Пример #1
0
		public DecrypterInfo(MainType mainType, byte[] fileData) {
			this.mainType = mainType;
			this.peImage = new MyPEImage(fileData);
			this.peHeader = new PeHeader(mainType, peImage);
			this.mcKey = new McKey(peImage, peHeader);
			this.fileData = fileData;
		}
Пример #2
0
 public DecrypterInfo(MainType mainType, byte[] fileData)
 {
     this.mainType = mainType;
     peImage       = new MyPEImage(fileData);
     peHeader      = new PeHeader(mainType, peImage);
     mcKey         = new McKey(peImage, peHeader);
     this.fileData = fileData;
 }
Пример #3
0
		public McKey(MyPEImage peImage, PeHeader peHeader) {
			this.peHeader = peHeader;
			try {
				this.data = peImage.ReadBytes(peHeader.GetMcKeyRva(), 0x2000);
			}
			catch (IOException) {
				this.data = peImage.ReadBytes(peHeader.GetMcKeyRva(), 0x1000);
			}
		}
Пример #4
0
 public McKey(PeImage peImage, PeHeader peHeader)
 {
     this.peHeader = peHeader;
     try {
         this.data = peImage.readBytes(peHeader.getMcKeyRva(), 0x2000);
     }
     catch (IOException) {
         this.data = peImage.readBytes(peHeader.getMcKeyRva(), 0x1000);
     }
 }
Пример #5
0
 public McKey(MyPEImage peImage, PeHeader peHeader)
 {
     try {
         data = peImage.ReadBytes(peHeader.GetMcKeyRva(), 0x2000);
     }
     catch (Exception ex) when(ex is IOException || ex is ArgumentException)
     {
         data = peImage.ReadBytes(peHeader.GetMcKeyRva(), 0x1000);
     }
 }
			public MethodInfos(ModuleDef module, MainType mainType, MyPEImage peImage, PeHeader peHeader, McKey mcKey) {
				this.module = module;
				this.mainType = mainType;
				this.peImage = peImage;
				this.peHeader = peHeader;
				this.mcKey = mcKey;

				structSize = GetStructSize(mcKey);

				uint methodInfosRva = peHeader.GetRva(0x0FF8, mcKey.ReadUInt32(0x005A));
				uint encryptedDataRva = peHeader.GetRva(0x0FF0, mcKey.ReadUInt32(0x0046));

				methodInfosOffset = peImage.RvaToOffset(methodInfosRva);
				encryptedDataOffset = peImage.RvaToOffset(encryptedDataRva);
			}
Пример #7
0
            public MethodInfos(MainType mainType, PeImage peImage, PeHeader peHeader, McKey mcKey)
            {
                this.mainType = mainType;
                this.peImage  = peImage;
                this.peHeader = peHeader;
                this.mcKey    = mcKey;

                structSize = getStructSize(mcKey);

                uint methodInfosRva   = peHeader.getRva2(0x0FF8, mcKey.readUInt32(0x005A));
                uint encryptedDataRva = peHeader.getRva2(0x0FF0, mcKey.readUInt32(0x0046));

                methodInfosOffset   = peImage.rvaToOffset(methodInfosRva);
                encryptedDataOffset = peImage.rvaToOffset(encryptedDataRva);
            }
Пример #8
0
            public MethodInfos(ModuleDef module, MainType mainType, MyPEImage peImage, PeHeader peHeader, McKey mcKey)
            {
                this.module   = module;
                this.mainType = mainType;
                this.peImage  = peImage;
                this.peHeader = peHeader;
                this.mcKey    = mcKey;

                structSize = GetStructSize(mcKey);

                uint methodInfosRva   = peHeader.GetRva(0x0FF8, mcKey.ReadUInt32(0x005A));
                uint encryptedDataRva = peHeader.GetRva(0x0FF0, mcKey.ReadUInt32(0x0046));

                methodInfosOffset   = peImage.RvaToOffset(methodInfosRva);
                encryptedDataOffset = peImage.RvaToOffset(encryptedDataRva);
            }
Пример #9
0
        public bool decrypt(byte[] fileData, ref DumpedMethods dumpedMethods)
        {
            peImage       = new PeImage(fileData);
            peHeader      = new PeHeader(mainType, peImage);
            mcKey         = new McKey(peImage, peHeader);
            this.fileData = fileData;

            dumpedMethods = decryptMethods();
            if (dumpedMethods == null)
            {
                return(false);
            }

            decryptResources();
            decryptStrings();

            return(true);
        }
Пример #10
0
            public MethodInfos(MainType mainType, PeImage peImage, PeHeader peHeader, McKey mcKey)
            {
                this.mainType = mainType;
                this.peImage  = peImage;
                this.peHeader = peHeader;
                this.mcKey    = mcKey;

