List <ProjectFile>?TryCreateResourceFiles(ModuleDef module, ResourceNameCreator resourceNameCreator, EmbeddedResource er) { ResourceElementSet set; try { set = ResourceReader.Read(module, er.CreateReader()); } catch { return(null); } if (IsXamlResource(module, er.Name, set)) { return(CreateXamlResourceFiles(module, resourceNameCreator, set).ToList()); } if (Options.CreateResX) { string filename = resourceNameCreator.GetResxFilename(er.Name, out string typeFullName); return(new List <ProjectFile>() { CreateResXFile(module, er, set, filename, typeFullName, false) }); } return(null); }
public void Initialize(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) { if (resolverType == null) { return; } encryptedResource = BabelUtils.FindEmbeddedResource(module, resolverType, simpleDeobfuscator, deob); if (encryptedResource == null) { Logger.w("Could not find embedded assemblies resource"); return; } var decrypted = resourceDecrypter.Decrypt(encryptedResource.CreateReader().ToArray()); var reader = new BinaryReader(new MemoryStream(decrypted)); int numAssemblies = reader.ReadInt32(); embeddedAssemblyInfos = new EmbeddedAssemblyInfo[numAssemblies]; for (int i = 0; i < numAssemblies; i++) { string name = reader.ReadString(); var data = reader.ReadBytes(reader.ReadInt32()); var mod = ModuleDefMD.Load(data); embeddedAssemblyInfos[i] = new EmbeddedAssemblyInfo(name, DeobUtils.GetExtension(mod.Kind), data); } }
private void ParseResource(EmbeddedResource resource) { ResourceReader reader; try { reader = new ResourceReader(resource.CreateReader().AsStream()); } catch (ArgumentException) { Console.WriteLine("This resource can not be parsed."); //throw; return; } var e = reader.GetEnumerator(); while (e.MoveNext()) { if (e.Key.ToString().ToLower().EndsWith(".baml")) { reader.GetResourceData(e.Key.ToString(), out _, out var contents); //MARK:AF 3E 00 00 contents = contents.Skip(4).ToArray(); //MARK:the first 4 bytes = length using (var ms = new MemoryStream(contents)) { BamlDocument b = BamlReader.ReadDocument(ms); BamlFiles.TryAdd(e.Key.ToString(), b); } } } }
public override byte[] GetMethodsData(EmbeddedResource resource) { var reader = resource.CreateReader(); reader.Position = (uint)startOffset; var decrypted = new byte[reader.Read7BitEncodedUInt32()]; uint origCrc32 = reader.ReadUInt32(); uint pos = reader.Position; var keys = new byte[][] { decryptionKey, decryptionKey6, decryptionKey7 }; foreach (var key in keys) { try { reader.Position = pos; Decompress(decrypted, ref reader, key, decryptionKeyMod); uint crc32 = CRC32.CheckSum(decrypted); if (crc32 == origCrc32) { return(decrypted); } } catch (OutOfMemoryException) { } catch (Exception ex) when(ex is IOException || ex is ArgumentException) { } } throw new ApplicationException("Could not decrypt methods data"); }
public void Initialize(ModuleDefMD module, EmbeddedResource resource) { key = resource.CreateReader().ToArray(); if (key.Length != 0x100) { throw new ApplicationException($"Unknown key length: {key.Length}"); } }
static ResourceElementSet?TryCreateResourceElementSet(ModuleDef module, EmbeddedResource er) { if (er is null) { return(null); } if (!ResourceReader.CouldBeResourcesFile(er.CreateReader())) { return(null); } try { return(ResourceReader.Read(module, er.CreateReader())); } catch { return(null); } }
byte[] Decrypt_v14_r55802() { var reader = new BinaryReader(new MemoryStream(Decompress(resource.CreateReader().ToArray()))); var encypted = reader.ReadBytes(reader.ReadInt32()); if ((encypted.Length & 1) != 0) { throw new ApplicationException("Invalid resource data length"); } var decrypted = new byte[encypted.Length / 2]; for (int i = 0; i < decrypted.Length; i++) { decrypted[i] = (byte)((encypted[i * 2 + 1] ^ key0) * key1 + (encypted[i * 2] ^ key0)); } reader = new BinaryReader(new MemoryStream(Decompress(decrypted))); return(reader.ReadBytes(reader.ReadInt32())); }
