public PeHeader(MainType mainType, PeImage peImage) { headerData = getPeHeaderData(peImage); if (!mainType.IsOld && peImage.readUInt32(0x2008) != 0x48) { rvaDispl1 = readUInt32(0x0FB0) ^ XOR_KEY; rvaDispl2 = readUInt32(0x0FB4) ^ XOR_KEY; } }
public void initializeInfos() { initializeDecrypter(); int numMethods = readInt32(0) ^ readInt32(4); if (numMethods < 0) { throw new ApplicationException("Invalid number of encrypted methods"); } xorKey = (uint)numMethods; uint rvaDispl = !mainType.IsOld && peImage.readUInt32(0x2008) != 0x48 ? 0x1000U : 0; int numEncryptedDataInfos = ((int)structSize - 0xC) / ENCRYPTED_DATA_INFO_SIZE; var encryptedDataInfos = new byte[numEncryptedDataInfos][]; uint offset = 8; for (int i = 0; i < numMethods; i++, offset += structSize) { uint methodBodyRva = readEncryptedUInt32(offset) - rvaDispl; uint totalSize = readEncryptedUInt32(offset + 4); uint methodInstructionRva = readEncryptedUInt32(offset + 8) - rvaDispl; var decryptedData = new byte[totalSize]; // Read the method body header and method body (instrs + exception handlers). // The method body header is always in the first one. The instrs + ex handlers // are always in the last 4, and evenly divided (each byte[] is totalLen / 4). // The 2nd one is for the exceptions (or padding), but it may be null. uint offset2 = offset + 0xC; int exOffset = 0; for (int j = 0; j < encryptedDataInfos.Length; j++, offset2 += ENCRYPTED_DATA_INFO_SIZE) { // readByte(offset2); <-- index int encryptionType = readEncryptedInt16(offset2 + 1); uint dataOffset = readEncryptedUInt32(offset2 + 3); uint encryptedSize = readEncryptedUInt32(offset2 + 7); uint realSize = readEncryptedUInt32(offset2 + 11); if (j == 1) { exOffset = readEncryptedInt32(offset2 + 15); } if (j == 1 && exOffset == 0) { encryptedDataInfos[j] = null; } else { encryptedDataInfos[j] = decrypt(encryptionType, dataOffset, encryptedSize, realSize); } } int copyOffset = 0; copyOffset = copyData(decryptedData, encryptedDataInfos[0], copyOffset); for (int j = 2; j < encryptedDataInfos.Length; j++) { copyOffset = copyData(decryptedData, encryptedDataInfos[j], copyOffset); } copyData(decryptedData, encryptedDataInfos[1], exOffset); // Exceptions or padding var info = new DecryptedMethodInfo(methodBodyRva, decryptedData); infos[info.bodyRva] = info; } }
public bool decrypt(PeImage peImage, ISimpleDeobfuscator simpleDeobfuscator, ref DumpedMethods dumpedMethods, Dictionary <uint, byte[]> tokenToNativeCode) { if (encryptedResource.Method == null) { return(false); } encryptedResource.init(simpleDeobfuscator); if (!encryptedResource.FoundResource) { return(false); } var methodsData = encryptedResource.decrypt(); bool hooksJitter = findDnrCompileMethod(encryptedResource.Method.DeclaringType) != null; xorKey = getXorKey(); xorEncrypt(methodsData); var methodsDataReader = new BinaryReader(new MemoryStream(methodsData)); int patchCount = methodsDataReader.ReadInt32(); int mode = methodsDataReader.ReadInt32(); int tmp = methodsDataReader.ReadInt32(); methodsDataReader.BaseStream.Position -= 4; if ((tmp & 0xFF000000) == 0x06000000) { // It's method token + rva. DNR 3.7.0.3 (and earlier?) - 3.9.0.1 methodsDataReader.BaseStream.Position += 8L * patchCount; patchCount = methodsDataReader.ReadInt32(); mode = methodsDataReader.ReadInt32(); patchDwords(peImage, methodsDataReader, patchCount); while (methodsDataReader.BaseStream.Position < methodsData.Length - 1) { uint token = methodsDataReader.ReadUInt32(); int numDwords = methodsDataReader.ReadInt32(); patchDwords(peImage, methodsDataReader, numDwords / 2); } } else if (!hooksJitter || mode == 1) { // DNR 3.9.8.0, 4.0, 4.1, 4.2, 4.3, 4.4 patchDwords(peImage, methodsDataReader, patchCount); while (methodsDataReader.BaseStream.Position < methodsData.Length - 1) { uint rva = methodsDataReader.ReadUInt32(); uint token = methodsDataReader.ReadUInt32(); // token, unknown, or index int size = methodsDataReader.ReadInt32(); if (size > 0) { peImage.dotNetSafeWrite(rva, methodsDataReader.ReadBytes(size)); } } } else { // DNR 4.0 - 4.4 (jitter is hooked) var metadataTables = peImage.Cor20Header.createMetadataTables(); var methodDef = metadataTables.getMetadataType(MetadataIndex.iMethodDef); var rvaToIndex = new Dictionary <uint, int>((int)methodDef.rows); uint offset = methodDef.fileOffset; for (int i = 0; i < methodDef.rows; i++) { uint rva = peImage.offsetReadUInt32(offset); offset += methodDef.totalSize; if (rva == 0) { continue; } if ((peImage.readByte(rva) & 3) == 2) { rva++; } else { rva += (uint)(4 * (peImage.readByte(rva + 1) >> 