protected ProxyCallFixer1(ModuleDefMD module, ProxyCallFixer1 oldOne)
: base(module, oldOne)
{
foreach (var key in oldOne.fieldToDelegateInfo.GetKeys())
{
fieldToDelegateInfo.Add(Lookup(key, "Could not find field"), Copy(oldOne.fieldToDelegateInfo.Find(key)));
}
}
protected ProxyCallFixer4(ModuleDefMD module, ProxyCallFixer4 oldOne)
: base(module, oldOne)
{
foreach (var key in oldOne.fieldToDelegateInfo.GetKeys())
{
fieldToDelegateInfo.Add(Lookup(key, "Could not find field"), Copy(oldOne.fieldToDelegateInfo.Find(key)));
}
foreach (var oldMethod in oldOne.proxyMethodToDelegateInfo.GetKeys())
{
var oldDi = oldOne.proxyMethodToDelegateInfo.Find(oldMethod);
var method = Lookup(oldMethod, "Could not find proxy method");
proxyMethodToDelegateInfo.Add(method, Copy(oldDi));
}
}
protected override object CheckCctor(TypeDef type, MethodDef cctor) {
// Here if 1.2 r54564 (almost 1.3) or later
var fieldToInfo = new FieldDefAndDeclaringTypeDict<DelegateInitInfo>();
var instrs = cctor.Body.Instructions;
for (int i = 0; i < instrs.Count - 1; i++) {
var ldtoken = instrs[i];
if (ldtoken.OpCode.Code != Code.Ldtoken)
continue;
var field = ldtoken.Operand as FieldDef;
if (field == null || field.DeclaringType != cctor.DeclaringType)
continue;
var call = instrs[i + 1];
if (call.OpCode.Code != Code.Call)
continue;
var calledMethod = call.Operand as MethodDef;
if (calledMethod == null)
continue;
if (!IsDelegateCreatorMethod(calledMethod))
continue;
var info = methodToInfo.Find(calledMethod);
if (info == null)
continue;
i++;
fieldToInfo.Add(field, new DelegateInitInfo(field, calledMethod));
}
return fieldToInfo.Count == 0 ? null : fieldToInfo;
}
static internal IEnumerable <FieldDef> GetFields(TypeDef type)
{
var typeFields = new FieldDefAndDeclaringTypeDict <FieldDef>();
foreach (var field in type.Fields)
{
typeFields.Add(field, field);
}
var realFields = new Dictionary <FieldDef, bool>();
foreach (var method in type.Methods)
{
if (method.Body == null)
{
continue;
}
foreach (var instr in method.Body.Instructions)
{
var fieldRef = instr.Operand as IField;
if (fieldRef == null)
{
continue;
}
var field = typeFields.Find(fieldRef);
if (field == null)
{
continue;
}
realFields[field] = true;
}
}
return(realFields.Keys);
}
public void Initialize()
{
foreach (var kv in GetMovedTypes())
{
var structType = kv.Key;
structToOwners.Add(structType, kv.Value);
foreach (var ownerType in kv.Value)
{
foreach (var ownerField in ownerType.Fields)
{
if (DotNetUtils.GetType(module, ownerField.FieldSig.GetFieldType()) != structType)
{
continue;
}
structFieldsToFix.Add(ownerField, true);
break;
}
var fieldsDict = new FieldDefAndDeclaringTypeDict <FieldDef>();
typeToFieldsDict.Add(ownerType, fieldsDict);
foreach (var structField in structType.Fields)
{
var newField = module.UpdateRowId(new FieldDefUser(structField.Name, structField.FieldSig.Clone(), structField.Attributes));
ownerType.Fields.Add(newField);
fieldsDict.Add(structField, newField);
}
}
}
}
static short[] FindKey(MethodDef initMethod, FieldDef keyField)
{
var fields = new FieldDefAndDeclaringTypeDict <bool>();
fields.Add(keyField, true);
return(FindKey(initMethod, fields));
}
FieldDefAndDeclaringTypeDict<FieldDef> FindFieldTypes() {
var dict = new FieldDefAndDeclaringTypeDict<FieldDef>();
foreach (var type in module.GetTypes()) {
foreach (var method in type.Methods) {
var body = method.Body;
if (body == null)
continue;
foreach (var instr in body.Instructions) {
if (instr.OpCode.Code != Code.Ldsfld)
continue;
var field = instr.Operand as FieldDef;
if (field == null)
continue;
var declType = field.DeclaringType;
if (declType == null)
continue;
if (!InlinedMethodTypes.IsValidFieldType(declType))
continue;
dict.Add(field, field);
}
}
}
return dict;
}