                decryptHandlersV1  = new Decrypt[] { decrypt1a, decrypt4a, decrypt2a, decrypt3a, decrypt5, decrypt6, decrypt7 };
                decryptHandlersV2  = new Decrypt[] { decrypt3a, decrypt2a, decrypt1a, decrypt4a, decrypt5, decrypt6, decrypt7 };
                decryptHandlersV3  = new Decrypt[] { decrypt1a, decrypt2a, decrypt3a, decrypt4a, decrypt5, decrypt6, decrypt7 };
                decryptHandlersV4  = new Decrypt[] { decrypt2a, decrypt1a, decrypt3a, decrypt4a, decrypt5, decrypt6, decrypt7 };
                decryptHandlersV5a = new Decrypt[] { decrypt4a, decrypt2a, decrypt3a, decrypt1a, decrypt5, decrypt6, decrypt7 };
                decryptHandlersV5b = new Decrypt[] { decrypt4b, decrypt2b, decrypt3b, decrypt1b, decrypt6, decrypt7, decrypt5 };
                decryptHandlersV5c = new Decrypt[] { decrypt4c, decrypt2c, decrypt3c, decrypt1c, decrypt6, decrypt7, decrypt5 };

                structSize = getStructSize(mcKey);

                uint methodInfosRva   = peHeader.getRva(0x0FF8, mcKey.readUInt32(0x005A));
                uint encryptedDataRva = peHeader.getRva(0x0FF0, mcKey.readUInt32(0x0046));

                methodInfosOffset   = peImage.rvaToOffset(methodInfosRva);
                encryptedDataOffset = peImage.rvaToOffset(encryptedDataRva);
            }
Пример #11
0
        public bool decrypt(byte[] fileData, ref DumpedMethods dumpedMethods)
        {
            peImage = new PeImage(fileData);
            peHeader = new PeHeader(mainType, peImage);
            mcKey = new McKey(peImage, peHeader);
            this.fileData = fileData;

            dumpedMethods = decryptMethods();
            if (dumpedMethods == null)
                return false;

            decryptResources();
            decryptStrings();

            return true;
        }
Пример #12
0
        DumpedMethods decryptMethods(PeImage peImage, PeHeader peHeader, McHeader mcHeader)
        {
            var dumpedMethods = new DumpedMethods();

            var methodInfos = new MethodInfos(mainType, peImage, peHeader, mcHeader);
            methodInfos.initializeInfos();

            var metadataTables = peImage.Cor20Header.createMetadataTables();
            var methodDef = metadataTables.getMetadataType(MetadataIndex.iMethodDef);
            uint methodDefOffset = methodDef.fileOffset;
            for (int i = 0; i < methodDef.rows; i++, methodDefOffset += methodDef.totalSize) {
                uint bodyRva = peImage.offsetReadUInt32(methodDefOffset);
                if (bodyRva == 0)
                    continue;

                var info = methodInfos.lookup(bodyRva);
                if (info == null)
                    continue;

                uint bodyOffset = peImage.rvaToOffset(bodyRva);
                ushort magic = peImage.offsetReadUInt16(bodyOffset);
                if (magic != 0xFFF3)
                    continue;

                var dm = new DumpedMethod();
                dm.token = (uint)(0x06000001 + i);
                dm.mdImplFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[1].offset);
                dm.mdFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[2].offset);
                dm.mdName = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size);
                dm.mdSignature = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[4].offset, methodDef.fields[4].size);
                dm.mdParamList = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[5].offset, methodDef.fields[5].size);

                var reader = new BinaryReader(new MemoryStream(info.body));
                byte b = reader.ReadByte();
                if ((b & 3) == 2) {
                    dm.mhFlags = 2;
                    dm.mhMaxStack = 8;
                    dm.mhCodeSize = (uint)(b >> 2);
                    dm.mhLocalVarSigTok = 0;
                }
                else {
                    reader.BaseStream.Position--;
                    dm.mhFlags = reader.ReadUInt16();
                    dm.mhMaxStack = reader.ReadUInt16();
                    dm.mhCodeSize = reader.ReadUInt32();
                    dm.mhLocalVarSigTok = reader.ReadUInt32();
                    uint codeOffset = (uint)(dm.mhFlags >> 12) * 4;
                    reader.BaseStream.Position += codeOffset - 12;
                }

                dm.code = reader.ReadBytes((int)dm.mhCodeSize);
                if ((dm.mhFlags & 8) != 0) {
                    reader.BaseStream.Position = (reader.BaseStream.Position + 3) & ~3;
                    dm.extraSections = reader.ReadBytes((int)(reader.BaseStream.Length - reader.BaseStream.Position));
                }

                dumpedMethods.add(dm);
            }

            return dumpedMethods;
        }
Пример #13
0
        void decryptResources(byte[] fileData, PeImage peImage, PeHeader peHeader, McHeader mcHeader)
        {
            uint resourceRva = peHeader.getRva1(0x0E10, mcHeader.readUInt32(0x00A0));
            uint resourceSize = peHeader.readUInt32(0x0E14) ^ mcHeader.readUInt32(0x00AA);
            if (resourceRva == 0 || resourceSize == 0)
                return;
            if (resourceRva != peImage.Cor20Header.resources.virtualAddress ||
                resourceSize != peImage.Cor20Header.resources.size) {
                Log.w("Invalid resource RVA and size found");
            }

