byte[] decrypt1(byte[] encrypted) { var decrypted = new byte[encrypted.Length]; for (int i = 0; i < decrypted.Length; i++) { decrypted[i] = (byte)(encrypted[i] ^ mcKey.readByte(i % 0x2000)); } return(decrypted); }
void decryptStrings() { uint usHeapRva = peHeader.getRva1(0x0E00, mcKey.readUInt32(0x0078)); uint usHeapSize = peHeader.readUInt32(0x0E04) ^ mcKey.readUInt32(0x0082); if (usHeapRva == 0 || usHeapSize == 0) { return; } var usHeap = peImage.Cor20Header.metadata.getStream("#US"); if (usHeap == null || peImage.rvaToOffset(usHeapRva) != usHeap.fileOffset || usHeapSize != usHeap.Length) { Log.w("Invalid #US heap RVA and size found"); } Log.v("Decrypting strings @ RVA {0:X8}, {1} bytes", usHeapRva, usHeapSize); Log.indent(); int mcKeyOffset = 0; int usHeapOffset = (int)peImage.rvaToOffset(usHeapRva); int usHeapEnd = usHeapOffset + (int)usHeapSize; usHeapOffset++; while (usHeapOffset < usHeapEnd) { if (fileData[usHeapOffset] == 0 || fileData[usHeapOffset] == 1) { usHeapOffset++; continue; } int usHeapOffsetOrig = usHeapOffset; int stringDataLength = DeobUtils.readVariableLengthInt32(fileData, ref usHeapOffset); int usHeapOffsetString = usHeapOffset; int encryptedLength = stringDataLength - (usHeapOffset - usHeapOffsetOrig == 1 ? 1 : 2); for (int i = 0; i < encryptedLength; i++) { byte k = mcKey.readByte(mcKeyOffset++ % 0x2000); fileData[usHeapOffset] = rolb((byte)(fileData[usHeapOffset] ^ k), 3); usHeapOffset++; } try { Log.v("Decrypted string: {0}", Utils.toCsharpString(Encoding.Unicode.GetString(fileData, usHeapOffsetString, stringDataLength - 1))); } catch { Log.v("Could not decrypt string at offset {0:X8}", usHeapOffsetOrig); } usHeapOffset++; } Log.deIndent(); }
byte[] decrypt1(byte[] encrypted, int keyStart, int keyReset, int keyEnd) { var decrypted = new byte[encrypted.Length]; for (int i = 0, ki = keyStart; i < decrypted.Length; i++) { decrypted[i] = (byte)(encrypted[i] ^ mcKey.readByte(ki)); if (++ki == keyEnd) { ki = keyReset; } } return(decrypted); }