FieldDefAndDeclaringTypeDict<DelegateInitInfo> CreateDelegateInitInfos_v10_r42915(MethodDef method) {
var infos = new FieldDefAndDeclaringTypeDict<DelegateInitInfo>();
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count - 2; i++) {
var ldstr = instrs[i];
if (ldstr.OpCode.Code != Code.Ldstr)
continue;
var info = ldstr.Operand as string;
if (info == null)
continue;
var ldtoken = instrs[i + 1];
if (ldtoken.OpCode.Code != Code.Ldtoken)
continue;
var delegateField = ldtoken.Operand as FieldDef;
if (delegateField == null)
continue;
var delegateType = delegateField.FieldType.TryGetTypeDef();
if (!DotNetUtils.DerivesFromDelegate(delegateType))
continue;
var call = instrs[i + 2];
if (call.OpCode.Code != Code.Call)
continue;
var delegateCreatorMethod = call.Operand as MethodDef;
if (delegateCreatorMethod == null || !IsDelegateCreatorMethod(delegateCreatorMethod))
continue;
infos.Add(delegateField, new DelegateInitInfo(info, delegateField, delegateCreatorMethod));
i += 2;
}
return infos;
}
protected bool Add(FieldDef field)
{
if (field == null)
{
return(false);
}
fields.Add(field, true);
return(true);
}
bool InitializeArrays2(ISimpleDeobfuscator simpleDeobfuscator, MethodDef method)
{
bool foundField = false;
simpleDeobfuscator.Deobfuscate(method, true);
var instructions = method.Body.Instructions;
for (int i = 0; i < instructions.Count; i++)
{
var ldci4 = instructions[i];
if (!ldci4.IsLdcI4())
{
continue;
}
i++;
var instrs = DotNetUtils.GetInstructions(instructions, i, OpCodes.Newarr, OpCodes.Dup, OpCodes.Ldtoken, OpCodes.Call, OpCodes.Stsfld);
if (instrs == null)
{
continue;
}
var arrayInitField = instrs[2].Operand as FieldDef;
if (arrayInitField == null || arrayInitField.InitialValue == null || arrayInitField.InitialValue.Length == 0)
{
continue;
}
var calledMethod = instrs[3].Operand as IMethod;
if (calledMethod == null || calledMethod.FullName != "System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)")
{
continue;
}
var targetField = instrs[4].Operand as FieldDef;
if (targetField == null || targetField.FieldType.GetElementType() != ElementType.SZArray)
{
continue;
}
var etype = ((SZArraySig)targetField.FieldType).Next.GetElementType();
if (etype < ElementType.Boolean || etype > ElementType.U4)
{
continue;
}
if (fieldToInfo.Find(targetField) == null)
{
fieldToInfo.Add(targetField, new FieldInfo(targetField, arrayInitField));
foundField = true;
}
}
return(foundField);
}
public void Initialize(ISimpleDeobfuscator deobfuscator)
{
if (decrypterCctor == null)
{
return;
}
deobfuscator.Deobfuscate(decrypterCctor);
var instrs = decrypterCctor.Body.Instructions;
for (int i = 0; i < instrs.Count - 4; i++)
{
var ldstr = instrs[i];
if (ldstr.OpCode.Code != Code.Ldstr)
{
continue;
}
var encryptedString = ldstr.Operand as string;
if (encryptedString == null)
{
continue;
}
if (instrs[i + 1].OpCode.Code != Code.Stsfld)
{
continue;
}
if (instrs[i + 2].OpCode.Code != Code.Ldsfld)
{
continue;
}
if (instrs[i + 3].OpCode.Code != Code.Call)
{
continue;
}
if (instrs[i + 4].OpCode.Code != Code.Stsfld)
{
continue;
}
var field = instrs[i + 4].Operand as FieldDef;
if (field == null)
{
continue;
}
if (!new SigComparer().Equals(field.DeclaringType, decrypterType))
{
continue;
}
fieldToDecryptedString.Add(field, decrypter.Decrypt(encryptedString));
}
}
static FieldDefAndDeclaringTypeDict<List<MethodDef>> CreateFieldToMethodsDictionary(TypeDef type) {
var dict = new FieldDefAndDeclaringTypeDict<List<MethodDef>>();
foreach (var method in type.Methods) {
if (!method.IsStatic || method.Body == null || method.Name == ".cctor")
continue;
var delegateField = GetDelegateField(method);
if (delegateField == null)
continue;
var methods = dict.Find(delegateField);
if (methods == null)
dict.Add(delegateField, methods = new List<MethodDef>());