            Log.v("Decrypting resources @ RVA {0:X8}, {1} bytes", resourceRva, resourceSize);

            int resourceOffset = (int)peImage.rvaToOffset(resourceRva);
            for (int i = 0; i < resourceSize; i++)
                fileData[resourceOffset + i] ^= mcHeader[i % 0x2000];
        }
Пример #14
0
            public MethodInfos(MainType mainType, PeImage peImage, PeHeader peHeader, McKey mcKey)
            {
                this.mainType = mainType;
                this.peImage = peImage;
                this.peHeader = peHeader;
                this.mcKey = mcKey;

                structSize = getStructSize(mcKey);

                uint methodInfosRva = peHeader.getRva2(0x0FF8, mcKey.readUInt32(0x005A));
                uint encryptedDataRva = peHeader.getRva2(0x0FF0, mcKey.readUInt32(0x0046));

                methodInfosOffset = peImage.rvaToOffset(methodInfosRva);
                encryptedDataOffset = peImage.rvaToOffset(encryptedDataRva);
            }
Пример #15
0
 public McKey(PeImage peImage, PeHeader peHeader)
 {
     this.peHeader = peHeader;
     this.data = peImage.readBytes(peHeader.getMcKeyRva(), 0x2000);
 }
Пример #16
0
        public bool decrypt(byte[] fileData, ref DumpedMethods dumpedMethods)
        {
            var peImage = new PeImage(fileData);
            var peHeader = new PeHeader(mainType, peImage);
            var mcHeader = new McHeader(peImage, peHeader);

            dumpedMethods = decryptMethods(peImage, peHeader, mcHeader);
            if (dumpedMethods == null)
                return false;

            decryptResources(fileData, peImage, peHeader, mcHeader);

            return true;
        }
Пример #17
0
 public McKey(PeImage peImage, PeHeader peHeader)
 {
     this.peHeader = peHeader;
     this.data     = peImage.readBytes(peHeader.getMcKeyRva(), 0x2000);
 }
Пример #18
0
            public MethodInfos(MainType mainType, MyPEImage peImage, PeHeader peHeader, McKey mcKey)
            {
                this.mainType = mainType;
                this.peImage = peImage;
                this.peHeader = peHeader;
                this.mcKey = mcKey;

                decryptHandlersV1 = new Decrypt[] { decrypt1a, decrypt4a, decrypt2a, decrypt3a, decrypt5, decrypt6, decrypt7 };
                decryptHandlersV2 = new Decrypt[] { decrypt3a, decrypt2a, decrypt1a, decrypt4a, decrypt5, decrypt6, decrypt7 };
                decryptHandlersV3 = new Decrypt[] { decrypt1a, decrypt2a, decrypt3a, decrypt4a, decrypt5, decrypt6, decrypt7 };
                decryptHandlersV4 = new Decrypt[] { decrypt2a, decrypt1a, decrypt3a, decrypt4a, decrypt5, decrypt6, decrypt7 };
                decryptHandlersV5a = new Decrypt[] { decrypt4a, decrypt2a, decrypt3a, decrypt1a, decrypt5, decrypt6, decrypt7 };
                decryptHandlersV5b = new Decrypt[] { decrypt4b, decrypt2b, decrypt3b, decrypt1b, decrypt6, decrypt7, decrypt5 };
                decryptHandlersV5c = new Decrypt[] { decrypt4c, decrypt2c, decrypt3c, decrypt1c, decrypt6, decrypt7, decrypt5 };
                decryptHandlersV6a = new Decrypt[] { decrypt4d, decrypt2d, decrypt3d, decrypt1d, decrypt6, decrypt7, decrypt5 };

                structSize = getStructSize(mcKey);

                uint methodInfosRva = peHeader.getRva(0x0FF8, mcKey.readUInt32(0x005A));
                uint encryptedDataRva = peHeader.getRva(0x0FF0, mcKey.readUInt32(0x0046));

                methodInfosOffset = peImage.rvaToOffset(methodInfosRva);
                encryptedDataOffset = peImage.rvaToOffset(encryptedDataRva);
            }