                        Log.w("Could not find method having code RVA {0:X8}", rva);
                        continue;
                    }
                    uint methodToken = 0x06000001 + (uint)methodIndex;

                    if (isNativeCode)
                    {
                        totalEncryptedNativeMethods++;
                        if (tokenToNativeCode != null)
                        {
                            tokenToNativeCode[methodToken] = methodData;
                        }

                        // Convert return true / false methods. The others are converted to
                        // throw 0xDEADCODE.
                        if (DeobUtils.isCode(nativeLdci4, methodData))
                        {
                            uint val = BitConverter.ToUInt32(methodData, 4);
                            // ldc.i4 XXXXXXXXh / ret
                            methodData    = new byte[] { 0x20, 0, 0, 0, 0, 0x2A };
                            methodData[1] = (byte)val;
                            methodData[2] = (byte)(val >> 8);
                            methodData[3] = (byte)(val >> 16);
                            methodData[4] = (byte)(val >> 24);
                        }
                        else if (DeobUtils.isCode(nativeLdci4_0, methodData))
                        {
                            // ldc.i4.0 / ret
                            methodData = new byte[] { 0x16, 0x2A };
                        }
                        else
                        {
                            tokenToNativeMethod[methodToken] = methodData;

                            // ldc.i4 0xDEADCODE / conv.u4 / throw
                            methodData = new byte[] { 0x20, 0xDE, 0xC0, 0xAD, 0xDE, 0x6D, 0x7A };
                        }
                    }

                    var dm = new DumpedMethod();
                    dm.token = methodToken;
                    dm.code  = methodData;

                    offset         = methodDef.fileOffset + (uint)(methodIndex * methodDef.totalSize);
                    rva            = peImage.offsetReadUInt32(offset);
                    dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDef.fields[1].offset);
                    dm.mdFlags     = peImage.offsetReadUInt16(offset + (uint)methodDef.fields[2].offset);
                    dm.mdName      = peImage.offsetRead(offset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size);
                    dm.mdSignature = peImage.offsetRead(offset + (uint)methodDef.fields[4].offset, methodDef.fields[4].size);
                    dm.mdParamList = peImage.offsetRead(offset + (uint)methodDef.fields[5].offset, methodDef.fields[5].size);

                    if ((peImage.readByte(rva) & 3) == 2)
                    {
                        dm.mhFlags          = 2;
                        dm.mhMaxStack       = 8;
                        dm.mhCodeSize       = (uint)dm.code.Length;
                        dm.mhLocalVarSigTok = 0;
                    }
                    else
                    {
                        dm.mhFlags          = peImage.readUInt16(rva);
                        dm.mhMaxStack       = peImage.readUInt16(rva + 2);
                        dm.mhCodeSize       = (uint)dm.code.Length;
                        dm.mhLocalVarSigTok = peImage.readUInt32(rva + 8);
                    }

                    dumpedMethods.add(dm);
                }
            }

            return(true);
        }
Пример #3
0
		public bool decrypt(MyPEImage peImage, ISimpleDeobfuscator simpleDeobfuscator, ref DumpedMethods dumpedMethods, Dictionary<uint, byte[]> tokenToNativeCode, bool unpackedNativeFile) {
			if (encryptedResource.Method == null)
				return false;

			encryptedResource.init(simpleDeobfuscator);
			if (!encryptedResource.FoundResource)
				return false;
			var methodsData = encryptedResource.decrypt();

			bool hooksJitter = findDnrCompileMethod(encryptedResource.Method.DeclaringType) != null;

			xorKey = getXorKey();
			xorEncrypt(methodsData);

			var methodsDataReader = MemoryImageStream.Create(methodsData);
			int patchCount = methodsDataReader.ReadInt32();
			int mode = methodsDataReader.ReadInt32();

			int tmp = methodsDataReader.ReadInt32();
			methodsDataReader.Position -= 4;
			if ((tmp & 0xFF000000) == 0x06000000) {
				// It's method token + rva. DNR 3.7.0.3 (and earlier?) - 3.9.0.1
				methodsDataReader.Position += 8L * patchCount;
				patchCount = methodsDataReader.ReadInt32();
				mode = methodsDataReader.ReadInt32();

				patchDwords(peImage, methodsDataReader, patchCount);
				while (methodsDataReader.Position < methodsData.Length - 1) {
					uint token = methodsDataReader.ReadUInt32();
					int numDwords = methodsDataReader.ReadInt32();
					patchDwords(peImage, methodsDataReader, numDwords / 2);
				}
			}
			else if (!hooksJitter || mode == 1) {
				// DNR 3.9.8.0, 4.0, 4.1, 4.2, 4.3, 4.4

