void DeobfuscateNormal(Blocks blocks) { var instrsToRemove = new List <int>(); foreach (var block in blocks.MethodBlocks.GetAllBlocks()) { instrsToRemove.Clear(); var instrs = block.Instructions; for (int i = instrs.Count - 1; i >= 0; i--) { var instr = instrs[i]; if (instr.OpCode.Code != Code.Ldflda && instr.OpCode.Code != Code.Ldfld) { continue; } var structField = instr.Operand as IField; if (structField == null || !structFieldsToFix.Find(structField)) { continue; } var ldStFld = instrs[FindLdStFieldIndex(instrs, i + 1)]; ldStFld.Operand = GetNewField(structField, ldStFld.Operand as IField); instrsToRemove.Add(i); } if (instrsToRemove.Count > 0) { block.Remove(instrsToRemove); } } }
bool InitializeArrays2(ISimpleDeobfuscator simpleDeobfuscator, MethodDef method) { bool foundField = false; simpleDeobfuscator.Deobfuscate(method, true); var instructions = method.Body.Instructions; for (int i = 0; i < instructions.Count; i++) { var ldci4 = instructions[i]; if (!ldci4.IsLdcI4()) { continue; } i++; var instrs = DotNetUtils.GetInstructions(instructions, i, OpCodes.Newarr, OpCodes.Dup, OpCodes.Ldtoken, OpCodes.Call, OpCodes.Stsfld); if (instrs == null) { continue; } var arrayInitField = instrs[2].Operand as FieldDef; if (arrayInitField == null || arrayInitField.InitialValue == null || arrayInitField.InitialValue.Length == 0) { continue; } var calledMethod = instrs[3].Operand as IMethod; if (calledMethod == null || calledMethod.FullName != "System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)") { continue; } var targetField = instrs[4].Operand as FieldDef; if (targetField == null || targetField.FieldType.GetElementType() != ElementType.SZArray) { continue; } var etype = ((SZArraySig)targetField.FieldType).Next.GetElementType(); if (etype < ElementType.Boolean || etype > ElementType.U4) { continue; } if (fieldToInfo.Find(targetField) == null) { fieldToInfo.Add(targetField, new FieldInfo(targetField, arrayInitField)); foundField = true; } } return(foundField); }
static internal IEnumerable <FieldDef> GetFields(TypeDef type) { var typeFields = new FieldDefAndDeclaringTypeDict <FieldDef>(); foreach (var field in type.Fields) { typeFields.Add(field, field); } var realFields = new Dictionary <FieldDef, bool>(); foreach (var method in type.Methods) { if (method.Body == null) { continue; } foreach (var instr in method.Body.Instructions) { var fieldRef = instr.Operand as IField; if (fieldRef == null) { continue; } var field = typeFields.Find(fieldRef); if (field == null) { continue; } realFields[field] = true; } } return(realFields.Keys); }
public void Deobfuscate(Blocks blocks) { if (decrypter == null) { return; } foreach (var block in blocks.MethodBlocks.GetAllBlocks()) { var instrs = block.Instructions; for (int i = 0; i < instrs.Count; i++) { var instr = instrs[i]; if (instr.OpCode.Code != Code.Ldsfld) { continue; } var field = instr.Operand as IField; if (field == null) { continue; } var info = stringInfos.Find(field); if (info == null) { continue; } var decrypted = Decrypt(info); instrs[i] = new Instr(OpCodes.Ldstr.ToInstruction(decrypted)); Logger.v("Decrypted string: {0}", Utils.ToCsharpString(decrypted)); } } }
static short[] FindKey(MethodDef initMethod, FieldDefAndDeclaringTypeDict<bool> fields) { var instrs = initMethod.Body.Instructions; for (int i = 0; i < instrs.Count - 2; i++) { var ldci4 = instrs[i]; if (!ldci4.IsLdcI4()) continue; var newarr = instrs[i + 1]; if (newarr.OpCode.Code != Code.Newarr) continue; if (newarr.Operand.ToString() != "System.Char") continue; var stloc = instrs[i + 2]; if (!stloc.IsStloc()) continue; var local = stloc.GetLocal(initMethod.Body.Variables); int startInitIndex = i; i++; var array = ArrayFinder.GetInitializedInt16Array(ldci4.GetLdcI4Value(), initMethod, ref i); if (array == null) continue; var field = GetStoreField(initMethod, startInitIndex, local); if (field == null) continue; if (fields.Find(field)) return array; } return null; }