public void Initialize(ModuleDefMD module, EmbeddedResource resource) { var decrypted = resourceDecrypter.Decrypt(resource.CreateReader().ToArray()); var reader = new BinaryReader(new MemoryStream(decrypted)); while (reader.BaseStream.Position < reader.BaseStream.Length) { offsetToString[GetOffset((int)reader.BaseStream.Position)] = reader.ReadString(); } }
protected static byte[] DecryptResourceV41SL(EmbeddedResource resource) { var data = resource.CreateReader().ToArray(); byte k = data[0]; for (int i = 0; i < data.Length - 1; i++) { data[i + 1] ^= (byte)((k << (i & 5)) + i); } return(InflateIfNeeded(data, 1, data.Length - 1)); }
public override DataReader CreateReader(uint offset, uint length) { if (offset != 0) { throw new ArgumentException(nameof(offset)); } if (length != Length) { throw new ArgumentException(nameof(length)); } return(_resource.CreateReader()); }
public void Initialize() { if (installMethod == null) return; if (!FindKeys()) throw new ApplicationException("Could not find keys"); if ((resource = FindResource(key0)) == null) throw new ApplicationException("Could not find resource"); constants = DecryptResource(resource.CreateReader().ToArray()); FindDecrypters(); }
public void Initialize(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) { if (methodsDecrypter == null) { return; } encryptedResource = BabelUtils.FindEmbeddedResource(module, methodsDecrypter, simpleDeobfuscator, deob); if (encryptedResource != null) { AddImageReader("", resourceDecrypter.Decrypt(encryptedResource.CreateReader().ToArray())); } }
public virtual byte[] GetMethodsData(EmbeddedResource resource) { var reader = resource.CreateReader(); reader.Position = (uint)startOffset; if ((reader.ReadInt32() & 1) != 0) { return(Decompress(ref reader)); } else { return(reader.ReadRemainingBytes()); } }
List <ResXDataNode> ReadResourceEntries(DecompileContext ctx) { var list = new List <ResXDataNode>(); int errors = 0; try { using (var reader = new ResourceReader(embeddedResource.CreateReader().AsStream())) { var iter = reader.GetEnumerator(); while (iter.MoveNext()) { ctx.CancellationToken.ThrowIfCancellationRequested(); string?key = null; try { key = iter.Key as string; if (key is null) { continue; } var value = iter.Value; // ResXDataNode ctor checks if the input is serializable, which this stream isn't. // We have no choice but to create a new stream. if (value is Stream && !value.GetType().IsSerializable) { var stream = (Stream)value; var data = new byte[stream.Length]; if (stream.Read(data, 0, data.Length) != data.Length) { throw new IOException("Could not read all bytes"); } value = new MemoryStream(data); } //TODO: Some resources, like images, should be saved as separate files. Use ResXFileRef. // Don't do it if it's a satellite assembly. list.Add(delegateResXDataNodeConstructor?.Invoke(key, value, TypeNameConverter) ?? new ResXDataNode(key, value)); } catch (Exception ex) { if (errors++ < 30) { ctx.Logger.Error($"Could not add resource '{key}', Message: {ex.Message}"); } } } } } catch (Exception ex) { ctx.Logger.Error($"Could not read resources from {embeddedResource.Name}, Message: {ex.Message}"); } return(list); }