				// If it's .NET 1.x, then offsets are used, not RVAs.
				bool useOffsets = unpackedNativeFile && module.IsClr1x;

				patchDwords(peImage, methodsDataReader, patchCount);
				while (methodsDataReader.Position < methodsData.Length - 1) {
					uint rva = methodsDataReader.ReadUInt32();
					uint token = methodsDataReader.ReadUInt32();	// token, unknown, or index
					int size = methodsDataReader.ReadInt32();
					if (size > 0) {
						var newData = methodsDataReader.ReadBytes(size);
						if (useOffsets)
							peImage.dotNetSafeWriteOffset(rva, newData);
						else
							peImage.dotNetSafeWrite(rva, newData);
					}
				}
			}
			else {
				// DNR 4.0 - 4.5 (jitter is hooked)

				var methodDef = peImage.DotNetFile.MetaData.TablesStream.MethodTable;
				var rvaToIndex = new Dictionary<uint, int>((int)methodDef.Rows);
				uint offset = (uint)methodDef.StartOffset;
				for (int i = 0; i < methodDef.Rows; i++) {
					uint rva = peImage.offsetReadUInt32(offset);
					offset += methodDef.RowSize;
					if (rva == 0)
						continue;

					if ((peImage.readByte(rva) & 3) == 2)
						rva++;
					else
						rva += (uint)(4 * (peImage.readByte(rva + 1) >> 4));
					rvaToIndex[rva] = i;
				}

				patchDwords(peImage, methodsDataReader, patchCount);
				int count = methodsDataReader.ReadInt32();
				dumpedMethods = new DumpedMethods();
				while (methodsDataReader.Position < methodsData.Length - 1) {
					uint rva = methodsDataReader.ReadUInt32();
					uint index = methodsDataReader.ReadUInt32();
					bool isNativeCode = index >= 0x70000000;
					int size = methodsDataReader.ReadInt32();
					var methodData = methodsDataReader.ReadBytes(size);

					int methodIndex;
					if (!rvaToIndex.TryGetValue(rva, out methodIndex)) {
						Logger.w("Could not find method having code RVA {0:X8}", rva);
						continue;
					}

					uint methodToken = 0x06000001 + (uint)methodIndex;

					if (isNativeCode) {
						totalEncryptedNativeMethods++;
						if (tokenToNativeCode != null)
							tokenToNativeCode[methodToken] = methodData;

						// Convert return true / false methods. The others are converted to
						// throw 0xDEADCODE.
						if (DeobUtils.isCode(nativeLdci4, methodData)) {
							uint val = BitConverter.ToUInt32(methodData, 4);
							// ldc.i4 XXXXXXXXh / ret
							methodData = new byte[] { 0x20, 0, 0, 0, 0, 0x2A };
							methodData[1] = (byte)val;
							methodData[2] = (byte)(val >> 8);
							methodData[3] = (byte)(val >> 16);
							methodData[4] = (byte)(val >> 24);
						}
						else if (DeobUtils.isCode(nativeLdci4_0, methodData)) {
							// ldc.i4.0 / ret
							methodData = new byte[] { 0x16, 0x2A };
						}
						else {
							tokenToNativeMethod[methodToken] = methodData;

							// ldc.i4 0xDEADCODE / conv.u4 / throw
							methodData = new byte[] { 0x20, 0xDE, 0xC0, 0xAD, 0xDE, 0x6D, 0x7A };
						}
					}

					var dm = new DumpedMethod();
					peImage.readMethodTableRowTo(dm, MDToken.ToRID(methodToken));
					dm.code = methodData;

					var codeReader = peImage.Reader;
					codeReader.Position = peImage.rvaToOffset(dm.mdRVA);
					byte[] code;
					var mbHeader = MethodBodyParser.parseMethodBody(codeReader, out code, out dm.extraSections);
					peImage.updateMethodHeaderInfo(dm, mbHeader);

					dumpedMethods.add(dm);
				}
			}

			return true;
		}