protected DelegateInfo GetDelegateInfo(IField field) { if (field == null) { return(null); } return(fieldToDelegateInfo.Find(field)); }
public new void Find() { if (delegateCreatorMethods.Count == 0) return; var cctor = DotNetUtils.GetModuleTypeCctor(module); if (cctor == null) return; Logger.v("Finding all proxy delegates"); var delegateInfos = CreateDelegateInitInfos(cctor); fieldToMethods = CreateFieldToMethodsDictionary(cctor.DeclaringType); if (delegateInfos.Count < fieldToMethods.Count) throw new ApplicationException("Missing proxy delegates"); var delegateToFields = new Dictionary<TypeDef, List<FieldDef>>(); foreach (var field in fieldToMethods.GetKeys()) { if (!delegateToFields.TryGetValue(field.FieldType.TryGetTypeDef(), out var list)) delegateToFields[field.FieldType.TryGetTypeDef()] = list = new List<FieldDef>(); list.Add(field); } foreach (var kv in delegateToFields) { var type = kv.Key; var fields = kv.Value; Logger.v("Found proxy delegate: {0} ({1:X8})", Utils.RemoveNewlines(type), type.MDToken.ToInt32()); RemovedDelegateCreatorCalls++; Logger.Instance.Indent(); foreach (var field in fields) { var proxyMethods = fieldToMethods.Find(field); if (proxyMethods == null) continue; var info = delegateInfos.Find(field); if (info == null) throw new ApplicationException("Missing proxy info"); GetCallInfo(info, field, out var calledMethod, out var callOpcode); if (calledMethod == null) continue; foreach (var proxyMethod in proxyMethods) { Add(proxyMethod, new DelegateInfo(field, calledMethod, callOpcode)); Logger.v("Field: {0}, Opcode: {1}, Method: {2} ({3:X8})", Utils.RemoveNewlines(field.Name), callOpcode, Utils.RemoveNewlines(calledMethod), calledMethod.MDToken.ToUInt32()); } } Logger.Instance.DeIndent(); delegateTypesDict[type] = true; } // 1.2 r54564 (almost 1.3) now moves method proxy init code to the delegate cctors Find2(); }
int FindNextFieldUse(MethodDef method, int index) { var instrs = method.Body.Instructions; for (int i = index; i < instrs.Count; i++) { var instr = instrs[i]; if (instr.OpCode.Code != Code.Ldsfld && instr.OpCode.Code != Code.Stsfld) { continue; } var field = instr.Operand as IField; if (!fields.Find(field)) { return(-1); } return(i); } return(-1); }
static short[] FindKey(MethodDef initMethod, FieldDefAndDeclaringTypeDict <bool> fields) { var instrs = initMethod.Body.Instructions; for (int i = 0; i < instrs.Count - 2; i++) { var ldci4 = instrs[i]; if (!ldci4.IsLdcI4()) { continue; } var newarr = instrs[i + 1]; if (newarr.OpCode.Code != Code.Newarr) { continue; } if (newarr.Operand.ToString() != "System.Char") { continue; } var stloc = instrs[i + 2]; if (!stloc.IsStloc()) { continue; } var local = stloc.GetLocal(initMethod.Body.Variables); int startInitIndex = i; i++; var array = ArrayFinder.GetInitializedInt16Array(ldci4.GetLdcI4Value(), initMethod, ref i); if (array == null) { continue; } var field = GetStoreField(initMethod, startInitIndex, local); if (field == null) { continue; } if (fields.Find(field)) { return(array); } } return(null); }
static FieldDefAndDeclaringTypeDict<List<MethodDef>> CreateFieldToMethodsDictionary(TypeDef type) { var dict = new FieldDefAndDeclaringTypeDict<List<MethodDef>>(); foreach (var method in type.Methods) { if (!method.IsStatic || method.Body == null || method.Name == ".cctor") continue; var delegateField = GetDelegateField(method); if (delegateField == null) continue; var methods = dict.Find(delegateField); if (methods == null) dict.Add(delegateField, methods = new List<MethodDef>()); methods.Add(method); } return dict; }