public void Initialize(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) { if (decrypterType == null) { return; } encryptedResource = BabelUtils.FindEmbeddedResource(module, decrypterType, simpleDeobfuscator, deob); if (encryptedResource == null) { Logger.w("Could not find encrypted constants resource"); return; } var decrypted = resourceDecrypter.Decrypt(encryptedResource.CreateReader().ToArray()); var reader = new BinaryReader(new MemoryStream(decrypted)); int count; count = reader.ReadInt32(); decryptedInts = new int[count]; while (count-- > 0) { decryptedInts[count] = reader.ReadInt32(); } count = reader.ReadInt32(); decryptedLongs = new long[count]; while (count-- > 0) { decryptedLongs[count] = reader.ReadInt64(); } count = reader.ReadInt32(); decryptedFloats = new float[count]; while (count-- > 0) { decryptedFloats[count] = reader.ReadSingle(); } count = reader.ReadInt32(); decryptedDoubles = new double[count]; while (count-- > 0) { decryptedDoubles[count] = reader.ReadDouble(); } }
public void Initialize(ResourceDecrypter resourceDecrypter) { if (decrypterType == null) { return; } var cctor = decrypterType.FindStaticConstructor(); encryptedResource = CoUtils.GetResource(module, DotNetUtils.GetCodeStrings(cctor)); //if the return value is null, it is possible that resource name is encrypted if (encryptedResource == null) { var Resources = new string[] { CoUtils.DecryptResourceName(module, cctor) }; encryptedResource = CoUtils.GetResource(module, Resources); } constantsData = resourceDecrypter.Decrypt(encryptedResource.CreateReader().AsStream()); }
private EmbeddedResource ReloadResource(EmbeddedResource resource) { ResourceReader reader; try { reader = new ResourceReader(resource.CreateReader().AsStream()); } catch (ArgumentException) { Console.WriteLine("This resource can not be parsed."); return(resource); } MemoryStream m = new MemoryStream(); ResourceWriter writer = new ResourceWriter(m); var e = reader.GetEnumerator(); while (e.MoveNext()) { if (BamlFiles.ContainsKey(e.Key.ToString())) { //MARK:AF 3E 00 00 using var ms = new MemoryStream(); BamlWriter.WriteDocument(BamlFiles[e.Key.ToString()], ms); writer.AddResource(e.Key.ToString(), ms.ToArray()); } else { writer.AddResource(e.Key.ToString(), e.Value); } } //writer.AddResource(e.Key.ToString(), e.Value); writer.Generate(); EmbeddedResource embedded = new EmbeddedResource(resource.Name, m.ToArray()); writer.Close(); return(embedded); }
void DecryptAllAssemblies() { if (assemblyResource == null) { return; } var resourceSet = ResourceReader.Read(resourceModule, assemblyResource.CreateReader()); foreach (var resourceElement in resourceSet.ResourceElements) { if (resourceElement.ResourceData.Code != ResourceTypeCode.ByteArray) { throw new ApplicationException("Invalid resource"); } var resourceData = (BuiltInResourceData)resourceElement.ResourceData; var assemblyData = Decrypt((byte[])resourceData.Data); var theModule = ModuleDefMD.Load(assemblyData); bool isMain = resourceElement.Name == entryPointAssemblyKey; assemblyInfos.Add(new AssemblyInfo(assemblyData, DeobUtils.GetExtension(theModule.Kind), theModule.Assembly.FullName, theModule.Assembly.Name.String, isMain)); } }
byte[] Decrypt(EmbeddedResource resource) { var data = resource.CreateReader().ToArray(); switch (version) { case ConfuserVersion.v10_r42915: return(Decrypt_v10_r42915(data)); case ConfuserVersion.v10_r48717: return(Decrypt_v10_r42915(data)); case ConfuserVersion.v14_r57778: return(Decrypt_v10_r42915(data)); case ConfuserVersion.v14_r58564: return(Decrypt_v14_r58564(data)); case ConfuserVersion.v14_r58802: return(Decrypt_v14_r58564(data)); case ConfuserVersion.v14_r58852: return(Decrypt_v14_r58852(data)); case ConfuserVersion.v15_r60785: return(Decrypt_v15_r60785(data)); case ConfuserVersion.v17_r73404: return(Decrypt_v17_r73404(data)); case ConfuserVersion.v17_r73477: return(Decrypt_v17_r73404(data)); case ConfuserVersion.v17_r73566: return(Decrypt_v17_r73404(data)); case ConfuserVersion.v17_r75076: return(Decrypt_v17_r75076(data)); case ConfuserVersion.v18_r75184: return(Decrypt_v17_r75076(data)); case ConfuserVersion.v18_r75367: return(Decrypt_v17_r75076(data)); case ConfuserVersion.v19_r77172: return(Decrypt_v17_r75076(data)); default: throw new ApplicationException("Unknown version"); } }
