void DecryptMethodsOld(MDTable methodDefTable, ref DumpedMethods dumpedMethods) { dumpedMethods = new DumpedMethods(); var decrypter = new Decrypter10(peImage, codeHeader.decryptionKey); for (uint rid = 1; rid <= methodDefTable.Rows; rid++) { var dm = new DumpedMethod(); var method = (MethodDef)module.ResolveMethod(rid); if (method == null || method.DeclaringType == module.GlobalType) { continue; } peImage.ReadMethodTableRowTo(dm, rid); if (dm.mdRVA == 0) { continue; } uint bodyOffset = peImage.RvaToOffset(dm.mdRVA); var mbHeader = decrypter.Decrypt(bodyOffset, out dm.code, out dm.extraSections); peImage.UpdateMethodHeaderInfo(dm, mbHeader); dumpedMethods.Add(dm); } }
void decryptMethodsOld(MetadataType methodDefTable, ref DumpedMethods dumpedMethods) { dumpedMethods = new DumpedMethods(); uint offset = methodDefTable.fileOffset; var decrypter = new Decrypter10(peImage, codeHeader.decryptionKey); for (int i = 0; i < methodDefTable.rows; i++, offset += methodDefTable.totalSize) { var dm = new DumpedMethod(); dm.token = 0x06000001 + (uint)i; var method = (Mono.Cecil.MethodDefinition)module.LookupToken((int)dm.token); if (method == null || method.DeclaringType == DotNetUtils.getModuleType(module)) { continue; } uint rva = peImage.offsetReadUInt32(offset + (uint)methodDefTable.fields[0].offset); if (rva == 0) { continue; } uint bodyOffset = peImage.rvaToOffset(rva); dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[1].offset); dm.mdFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[2].offset); dm.mdName = peImage.offsetRead(offset + (uint)methodDefTable.fields[3].offset, methodDefTable.fields[3].size); dm.mdSignature = peImage.offsetRead(offset + (uint)methodDefTable.fields[4].offset, methodDefTable.fields[4].size); dm.mdParamList = peImage.offsetRead(offset + (uint)methodDefTable.fields[5].offset, methodDefTable.fields[5].size); var mbHeader = decrypter.decrypt(bodyOffset, out dm.code, out dm.extraSections); dm.mhFlags = mbHeader.flags; dm.mhMaxStack = mbHeader.maxStack; dm.mhCodeSize = (uint)dm.code.Length; dm.mhLocalVarSigTok = mbHeader.localVarSigTok; dumpedMethods.add(dm); } }
void DecryptMethodsOld(MDTable methodDefTable, ref DumpedMethods dumpedMethods) { dumpedMethods = new DumpedMethods(); var decrypter = new Decrypter10(peImage, codeHeader.decryptionKey); for (uint rid = 1; rid <= methodDefTable.Rows; rid++) { var dm = new DumpedMethod(); var method = (MethodDef)module.ResolveMethod(rid); if (method == null || method.DeclaringType == module.GlobalType) continue; peImage.ReadMethodTableRowTo(dm, rid); if (dm.mdRVA == 0) continue; uint bodyOffset = peImage.RvaToOffset(dm.mdRVA); var mbHeader = decrypter.Decrypt(bodyOffset, out dm.code, out dm.extraSections); peImage.UpdateMethodHeaderInfo(dm, mbHeader); dumpedMethods.Add(dm); } }
void decryptMethodsOld(MetadataType methodDefTable, ref DumpedMethods dumpedMethods) { dumpedMethods = new DumpedMethods(); uint offset = methodDefTable.fileOffset; var decrypter = new Decrypter10(peImage, codeHeader.decryptionKey); for (int i = 0; i < methodDefTable.rows; i++, offset += methodDefTable.totalSize) { var dm = new DumpedMethod(); dm.token = 0x06000001 + (uint)i; var method = (Mono.Cecil.MethodDefinition)module.LookupToken((int)dm.token); if (method == null || method.DeclaringType == DotNetUtils.getModuleType(module)) continue; uint rva = peImage.offsetReadUInt32(offset + (uint)methodDefTable.fields[0].offset); if (rva == 0) continue; uint bodyOffset = peImage.rvaToOffset(rva); dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[1].offset); dm.mdFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[2].offset); dm.mdName = peImage.offsetRead(offset + (uint)methodDefTable.fields[3].offset, methodDefTable.fields[3].size); dm.mdSignature = peImage.offsetRead(offset + (uint)methodDefTable.fields[4].offset, methodDefTable.fields[4].size); dm.mdParamList = peImage.offsetRead(offset + (uint)methodDefTable.fields[5].offset, methodDefTable.fields[5].size); var mbHeader = decrypter.decrypt(bodyOffset, out dm.code, out dm.extraSections); dm.mhFlags = mbHeader.flags; dm.mhMaxStack = mbHeader.maxStack; dm.mhCodeSize = (uint)dm.code.Length; dm.mhLocalVarSigTok = mbHeader.localVarSigTok; dumpedMethods.add(dm); } }