Dictionary <FieldDef, bool> FindFieldTypes(FieldDefAndDeclaringTypeDict <FieldDef> fields) { var validFields = new Dictionary <FieldDef, bool>(fields.Count); foreach (var field in fields.GetKeys()) { validFields.Add(field, false); } foreach (var type in module.GetTypes()) { if (validFields.Count == 0) { break; } foreach (var method in type.Methods) { var body = method.Body; if (body == null) { continue; } foreach (var instr in body.Instructions) { if (instr.OpCode.Code == Code.Ldsfld) { continue; } var field = instr.Operand as IField; if (field == null) { continue; } var validType = fields.Find(field); if (validType == null) { continue; } validFields.Remove(validType); } } } return(validFields); }
// Find the string decrypter string offset value or null if none found int?FindOffsetValue(MethodDef method) { var fieldDict = new FieldDefAndDeclaringTypeDict <IField>(); foreach (var field in method.DeclaringType.Fields) { fieldDict.Add(field, field); } var offsetField = FindOffsetField(method); if (offsetField == null) { return(null); } return(FindOffsetValue(method, (FieldDef)fieldDict.Find(offsetField), fieldDict)); }
public void Deobfuscate(Blocks blocks) { foreach (var block in blocks.MethodBlocks.GetAllBlocks()) { var instrs = block.Instructions; for (int i = 0; i < instrs.Count; i++) { var instr = instrs[i]; if (instr.OpCode.Code == Code.Call || instr.OpCode.Code == Code.Callvirt) { if (blocks.Method.DeclaringType == decrypterType) { continue; } var calledMethod = instr.Operand as IMethod; if (calledMethod != null && calledMethod.DeclaringType == decrypterType) { canRemoveType = false; } } else if (instr.OpCode.Code == Code.Ldsfld) { if (instr.OpCode.Code != Code.Ldsfld) { continue; } var field = instr.Operand as IField; if (field == null) { continue; } var decrypted = fieldToDecryptedString.Find(field); if (decrypted == null) { continue; } instrs[i] = new Instr(OpCodes.Ldstr.ToInstruction(decrypted)); Logger.v("Decrypted string: {0}", Utils.ToCsharpString(decrypted)); } } } }
int?FindOffsetValue(MethodDef method, FieldDef offsetField, FieldDefAndDeclaringTypeDict <IField> fields) { var instructions = method.Body.Instructions; for (int i = 0; i <= instructions.Count - 2; i++) { var ldstr = instructions[i]; if (ldstr.OpCode.Code != Code.Ldstr) { continue; } var stringVal = ldstr.Operand as string; if (stringVal == null) { continue; } var stsfld = instructions[i + 1]; if (stsfld.OpCode.Code != Code.Stsfld) { continue; } var field = stsfld.Operand as IField; if (field == null || fields.Find(field) != offsetField) { continue; } int value; if (!int.TryParse(stringVal, System.Globalization.NumberStyles.Integer, null, out value)) { continue; } return(value); } return(null); }
public new void Find() { if (delegateCreatorMethods.Count == 0) return; var cctor = DotNetUtils.GetModuleTypeCctor(module); if (cctor == null) return; Logger.v("Finding all proxy delegates"); var delegateInfos = CreateDelegateInitInfos(cctor); fieldToMethods = CreateFieldToMethodsDictionary(cctor.DeclaringType); if (delegateInfos.Count < fieldToMethods.Count) throw new ApplicationException("Missing proxy delegates"); var delegateToFields = new Dictionary<TypeDef, List<FieldDef>>(); foreach (var field in fieldToMethods.GetKeys()) { List<FieldDef> list; if (!delegateToFields.TryGetValue(field.FieldType.TryGetTypeDef(), out list)) delegateToFields[field.FieldType.TryGetTypeDef()] = list = new List<FieldDef>(); list.Add(field); } foreach (var kv in delegateToFields) { var type = kv.Key; var fields = kv.Value; Logger.v("Found proxy delegate: {0} ({1:X8})", Utils.RemoveNewlines(type), type.MDToken.ToInt32()); RemovedDelegateCreatorCalls++; Logger.Instance.Indent(); foreach (var