IEnumerable <ProjectFile> CreateEmbeddedResourceFiles(ModuleDef module, ResourceNameCreator resourceNameCreator, EmbeddedResource er) { if (!Options.UnpackResources) { yield return(CreateRawEmbeddedResourceProjectFile(module, resourceNameCreator, er)); yield break; } if (ResourceReader.CouldBeResourcesFile(er.CreateReader())) { var files = TryCreateResourceFiles(module, resourceNameCreator, er); if (!(files is null)) { foreach (var file in files) { yield return(file); } yield break; } } yield return(CreateRawEmbeddedResourceProjectFile(module, resourceNameCreator, er)); }
void Rename(TypeDef type, EmbeddedResource resource) { newNames.Clear(); var resourceSet = ResourceReader.Read(module, resource.CreateReader()); var renamed = new List <RenameInfo>(); foreach (var elem in resourceSet.ResourceElements) { if (nameChecker.IsValidResourceKeyName(elem.Name)) { newNames.Add(elem.Name, true); continue; } renamed.Add(new RenameInfo(elem, GetNewName(elem))); } if (renamed.Count == 0) { return; } Rename(type, renamed); var outStream = new MemoryStream(); ResourceWriter.Write(module, outStream, resourceSet); var newResource = new EmbeddedResource(resource.Name, outStream.ToArray(), resource.Attributes); int resourceIndex = module.Resources.IndexOf(resource); if (resourceIndex < 0) { throw new ApplicationException("Could not find index of resource"); } module.Resources[resourceIndex] = newResource; }
void Restore2() { Logger.n("Restoring CSVM methods"); Logger.Instance.Indent(); var opcodeDetector = GetVmOpCodeHandlerDetector(); var csvmMethods = new CsvmDataReader(resource.CreateReader()).Read(); var converter = new CsvmToCilMethodConverter(deobfuscatorContext, module, opcodeDetector); var methodPrinter = new MethodPrinter(); foreach (var csvmMethod in csvmMethods) { var cilMethod = module.ResolveToken(csvmMethod.Token) as MethodDef; if (cilMethod == null) { throw new ApplicationException($"Could not find method {csvmMethod.Token:X8}"); } converter.Convert(cilMethod, csvmMethod); Logger.v("Restored method {0:X8}", cilMethod.MDToken.ToInt32()); PrintMethod(methodPrinter, cilMethod); } Logger.Instance.DeIndent(); Logger.n("Restored {0} CSVM methods", csvmMethods.Count); }
byte[] DecryptResourceAssembly() { var decrypted = resourceDecrypter.Decrypt(encryptedResource.CreateReader().ToArray()); var reader = new BinaryReader(new MemoryStream(decrypted)); int numResources = reader.ReadInt32() ^ xorKey1; for (int i = 0; i < numResources; i++) { reader.ReadString(); } int len; if (hasXorKeys) { len = reader.ReadInt32() ^ xorKey2; } else { len = (int)(reader.BaseStream.Length - reader.BaseStream.Position); } return(reader.ReadBytes(len)); }
public ImageResourceNodeImpl(ITreeNodeGroup treeNodeGroup, EmbeddedResource resource) : base(treeNodeGroup, resource) { imageData = resource.CreateReader().ToArray(); imageSource = ImageResourceUtilities.CreateImageSource(imageData); }
public override void Create(DecompileContext ctx) { using (var stream = File.Create(Filename)) embeddedResource.CreateReader().CopyTo(stream); }
protected static byte[] DecryptResourceV3(EmbeddedResource resource) => DecryptResourceV3(resource.CreateReader().ToArray());
public ResourceElementSetNodeImpl(ITreeNodeGroup treeNodeGroup, ModuleDef module, EmbeddedResource resource) : base(treeNodeGroup, resource) { this.module = module; resourceElementSet = ResourceReader.Read(module, resource.CreateReader()); }
void DumpEmbeddedFile(EmbeddedResource resource, string assemblyName, string extension, string reason) { DeobfuscatedFile.CreateAssemblyFile(resourceDecrypter.Decrypt(resource.CreateReader().AsStream()), Utils.GetAssemblySimpleName(assemblyName), extension); AddResourceToBeRemoved(resource, reason); }