private int DecryptStrings(ModuleDef moduleDef, IMDTokenProvider decryptionMethod, IFullName declaringType)
{
var assembly = Assembly.LoadFile(moduleDef.Location);
var decryptCount = 0;
foreach (var type in moduleDef.Types)
{
foreach (var method in type.Methods)
{
if (!method.HasBody || !method.Body.HasInstructions)
continue;
var instructions = method.Body.Instructions;
for (var i = 0; i < instructions.Count; i++)
{
if (instructions[i].OpCode != OpCodes.Ldstr)
continue;
if (instructions[i + 1].OpCode != OpCodes.Ldstr)
continue;
if (!instructions[i + 2].Operand.ToString().
Equals(decryptionMethod.ToString()))
continue;
var param1 = instructions[i].Operand.ToString();
var param2 = instructions[i + 1].Operand.ToString();
var methodType = assembly.GetType(declaringType.Name);
if (methodType == null)
continue;
var metaData = decryptionMethod.MDToken.ToInt32();
var methodBase = methodType.Module.ResolveMethod(metaData);
if (methodBase == null)
continue;
var parameters = methodBase.GetParameters();
if (parameters.Length == 0)
continue;
var result
= methodBase.Invoke(null, new object[] { param1, param2 });
var body = method.Body;
body.Instructions[i].OpCode = OpCodes.Ldstr;
body.Instructions[i].Operand = result.ToString();
body.Instructions.RemoveAt(i + 1);
body.Instructions.RemoveAt(i + 1);
decryptCount++;
}
}
}
return decryptCount;
}
internal void Link(IMDTokenProvider from, IMDTokenProvider to)
{
var nodeFrom = GetOrCreateNode(from);
var nodeTo = GetOrCreateNode(to);
_graph.Edges.Add(nodeFrom, nodeTo);
}
internal INameProvider GetRenamer(IMDTokenProvider def, ProtectionTargets targets)
{
return targets.GetOption(def, "mode", "ascii").ToUpperInvariant() switch
{
"FILESIZESAVING" => Factory.CreateFileSizeSaving(),
_ => Factory.CreateAscii()
};
}
}
protected void Execute(IMDTokenProvider member)
{
if (member == null)
{
return;
}
Clipboard.SetText(string.Format("0x{0:X8}", member.MDToken.Raw));
}
void WriteToken(ISyntaxHighlightOutput output, IMDTokenProvider tok, bool showToken)
{
if (!showToken)
{
return;
}
output.WriteSpace();
output.Write("@", TextTokenKind.Operator);
output.Write(string.Format("{0:X8}", tok.MDToken.Raw), TextTokenKind.Number);
}
/// <summary>
/// Writes a token
/// </summary>
/// <param name="output">Output</param>
/// <param name="tok">Token provider</param>
/// <param name="showToken">true to write tokens</param>
void WriteToken(ITextColorWriter output, IMDTokenProvider tok, bool showToken)
{
if (!showToken)
{
return;
}
output.WriteSpace();
output.Write(BoxedTextColor.Operator, "@");
output.Write(BoxedTextColor.Number, tok.MDToken.Raw.ToString("X8"));
}
/// <summary>
/// Writes a token
/// </summary>
/// <param name="output">Output</param>
/// <param name="tok">Token provider</param>
/// <param name="showToken">true to write tokens</param>
void WriteToken(ITextColorWriter output, IMDTokenProvider tok, bool showToken)
{
if (!showToken)
{
return;
}
output.WriteSpace();
output.Write(BoxedTextColor.Operator, "@");
output.Write(BoxedTextColor.Number, string.Format("{0:X8}", tok.MDToken.Raw));
}
public string GetOption(IMDTokenProvider target, string key, string def = default)
{
if (!Options.ContainsKey(target))
{
return(def);
}
var value = Options[target];
return(!value.ContainsKey(key) ? def : value[key]);
}
T MethodInvoker <T>(ModuleDef module, IMDTokenProvider decrypterMethod, uint value)
{
if (assembly == null)
{
LoadAssembly(module);
}
var method = (MethodInfo)assembly.ManifestModule.ResolveMethod(decrypterMethod.MDToken.ToInt32());
var result = method.MakeGenericMethod(typeof(T)).Invoke(null, new object[] { value });
return((T)result);
}
static TokenReference CreateTokenReference(ModuleDef module, IMDTokenProvider @ref)
{
if (module == null || @ref == null)
{
return(null);
}
// Make sure it's not a created method/field/etc
var res = module.ResolveToken(@ref.MDToken.Raw);
if (res == null)
{
return(null);
}
return(new TokenReference(module, @ref.MDToken.Raw));
}
public static IMDTokenProvider Import(this ModuleDef module, IMDTokenProvider token)
{
switch (token)
{