field in fields) { var proxyMethods = fieldToMethods.Find(field); if (proxyMethods == null) continue; var info = delegateInfos.Find(field); if (info == null) throw new ApplicationException("Missing proxy info"); IMethod calledMethod; OpCode callOpcode; GetCallInfo(info, field, out calledMethod, out callOpcode); if (calledMethod == null) continue; foreach (var proxyMethod in proxyMethods) { Add(proxyMethod, new DelegateInfo(field, calledMethod, callOpcode)); Logger.v("Field: {0}, Opcode: {1}, Method: {2} ({3:X8})", Utils.RemoveNewlines(field.Name), callOpcode, Utils.RemoveNewlines(calledMethod), calledMethod.MDToken.ToUInt32()); } } Logger.Instance.DeIndent(); delegateTypesDict[type] = true; } // 1.2 r54564 (almost 1.3) now moves method proxy init code to the delegate cctors Find2(); }
int? FindOffsetValue(MethodDef method, FieldDef offsetField, FieldDefAndDeclaringTypeDict<IField> fields) { var instructions = method.Body.Instructions; for (int i = 0; i <= instructions.Count - 2; i++) { var ldstr = instructions[i]; if (ldstr.OpCode.Code != Code.Ldstr) continue; var stringVal = ldstr.Operand as string; if (stringVal == null) continue; var stsfld = instructions[i + 1]; if (stsfld.OpCode.Code != Code.Stsfld) continue; var field = stsfld.Operand as IField; if (field == null || fields.Find(field) != offsetField) continue; int value; if (!int.TryParse(stringVal, System.Globalization.NumberStyles.Integer, null, out value)) continue; return value; } return null; }
// Find the string decrypter string offset value or null if none found int? FindOffsetValue(MethodDef method) { var fieldDict = new FieldDefAndDeclaringTypeDict<IField>(); foreach (var field in method.DeclaringType.Fields) fieldDict.Add(field, field); var offsetField = FindOffsetField(method); if (offsetField == null) return null; return FindOffsetValue(method, (FieldDef)fieldDict.Find(offsetField), fieldDict); }
void InitFieldEventHandlers(FieldDefAndDeclaringTypeDict<MFieldDef> ourFields, MethodDefAndDeclaringTypeDict<MMethodDef> ourMethods) { var checker = NameChecker; foreach (var methodDef in type.AllMethods) { if (methodDef.MethodDef.Body == null) continue; if (methodDef.MethodDef.IsStatic) continue; var instructions = methodDef.MethodDef.Body.Instructions; for (int i = 0; i < instructions.Count - 6; i++) { // We're looking for this code pattern: // ldarg.0 // ldfld field // ldarg.0 // ldftn method / ldarg.0 + ldvirtftn // newobj event_handler_ctor // callvirt add_SomeEvent if (instructions[i].GetParameterIndex() != 0) continue; int index = i + 1; var ldfld = instructions[index++]; if (ldfld.OpCode.Code != Code.Ldfld) continue; var fieldRef = ldfld.Operand as IField; if (fieldRef == null) continue; var fieldDef = ourFields.Find(fieldRef); if (fieldDef == null) continue; if (instructions[index++].GetParameterIndex() != 0) continue; IMethod methodRef; var instr = instructions[index + 1]; if (instr.OpCode.Code == Code.Ldvirtftn) { if (!IsThisOrDup(instructions[index++])) continue; var ldvirtftn = instructions[index++]; methodRef = ldvirtftn.Operand as IMethod; } else { var ldftn = instructions[index++]; if (ldftn.OpCode.Code != Code.Ldftn) continue; methodRef = ldftn.Operand as IMethod; } if (methodRef == null) continue; var handlerMethod = ourMethods.Find(methodRef); if (handlerMethod == null) continue; var newobj = instructions[index++]; if (newobj.OpCode.Code != Code.Newobj) continue; if (!IsEventHandlerCtor(newobj.Operand as IMethod)) continue; var call = instructions[index++]; if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt) continue; var addHandler = call.Operand as IMethod; if (addHandler == null) continue; if (!Utils.StartsWith(addHandler.Name.String, "add_", StringComparison.Ordinal)) continue; var eventName = addHandler.Name.String.Substring(4); if (!checker.IsValidEventName(eventName)) continue; memberInfos.Method(handlerMethod).suggestedName = string.Format("{0}_{1}", memberInfos.Field(fieldDef).newName, eventName); } } }
