public void find(ISimpleDeobfuscator simpleDeobfuscator) { if (module.Assembly == null) { return; } var pkt = module.Assembly.PublicKeyToken; bool hasPublicKeyToken = !PublicKeyBase.IsNullOrEmpty2(pkt); foreach (var type in module.GetTypes()) { var cctor = type.FindStaticConstructor(); if (cctor == null) { continue; } bool deobfuscatedCctor = false; bool?v13State = null, v40State = null, v41State = null; foreach (var method in type.Methods) { if (!method.IsStatic || method.Body == null) { continue; } IDecrypterInfo info = null; if (DecrypterInfo13.isPossibleDecrypterMethod(method, ref v13State)) { deobfuscateCctor(simpleDeobfuscator, cctor, ref deobfuscatedCctor, hasPublicKeyToken); simpleDeobfuscator.deobfuscate(method); info = getInfoV13(cctor, method); } else if (DecrypterInfo40.isPossibleDecrypterMethod(method, ref v40State)) { deobfuscateCctor(simpleDeobfuscator, cctor, ref deobfuscatedCctor, hasPublicKeyToken); simpleDeobfuscator.deobfuscate(method); info = getInfoV40(cctor, method); } else if (DecrypterInfo41.isPossibleDecrypterMethod(method, ref v41State)) { deobfuscateCctor(simpleDeobfuscator, cctor, ref deobfuscatedCctor, hasPublicKeyToken); simpleDeobfuscator.deobfuscate(method); info = getInfoV41(cctor, method); } if (info == null) { continue; } methodToInfo.add(method, info); version = info.Version; } } }
public void find(ISimpleDeobfuscator simpleDeobfuscator) { if (module.Assembly == null) { return; } bool hasPublicKeyToken = module.Assembly.Name.PublicKeyToken != null && module.Assembly.Name.PublicKeyToken.Length != 0; foreach (var type in module.GetTypes()) { var cctor = DotNetUtils.getMethod(type, ".cctor"); if (cctor == null) { continue; } bool deobfuscatedCctor = false; foreach (var method in type.Methods) { if (!method.IsStatic || method.Body == null) { continue; } IDecrypterInfo info = null; if (DecrypterInfo13.isPossibleDecrypterMethod(method)) { deobfuscateCctor(simpleDeobfuscator, cctor, ref deobfuscatedCctor, hasPublicKeyToken); simpleDeobfuscator.deobfuscate(method); info = getInfoV13(cctor, method); } else if (DecrypterInfo40.isPossibleDecrypterMethod(method)) { deobfuscateCctor(simpleDeobfuscator, cctor, ref deobfuscatedCctor, hasPublicKeyToken); simpleDeobfuscator.deobfuscate(method); info = getInfoV40(cctor, method); } else if (DecrypterInfo41.isPossibleDecrypterMethod(method)) { deobfuscateCctor(simpleDeobfuscator, cctor, ref deobfuscatedCctor, hasPublicKeyToken); simpleDeobfuscator.deobfuscate(method); info = getInfoV41(cctor, method); } if (info == null) { continue; } methodToInfo.add(method, info); version = info.Version; } } }