Пример #1
0
 static void AddToken(this IList<short> instrs, ModuleDefMD module, uint token)
 {
     if (module == null || module.ResolveToken(token) == null)
         instrs.AddUnknownInt32();
     else
         instrs.AddInt32(unchecked((int)token));
 }
Пример #2
0
		public override IDeobfuscator ModuleReloaded(ModuleDefMD module) {
			if (module.Assembly != null)
				realAssemblyInfo = null;
			if (realAssemblyInfo != null) {
				realAssemblyInfo.realAssembly.Modules.Insert(0, module);
				if (realAssemblyInfo.entryPointToken != 0)
					module.EntryPoint = module.ResolveToken((int)realAssemblyInfo.entryPointToken) as MethodDef;
				module.Kind = realAssemblyInfo.kind;
				module.Name = new UTF8String(realAssemblyInfo.moduleName);
			}

			var newOne = new Deobfuscator(options);
			DeobfuscatedFile.SetDeobfuscator(newOne);
			newOne.realAssemblyInfo = realAssemblyInfo;
			newOne.decryptState = decryptState;
			newOne.DeobfuscatedFile = DeobfuscatedFile;
			newOne.ModuleBytes = ModuleBytes;
			newOne.embeddedAssemblyInfos.AddRange(embeddedAssemblyInfos);
			newOne.SetModule(module);
			newOne.RemoveObfuscatorAttribute();
			newOne.jitMethodsDecrypter = hasUnpacked ? new JitMethodsDecrypter(module, DeobfuscatedFile) :
						new JitMethodsDecrypter(module, DeobfuscatedFile, jitMethodsDecrypter);
			if ((newOne.decryptState & DecryptState.CanDecryptMethods) != 0) {
				try {
					newOne.jitMethodsDecrypter.Find();
				}
				catch {
				}
				if (newOne.jitMethodsDecrypter.Detected)
					return newOne;
			}
			newOne.memoryMethodsDecrypter = hasUnpacked ? new MemoryMethodsDecrypter(module, DeobfuscatedFile) :
						new MemoryMethodsDecrypter(module, DeobfuscatedFile, memoryMethodsDecrypter);
			if ((newOne.decryptState & DecryptState.CanDecryptMethods) != 0) {
				newOne.memoryMethodsDecrypter.Find();
				if (newOne.memoryMethodsDecrypter.Detected)
					return newOne;
			}
			newOne.InitializeTheRest(this);
			return newOne;
		}