示例#1
0
        void DecryptMethodsOld(MDTable methodDefTable, ref DumpedMethods dumpedMethods)
        {
            dumpedMethods = new DumpedMethods();
            var decrypter = new Decrypter10(peImage, codeHeader.decryptionKey);

            for (uint rid = 1; rid <= methodDefTable.Rows; rid++)
            {
                var dm = new DumpedMethod();

                var method = (MethodDef)module.ResolveMethod(rid);
                if (method == null || method.DeclaringType == module.GlobalType)
                {
                    continue;
                }

                peImage.ReadMethodTableRowTo(dm, rid);
                if (dm.mdRVA == 0)
                {
                    continue;
                }
                uint bodyOffset = peImage.RvaToOffset(dm.mdRVA);

                var mbHeader = decrypter.Decrypt(bodyOffset, out dm.code, out dm.extraSections);
                peImage.UpdateMethodHeaderInfo(dm, mbHeader);

                dumpedMethods.Add(dm);
            }
        }
示例#2
0
        void decryptMethodsOld(MetadataType methodDefTable, ref DumpedMethods dumpedMethods)
        {
            dumpedMethods = new DumpedMethods();
            uint offset    = methodDefTable.fileOffset;
            var  decrypter = new Decrypter10(peImage, codeHeader.decryptionKey);

            for (int i = 0; i < methodDefTable.rows; i++, offset += methodDefTable.totalSize)
            {
                var dm = new DumpedMethod();
                dm.token = 0x06000001 + (uint)i;

                var method = (Mono.Cecil.MethodDefinition)module.LookupToken((int)dm.token);
                if (method == null || method.DeclaringType == DotNetUtils.getModuleType(module))
                {
                    continue;
                }

                uint rva = peImage.offsetReadUInt32(offset + (uint)methodDefTable.fields[0].offset);
                if (rva == 0)
                {
                    continue;
                }
                uint bodyOffset = peImage.rvaToOffset(rva);
                dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[1].offset);
                dm.mdFlags     = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[2].offset);
                dm.mdName      = peImage.offsetRead(offset + (uint)methodDefTable.fields[3].offset, methodDefTable.fields[3].size);
                dm.mdSignature = peImage.offsetRead(offset + (uint)methodDefTable.fields[4].offset, methodDefTable.fields[4].size);
                dm.mdParamList = peImage.offsetRead(offset + (uint)methodDefTable.fields[5].offset, methodDefTable.fields[5].size);

                var mbHeader = decrypter.decrypt(bodyOffset, out dm.code, out dm.extraSections);
                dm.mhFlags          = mbHeader.flags;
                dm.mhMaxStack       = mbHeader.maxStack;
                dm.mhCodeSize       = (uint)dm.code.Length;
                dm.mhLocalVarSigTok = mbHeader.localVarSigTok;

                dumpedMethods.add(dm);
            }
        }
示例#3
0
		void DecryptMethodsOld(MDTable methodDefTable, ref DumpedMethods dumpedMethods) {
			dumpedMethods = new DumpedMethods();
			var decrypter = new Decrypter10(peImage, codeHeader.decryptionKey);
			for (uint rid = 1; rid <= methodDefTable.Rows; rid++) {
				var dm = new DumpedMethod();

				var method = (MethodDef)module.ResolveMethod(rid);
				if (method == null || method.DeclaringType == module.GlobalType)
					continue;

				peImage.ReadMethodTableRowTo(dm, rid);
				if (dm.mdRVA == 0)
					continue;
				uint bodyOffset = peImage.RvaToOffset(dm.mdRVA);

				var mbHeader = decrypter.Decrypt(bodyOffset, out dm.code, out dm.extraSections);
				peImage.UpdateMethodHeaderInfo(dm, mbHeader);

				dumpedMethods.Add(dm);
			}
		}
示例#4
0
        void decryptMethodsOld(MetadataType methodDefTable, ref DumpedMethods dumpedMethods)
        {
            dumpedMethods = new DumpedMethods();
            uint offset = methodDefTable.fileOffset;
            var decrypter = new Decrypter10(peImage, codeHeader.decryptionKey);
            for (int i = 0; i < methodDefTable.rows; i++, offset += methodDefTable.totalSize) {
                var dm = new DumpedMethod();
                dm.token = 0x06000001 + (uint)i;

                var method = (Mono.Cecil.MethodDefinition)module.LookupToken((int)dm.token);
                if (method == null || method.DeclaringType == DotNetUtils.getModuleType(module))
                    continue;

                uint rva = peImage.offsetReadUInt32(offset + (uint)methodDefTable.fields[0].offset);
                if (rva == 0)
                    continue;
                uint bodyOffset = peImage.rvaToOffset(rva);
                dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[1].offset);
                dm.mdFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[2].offset);
                dm.mdName = peImage.offsetRead(offset + (uint)methodDefTable.fields[3].offset, methodDefTable.fields[3].size);
                dm.mdSignature = peImage.offsetRead(offset + (uint)methodDefTable.fields[4].offset, methodDefTable.fields[4].size);
                dm.mdParamList = peImage.offsetRead(offset + (uint)methodDefTable.fields[5].offset, methodDefTable.fields[5].size);

                var mbHeader = decrypter.decrypt(bodyOffset, out dm.code, out dm.extraSections);
                dm.mhFlags = mbHeader.flags;
                dm.mhMaxStack = mbHeader.maxStack;
                dm.mhCodeSize = (uint)dm.code.Length;
                dm.mhLocalVarSigTok = mbHeader.localVarSigTok;

                dumpedMethods.add(dm);
            }
        }