void InitializeWindowsFormsFieldsAndProps() { var checker = NameChecker; var ourFields = new FieldDefAndDeclaringTypeDict<MFieldDef>(); foreach (var fieldDef in type.AllFields) ourFields.Add(fieldDef.FieldDef, fieldDef); var ourMethods = new MethodDefAndDeclaringTypeDict<MMethodDef>(); foreach (var methodDef in type.AllMethods) ourMethods.Add(methodDef.MethodDef, methodDef); foreach (var methodDef in type.AllMethods) { if (methodDef.MethodDef.Body == null) continue; if (methodDef.MethodDef.IsStatic || methodDef.MethodDef.IsVirtual) continue; var instructions = methodDef.MethodDef.Body.Instructions; for (int i = 2; i < instructions.Count; i++) { var call = instructions[i]; if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt) continue; if (!IsWindowsFormsSetNameMethod(call.Operand as IMethod)) continue; var ldstr = instructions[i - 1]; if (ldstr.OpCode.Code != Code.Ldstr) continue; var fieldName = ldstr.Operand as string; if (fieldName == null || !checker.IsValidFieldName(fieldName)) continue; var instr = instructions[i - 2]; IField fieldRef = null; if (instr.OpCode.Code == Code.Call || instr.OpCode.Code == Code.Callvirt) { var calledMethod = instr.Operand as IMethod; if (calledMethod == null) continue; var calledMethodDef = ourMethods.Find(calledMethod); if (calledMethodDef == null) continue; fieldRef = GetFieldRef(calledMethodDef.MethodDef); var propDef = calledMethodDef.Property; if (propDef == null) continue; memberInfos.Property(propDef).suggestedName = fieldName; fieldName = "_" + fieldName; } else if (instr.OpCode.Code == Code.Ldfld) { fieldRef = instr.Operand as IField; } if (fieldRef == null) continue; var fieldDef = ourFields.Find(fieldRef); if (fieldDef == null) continue; var fieldInfo = memberInfos.Field(fieldDef); if (fieldInfo.renamed) continue; fieldInfo.suggestedName = variableNameState.GetNewFieldName(fieldInfo.oldName, new NameCreator2(fieldName)); } } }
void InitFieldEventHandlers(FieldDefAndDeclaringTypeDict <MFieldDef> ourFields, MethodDefAndDeclaringTypeDict <MMethodDef> ourMethods) { var checker = NameChecker; foreach (var methodDef in type.AllMethods) { if (methodDef.MethodDef.Body == null) { continue; } if (methodDef.MethodDef.IsStatic) { continue; } var instructions = methodDef.MethodDef.Body.Instructions; for (int i = 0; i < instructions.Count - 6; i++) { // We're looking for this code pattern: // ldarg.0 // ldfld field // ldarg.0 // ldftn method / ldarg.0 + ldvirtftn // newobj event_handler_ctor // callvirt add_SomeEvent if (instructions[i].GetParameterIndex() != 0) { continue; } int index = i + 1; var ldfld = instructions[index++]; if (ldfld.OpCode.Code != Code.Ldfld) { continue; } var fieldRef = ldfld.Operand as IField; if (fieldRef == null) { continue; } var fieldDef = ourFields.Find(fieldRef); if (fieldDef == null) { continue; } if (instructions[index++].GetParameterIndex() != 0) { continue; } IMethod methodRef; var instr = instructions[index + 1]; if (instr.OpCode.Code == Code.Ldvirtftn) { if (!IsThisOrDup(instructions[index++])) { continue; } var ldvirtftn = instructions[index++]; methodRef = ldvirtftn.Operand as IMethod; } else { var ldftn = instructions[index++]; if (ldftn.OpCode.Code != Code.Ldftn) { continue; } methodRef = ldftn.Operand as IMethod; } if (methodRef == null) { continue; } var handlerMethod = ourMethods.Find(methodRef); if (handlerMethod == null) { continue; } var newobj = instructions[index++]; if (newobj.OpCode.Code != Code.Newobj) { continue; } if (!IsEventHandlerCtor(newobj.Operand as IMethod)) { continue; } var call = instructions[index++]; if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt) { continue; } var addHandler = call.Operand as IMethod; if (addHandler == null) { continue; } if (!Utils.StartsWith(addHandler.Name.String, "add_", StringComparison.Ordinal)) { continue; } var eventName = addHandler.Name.String.Substring(4); if (!checker.IsValidEventName(eventName)) { continue; } memberInfos.Method(handlerMethod).suggestedName = $"{memberInfos.Field(fieldDef).newName}_{eventName}"; } } }
