void findHouseOfCardsStrings_v1()
 {
     foreach (var type in module.Types)
     {
         if (type.Methods.Count != 1)
         {
             continue;
         }
         foreach (var method in DotNetUtils.findMethods(type.Methods, "System.Void", new string[] { }))
         {
             if (checkDelegateCreatorMethod(type, method))
             {
                 break;
             }
         }
     }
 }
        bool findDecrypterMethod()
        {
            if (stringDecrypterMethod != null)
            {
                return(true);
            }

            var methods = new List <MethodDef>(DotNetUtils.findMethods(stringsEncodingClass.Methods, "System.String", new string[] { "System.Int32" }));

            if (methods.Count != 1)
            {
                return(false);
            }

            stringDecrypterMethod = methods[0];
            return(true);
        }
Пример #3
0
        void findStringDecrypterMethods(TypeDefinition type, ISimpleDeobfuscator simpleDeobfuscator)
        {
            foreach (var method in DotNetUtils.findMethods(type.Methods, "System.String", new string[] { "System.String", "System.Int32" }))
            {
                if (method.Body.HasExceptionHandlers)
                {
                    continue;
                }

                var methodCalls = DotNetUtils.getMethodCallCounts(method);
                if (methodCalls.count("System.Char[] System.String::ToCharArray()") != 1)
                {
                    continue;
                }
                if (methodCalls.count("System.String System.String::Intern(System.String)") != 1)
                {
                    continue;
                }

                simpleDeobfuscator.deobfuscate(method);
                var instructions = method.Body.Instructions;
                for (int i = 0; i <= instructions.Count - 3; i++)
                {
                    var ldci4 = method.Body.Instructions[i];
                    if (!DotNetUtils.isLdcI4(ldci4))
                    {
                        continue;
                    }
                    if (instructions[i + 1].OpCode.Code != Code.Ldarg_1)
                    {
                        continue;
                    }
                    if (instructions[i + 2].OpCode.Code != Code.Add)
                    {
                        continue;
                    }

                    var info = new StringDecrypterInfo(method, DotNetUtils.getLdcI4Value(ldci4));
                    stringDecrypterMethods[info.method] = info;
                    Log.v("Found string decrypter method: {0}, magic: 0x{1:X8}", Utils.removeNewlines(info.method), info.magic);
                    break;
                }
            }
        }