methods.Add(method);
}
return dict;
}
void InitType(TypeDef type)
{
var cctor = type.FindStaticConstructor();
if (cctor == null)
{
return;
}
var info = GetStringInfo(cctor);
if (info == null)
{
return;
}
stringInfos.Add(info.field, info);
}
// Find the string decrypter string offset value or null if none found
int?FindOffsetValue(MethodDef method)
{
var fieldDict = new FieldDefAndDeclaringTypeDict <IField>();
foreach (var field in method.DeclaringType.Fields)
{
fieldDict.Add(field, field);
}
var offsetField = FindOffsetField(method);
if (offsetField == null)
{
return(null);
}
return(FindOffsetValue(method, (FieldDef)fieldDict.Find(offsetField), fieldDict));
}
public void InitializeEventHandlerNames()
{
var ourFields = new FieldDefAndDeclaringTypeDict <MFieldDef>();
foreach (var fieldDef in type.AllFields)
{
ourFields.Add(fieldDef.FieldDef, fieldDef);
}
var ourMethods = new MethodDefAndDeclaringTypeDict <MMethodDef>();
foreach (var methodDef in type.AllMethods)
{
ourMethods.Add(methodDef.MethodDef, methodDef);
}
InitVbEventHandlers(ourFields, ourMethods);
InitFieldEventHandlers(ourFields, ourMethods);
InitTypeEventHandlers(ourFields, ourMethods);
}
static internal IEnumerable<FieldDef> GetFields(TypeDef type) {
var typeFields = new FieldDefAndDeclaringTypeDict<FieldDef>();
foreach (var field in type.Fields)
typeFields.Add(field, field);
var realFields = new Dictionary<FieldDef, bool>();
foreach (var method in type.Methods) {
if (method.Body == null)
continue;
foreach (var instr in method.Body.Instructions) {
var fieldRef = instr.Operand as IField;
if (fieldRef == null)
continue;
var field = typeFields.Find(fieldRef);
if (field == null)
continue;
realFields[field] = true;
}
}
return realFields.Keys;
}
FieldDefAndDeclaringTypeDict <FieldDef> FindFieldTypes()
{
var dict = new FieldDefAndDeclaringTypeDict <FieldDef>();
foreach (var type in module.GetTypes())
{
foreach (var method in type.Methods)
{
var body = method.Body;
if (body == null)
{
continue;
}
foreach (var instr in body.Instructions)
{
if (instr.OpCode.Code != Code.Ldsfld)
{
continue;
}
var field = instr.Operand as FieldDef;
if (field == null)
{
continue;
}
var declType = field.DeclaringType;
if (declType == null)
{
continue;
}
if (!InlinedMethodTypes.IsValidFieldType(declType))
{
continue;
}
dict.Add(field, field);
}
}
}
return(dict);
}
static FieldDefAndDeclaringTypeDict <bool> GetFields(MethodDef method)
{
var fields = new FieldDefAndDeclaringTypeDict <bool>();
foreach (var instr in method.Body.Instructions)
{
if (instr.OpCode.Code != Code.Ldsfld && instr.OpCode.Code != Code.Stsfld)
{
continue;
}
var field = instr.Operand as FieldDef;
if (field == null)
{
continue;
}
if (field.DeclaringType != method.DeclaringType)
{
continue;
}
fields.Add(field, true);
}
return(fields);
}
public void Initialize() {
foreach (var kv in GetMovedTypes()) {
var structType = kv.Key;
structToOwners.Add(structType, kv.Value);
foreach (var ownerType in kv.Value) {
foreach (var ownerField in ownerType.Fields) {
if (DotNetUtils.GetType(module, ownerField.FieldSig.GetFieldType()) != structType)
continue;
structFieldsToFix.Add(ownerField, true);
break;
}
var fieldsDict = new FieldDefAndDeclaringTypeDict<FieldDef>();
typeToFieldsDict.Add(ownerType, fieldsDict);
foreach (var structField in structType.Fields) {
var newField = module.UpdateRowId(new FieldDefUser(structField.Name, structField.FieldSig.Clone(), structField.Attributes));
ownerType.Fields.Add(newField);
fieldsDict.Add(structField, newField);
}
}
}
}
static FieldDefAndDeclaringTypeDict<List<MethodDef>> CreateFieldToMethodsDictionary(TypeDef type) {
var dict = new FieldDefAndDeclaringTypeDict<List<MethodDef>>();
foreach (var method in type.Methods) {
if (!method.IsStatic || method.Body == null || method.Name == ".cctor")