4)); } rvaToIndex[rva] = i; } patchDwords(peImage, methodsDataReader, patchCount); int count = methodsDataReader.ReadInt32(); dumpedMethods = new DumpedMethods(); while (methodsDataReader.BaseStream.Position < methodsData.Length - 1) { uint rva = methodsDataReader.ReadUInt32(); uint index = methodsDataReader.ReadUInt32(); bool isNativeCode = index >= 0x70000000; int size = methodsDataReader.ReadInt32(); var methodData = methodsDataReader.ReadBytes(size); int methodIndex; if (!rvaToIndex.TryGetValue(rva, out methodIndex)) { Log.w("Could not find method having code RVA {0:X8}", rva); continue; } uint methodToken = 0x06000001 + (uint)methodIndex; if (isNativeCode) { totalEncryptedNativeMethods++; if (tokenToNativeCode != null) { tokenToNativeCode[methodToken] = methodData; } // Convert return true / false methods. The others are converted to // throw 0xDEADCODE. if (DeobUtils.isCode(nativeLdci4, methodData)) { uint val = BitConverter.ToUInt32(methodData, 4); // ldc.i4 XXXXXXXXh / ret methodData = new byte[] { 0x20, 0, 0, 0, 0, 0x2A }; methodData[1] = (byte)val; methodData[2] = (byte)(val >> 8); methodData[3] = (byte)(val >> 16); methodData[4] = (byte)(val >> 24); } else if (DeobUtils.isCode(nativeLdci4_0, methodData)) { // ldc.i4.0 / ret methodData = new byte[] { 0x16, 0x2A }; } else { tokenToNativeMethod[methodToken] = methodData; // ldc.i4 0xDEADCODE / conv.u4 / throw methodData = new byte[] { 0x20, 0xDE, 0xC0, 0xAD, 0xDE, 0x6D, 0x7A }; } } var dm = new DumpedMethod(); dm.token = methodToken; dm.code = methodData; offset = methodDef.fileOffset + (uint)(methodIndex * methodDef.totalSize); rva = peImage.offsetReadUInt32(offset); dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDef.fields[1].offset); dm.mdFlags = peImage.offsetReadUInt16(offset + (uint)methodDef.fields[2].offset); dm.mdName = peImage.offsetRead(offset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size); dm.mdSignature = peImage.offsetRead(offset + (uint)methodDef.fields[4].offset, methodDef.fields[4].size); dm.mdParamList = peImage.offsetRead(offset + (uint)methodDef.fields[5].offset, methodDef.fields[5].size); if ((peImage.readByte(rva) & 3) == 2) { dm.mhFlags = 2; dm.mhMaxStack = 8; dm.mhCodeSize = (uint)dm.code.Length; dm.mhLocalVarSigTok = 0; } else { dm.mhFlags = peImage.readUInt16(rva); dm.mhMaxStack = peImage.readUInt16(rva + 2); dm.mhCodeSize = (uint)dm.code.Length; dm.mhLocalVarSigTok = peImage.readUInt32(rva + 8); } dumpedMethods.add(dm); } } return(true); }
public bool decrypt2(ref DumpedMethods dumpedMethods) { uint offset = peImage.rvaToOffset(peImage.Cor20Header.metadataDirectory.virtualAddress + peImage.Cor20Header.metadataDirectory.size); if (!readCodeHeader(offset)) { return(false); } var metadataTables = peImage.Cor20Header.createMetadataTables(); var methodDefTable = metadataTables.getMetadataType(MetadataIndex.iMethodDef); if (methodDefTable.totalSize != codeHeader.methodDefElemSize) { return(false); } var methodInfos = getMethodInfos(offset + 0x30 + codeHeader.totalCodeSize); offset = methodDefTable.fileOffset - methodDefTable.totalSize; foreach (var methodInfo in methodInfos) { offset += methodDefTable.totalSize; if (methodInfo.flags == 0 || methodInfo.codeOffs == 0) { continue; } uint rva = peImage.offsetReadUInt32(offset); peImage.writeUint16(rva, (ushort)methodInfo.flags); peImage.writeUint32(rva + 8, methodInfo.localVarSigTok); } dumpedMethods = new DumpedMethods(); offset = methodDefTable.fileOffset; for (int i = 0; i < methodInfos.Count; i++, offset += methodDefTable.totalSize) { var methodInfo = methodInfos[i]; if (methodInfo.codeOffs == 0) { continue; } var dm = new DumpedMethod(); dm.token = 0x06000001 + (uint)i; uint rva = peImage.offsetReadUInt32(offset); dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[1].offset); dm.mdFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[2].offset); dm.mdName = peImage.offsetRead(offset + (uint)methodDefTable.fields[3].offset, methodDefTable.fields[3].size); dm.mdSignature = peImage.offsetRead(offset + (uint)methodDefTable.fields[4].offset, methodDefTable.fields[4].size); dm.mdParamList = peImage.offsetRead(offset + (uint)methodDefTable.fields[5].offset, methodDefTable.fields[5].size); dm.code = decrypter.decrypt(methodInfo); if ((peImage.readByte(rva) & 3) == 2) { dm.mhFlags = 2; dm.mhMaxStack = 8; dm.mhCodeSize = (uint)dm.code.Length; dm.mhLocalVarSigTok = 0; } else { dm.mhFlags = peImage.readUInt16(rva); dm.mhMaxStack = peImage.readUInt16(rva + 2); dm.mhCodeSize = (uint)dm.code.Length; dm.mhLocalVarSigTok = peImage.readUInt32(rva + 8); } dumpedMethods.add(dm); } return(true); }