static internal IEnumerable<FieldDef> GetFields(TypeDef type) { var typeFields = new FieldDefAndDeclaringTypeDict<FieldDef>(); foreach (var field in type.Fields) typeFields.Add(field, field); var realFields = new Dictionary<FieldDef, bool>(); foreach (var method in type.Methods) { if (method.Body == null) continue; foreach (var instr in method.Body.Instructions) { var fieldRef = instr.Operand as IField; if (fieldRef == null) continue; var field = typeFields.Find(fieldRef); if (field == null) continue; realFields[field] = true; } } return realFields.Keys; }
void InitializeWindowsFormsFieldsAndProps() { var checker = NameChecker; var ourFields = new FieldDefAndDeclaringTypeDict <MFieldDef>(); foreach (var fieldDef in type.AllFields) { ourFields.Add(fieldDef.FieldDef, fieldDef); } var ourMethods = new MethodDefAndDeclaringTypeDict <MMethodDef>(); foreach (var methodDef in type.AllMethods) { ourMethods.Add(methodDef.MethodDef, methodDef); } foreach (var methodDef in type.AllMethods) { if (methodDef.MethodDef.Body == null) { continue; } if (methodDef.MethodDef.IsStatic || methodDef.MethodDef.IsVirtual) { continue; } var instructions = methodDef.MethodDef.Body.Instructions; for (int i = 2; i < instructions.Count; i++) { var call = instructions[i]; if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt) { continue; } if (!IsWindowsFormsSetNameMethod(call.Operand as IMethod)) { continue; } var ldstr = instructions[i - 1]; if (ldstr.OpCode.Code != Code.Ldstr) { continue; } var fieldName = ldstr.Operand as string; if (fieldName == null || !checker.IsValidFieldName(fieldName)) { continue; } var instr = instructions[i - 2]; IField fieldRef = null; if (instr.OpCode.Code == Code.Call || instr.OpCode.Code == Code.Callvirt) { var calledMethod = instr.Operand as IMethod; if (calledMethod == null) { continue; } var calledMethodDef = ourMethods.Find(calledMethod); if (calledMethodDef == null) { continue; } fieldRef = GetFieldRef(calledMethodDef.MethodDef); var propDef = calledMethodDef.Property; if (propDef == null) { continue; } memberInfos.Property(propDef).suggestedName = fieldName; fieldName = "_" + fieldName; } else if (instr.OpCode.Code == Code.Ldfld) { fieldRef = instr.Operand as IField; } if (fieldRef == null) { continue; } var fieldDef = ourFields.Find(fieldRef); if (fieldDef == null) { continue; } var fieldInfo = memberInfos.Field(fieldDef); if (fieldInfo.renamed) { continue; } fieldInfo.suggestedName = variableNameState.GetNewFieldName(fieldInfo.oldName, new NameCreator2(fieldName)); } } }
Dictionary<FieldDef, bool> FindFieldTypes(FieldDefAndDeclaringTypeDict<FieldDef> fields) { var validFields = new Dictionary<FieldDef, bool>(fields.Count); foreach (var field in fields.GetKeys()) validFields.Add(field, false); foreach (var type in module.GetTypes()) { if (validFields.Count == 0) break; foreach (var method in type.Methods) { var body = method.Body; if (body == null) continue; foreach (var instr in body.Instructions) { if (instr.OpCode.Code == Code.Ldsfld) continue; var field = instr.Operand as IField; if (field == null) continue; var validType = fields.Find(field); if (validType == null) continue; validFields.Remove(validType); } } } return validFields; }