continue;
var delegateField = GetDelegateField(method);
if (delegateField == null)
continue;
var methods = dict.Find(delegateField);
if (methods == null)
dict.Add(delegateField, methods = new List<MethodDef>());
methods.Add(method);
}
return dict;
}
// Find the string decrypter string offset value or null if none found
int? FindOffsetValue(MethodDef method) {
var fieldDict = new FieldDefAndDeclaringTypeDict<IField>();
foreach (var field in method.DeclaringType.Fields)
fieldDict.Add(field, field);
var offsetField = FindOffsetField(method);
if (offsetField == null)
return null;
return FindOffsetValue(method, (FieldDef)fieldDict.Find(offsetField), fieldDict);
}
protected override object CheckCctor(TypeDef type, MethodDef cctor) {
// Here if 1.2 r54564 (almost 1.3) or later
var fieldToInfo = new FieldDefAndDeclaringTypeDict<DelegateInitInfo>();
var instrs = cctor.Body.Instructions;
for (int i = 0; i < instrs.Count - 1; i++) {
var ldtoken = instrs[i];
if (ldtoken.OpCode.Code != Code.Ldtoken)
continue;
var field = ldtoken.Operand as FieldDef;
if (field == null || field.DeclaringType != cctor.DeclaringType)
continue;
var call = instrs[i + 1];
if (call.OpCode.Code != Code.Call)
continue;
var calledMethod = call.Operand as MethodDef;
if (calledMethod == null)
continue;
if (!IsDelegateCreatorMethod(calledMethod))
continue;
var info = methodToInfo.Find(calledMethod);
if (info == null)
continue;
i++;
fieldToInfo.Add(field, new DelegateInitInfo(field, calledMethod));
}
return fieldToInfo.Count == 0 ? null : fieldToInfo;
}
public void InitializeEventHandlerNames() {
var ourFields = new FieldDefAndDeclaringTypeDict<MFieldDef>();
foreach (var fieldDef in type.AllFields)
ourFields.Add(fieldDef.FieldDef, fieldDef);
var ourMethods = new MethodDefAndDeclaringTypeDict<MMethodDef>();
foreach (var methodDef in type.AllMethods)
ourMethods.Add(methodDef.MethodDef, methodDef);
InitVbEventHandlers(ourFields, ourMethods);
InitFieldEventHandlers(ourFields, ourMethods);
InitTypeEventHandlers(ourFields, ourMethods);
}
void InitializeWindowsFormsFieldsAndProps() {
var checker = NameChecker;
var ourFields = new FieldDefAndDeclaringTypeDict<MFieldDef>();
foreach (var fieldDef in type.AllFields)
ourFields.Add(fieldDef.FieldDef, fieldDef);
var ourMethods = new MethodDefAndDeclaringTypeDict<MMethodDef>();
foreach (var methodDef in type.AllMethods)
ourMethods.Add(methodDef.MethodDef, methodDef);
foreach (var methodDef in type.AllMethods) {
if (methodDef.MethodDef.Body == null)
continue;
if (methodDef.MethodDef.IsStatic || methodDef.MethodDef.IsVirtual)
continue;
var instructions = methodDef.MethodDef.Body.Instructions;
for (int i = 2; i < instructions.Count; i++) {
var call = instructions[i];
if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
continue;
if (!IsWindowsFormsSetNameMethod(call.Operand as IMethod))
continue;
var ldstr = instructions[i - 1];
if (ldstr.OpCode.Code != Code.Ldstr)
continue;
var fieldName = ldstr.Operand as string;
if (fieldName == null || !checker.IsValidFieldName(fieldName))
continue;
var instr = instructions[i - 2];
IField fieldRef = null;
if (instr.OpCode.Code == Code.Call || instr.OpCode.Code == Code.Callvirt) {
var calledMethod = instr.Operand as IMethod;
if (calledMethod == null)
continue;
var calledMethodDef = ourMethods.Find(calledMethod);
if (calledMethodDef == null)
continue;
fieldRef = GetFieldRef(calledMethodDef.MethodDef);
var propDef = calledMethodDef.Property;
if (propDef == null)
continue;
memberInfos.Property(propDef).suggestedName = fieldName;
fieldName = "_" + fieldName;
}
else if (instr.OpCode.Code == Code.Ldfld) {
fieldRef = instr.Operand as IField;
}
if (fieldRef == null)
continue;
var fieldDef = ourFields.Find(fieldRef);
if (fieldDef == null)
continue;
var fieldInfo = memberInfos.Field(fieldDef);
if (fieldInfo.renamed)
continue;
fieldInfo.suggestedName = variableNameState.GetNewFieldName(fieldInfo.oldName, new NameCreator2(fieldName));
}
}
}
void InitializeWindowsFormsFieldsAndProps()
{
var checker = NameChecker;
var ourFields = new FieldDefAndDeclaringTypeDict <MFieldDef>();
foreach (var fieldDef in type.AllFields)
{
ourFields.Add(fieldDef.FieldDef, fieldDef);
}
var ourMethods = new MethodDefAndDeclaringTypeDict <MMethodDef>();
foreach (var methodDef in type.AllMethods)
{
ourMethods.Add(methodDef.MethodDef, methodDef);
}
foreach (var methodDef in type.AllMethods)
{
if (methodDef.MethodDef.Body == null)
{
continue;
}
if (methodDef.MethodDef.IsStatic || methodDef.MethodDef.IsVirtual)
{
continue;
}
var instructions = methodDef.MethodDef.Body.Instructions;
for (int i = 2; i < instructions.Count; i++)
{
var call = instructions[i];
if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
{
continue;
}
if (!IsWindowsFormsSetNameMethod(call.Operand as IMethod))
{
continue;
}
var ldstr = instructions[i - 1];
if (ldstr.OpCode.Code != Code.Ldstr)
{
continue;
}
var fieldName = ldstr.Operand as string;
if (fieldName == null || !checker.IsValidFieldName(fieldName))
{
continue;
}
var instr = instructions[i - 2];
IField fieldRef = null;
if (instr.OpCode.Code == Code.Call || instr.OpCode.Code == Code.Callvirt)
{
var calledMethod = instr.Operand as IMethod;
if (calledMethod == null)
{
continue;
}
var calledMethodDef = ourMethods.Find(calledMethod);
if (calledMethodDef == null)
{
continue;
}
fieldRef = GetFieldRef(calledMethodDef.MethodDef);
var propDef = calledMethodDef.Property;
if (propDef == null)
{
continue;
}
memberInfos.Property(propDef).suggestedName = fieldName;
fieldName = "_" + fieldName;
}
else if (instr.OpCode.Code == Code.Ldfld)
{
fieldRef = instr.Operand as IField;
}
if (fieldRef == null)
{
continue;
}
var fieldDef = ourFields.Find(fieldRef);
if (fieldDef == null)
{
continue;
}
var fieldInfo = memberInfos.Field(fieldDef);
if (fieldInfo.renamed)
{
continue;
}
fieldInfo.suggestedName = variableNameState.GetNewFieldName(fieldInfo.oldName, new NameCreator2(fieldName));
}
}
}
static short[] FindKey(MethodDef initMethod, FieldDef keyField) {
var fields = new FieldDefAndDeclaringTypeDict<bool>();
fields.Add(keyField, true);
return FindKey(initMethod, fields);
}
static FieldDefAndDeclaringTypeDict<bool> GetFields(MethodDef method) {
var fields = new FieldDefAndDeclaringTypeDict<bool>();
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode.Code != Code.Ldsfld && instr.OpCode.Code != Code.Stsfld)
continue;
var field = instr.Operand as FieldDef;
if (field == null)
continue;
if (field.DeclaringType != method.DeclaringType)
continue;
fields.Add(field, true);
}
return fields;
}
FieldDefAndDeclaringTypeDict<DelegateInitInfo> CreateDelegateInitInfos_v10_r42915(MethodDef method) {
var infos = new FieldDefAndDeclaringTypeDict<DelegateInitInfo>();
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count - 2; i++) {
var ldstr = instrs[i];
if (ldstr.OpCode.Code != Code.Ldstr)
continue;
var info = ldstr.Operand as string;
if (info == null)
continue;
var ldtoken = instrs[i + 1];
if (ldtoken.OpCode.Code != Code.Ldtoken)
continue;
var delegateField = ldtoken.Operand as FieldDef;
if (delegateField == null)
continue;
var delegateType = delegateField.FieldType.TryGetTypeDef();
if (!DotNetUtils.DerivesFromDelegate(delegateType))
continue;
var call = instrs[i + 2];
if (call.OpCode.Code != Code.Call)
continue;
var delegateCreatorMethod = call.Operand as MethodDef;
if (delegateCreatorMethod == null || !IsDelegateCreatorMethod(delegateCreatorMethod))
continue;
infos.Add(delegateField, new DelegateInitInfo(info, delegateField, delegateCreatorMethod));
i += 2;
}
return infos;
}