case IField field:
return(module.Import(field));
case IMethod method:
return(module.Import(method));
case IType type:
return(module.Import(type));
default:
throw new ArgumentException("unrecognized token provider type: " + token.GetType());
}
}
Node GetOrCreateNode(IMDTokenProvider def)
{
var token = def.MDToken.ToInt32().ToString();
if (_graph.Nodes.TryGetNode(token, out var existing))
{
return(existing);
}
var node = new Node(token);
node.UserData["def"] = def;
node.UserData["rename"] = true;
_graph.Nodes.Add(node);
return(node);
}
public SourceRef(MethodDef method, uint offset, IMDTokenProvider reference) {
this.Method = method;
this.ILOffset = offset;
this.Reference = reference;
}
public SourceRef(MethodDef method, uint offset, IMDTokenProvider reference)
{
Method = method;
ILOffset = offset;
Reference = reference;
}
public bool Contains(IMDTokenProvider obfMdTokenProvider) => MDTokens.Contains(obfMdTokenProvider.MDToken);
internal void Link(IMDTokenProvider from, IMDTokenProvider to)
{
Graph.Link(from, to);
}
internal void Remove(IMDTokenProvider def)
{
_graph.Nodes[def.MDToken.ToInt32().ToString()].UserData["rename"] = false;
}
internal void Add(IMDTokenProvider def)
{
_graph.Nodes.Add(GetOrCreateNode(def));
}
void WriteToken(IMDTokenProvider tok) {
if (!ShowTokens)
return;
Debug.Assert(tok != null);
if (tok == null)
return;
OutputWrite(string.Format("/*0x{0:X8}*/", tok.MDToken.Raw), TextTokenKind.Comment);
}
public virtual IMDTokenProvider Transform(IMDTokenProvider token, ITransformContext context) => token;
static TokenReference CreateTokenReference(ModuleDef module, IMDTokenProvider @ref)
{
if (module == null || @ref == null)
return null;
var mod = module as ModuleDefMD;
if (mod == null)
return null;
// Make sure it's not a created method/field/etc
var res = mod.ResolveToken(@ref.MDToken.Raw);
if (res == null)
return null;
return new TokenReference(module.Location, @ref.MDToken.Raw);
}
private void Load(IMDTokenProvider mdt)
{
if (mdt == null)
{
return;
}
switch (mdt.MDToken.Table)
{
case Table.Module: Load((ModuleDef)mdt); break;
case Table.TypeRef: Load((TypeRef)mdt); break;
case Table.TypeDef: Load((TypeDef)mdt); break;
case Table.Field: Load((FieldDef)mdt); break;
case Table.Method: Load((MethodDef)mdt); break;
case Table.Param: Load((ParamDef)mdt); break;
case Table.InterfaceImpl: Load((InterfaceImpl)mdt); break;
case Table.MemberRef: Load((MemberRef)mdt); break;
case Table.Constant: Load((Constant)mdt); break;
case Table.DeclSecurity: Load((DeclSecurity)mdt); break;
case Table.ClassLayout: Load((ClassLayout)mdt); break;
case Table.StandAloneSig: Load((StandAloneSig)mdt); break;
case Table.Event: Load((EventDef)mdt); break;
case Table.Property: Load((PropertyDef)mdt); break;
case Table.ModuleRef: Load((ModuleRef)mdt); break;
case Table.TypeSpec: Load((TypeSpec)mdt); break;
case Table.ImplMap: Load((ImplMap)mdt); break;
case Table.Assembly: Load((AssemblyDef)mdt); break;
case Table.AssemblyRef: Load((AssemblyRef)mdt); break;
case Table.File: Load((FileDef)mdt); break;
case Table.ExportedType: Load((ExportedType)mdt); break;
case Table.GenericParam: Load((GenericParam)mdt); break;
case Table.MethodSpec: Load((MethodSpec)mdt); break;
case Table.GenericParamConstraint: Load((GenericParamConstraint)mdt); break;
case Table.ManifestResource:
var rsrc = mdt as Resource;
if (rsrc != null)
{
Load(rsrc);
break;
}
var mr = mdt as ManifestResource;
if (mr != null)
{
Load(mr);
break;
}
Debug.Fail("Unknown ManifestResource");
break;
case Table.FieldPtr:
case Table.MethodPtr:
case Table.ParamPtr:
case Table.CustomAttribute:
case Table.FieldMarshal:
case Table.FieldLayout:
case Table.EventMap:
case Table.EventPtr:
case Table.PropertyMap:
case Table.PropertyPtr:
case Table.MethodSemantics:
case Table.MethodImpl:
case Table.FieldRVA:
case Table.ENCLog:
case Table.ENCMap:
case Table.AssemblyProcessor:
case Table.AssemblyOS:
case Table.AssemblyRefProcessor:
case Table.AssemblyRefOS:
case Table.NestedClass:
break;
default:
Debug.Fail("Unknown type");
break;
}
}
private int DecryptStrings(ModuleDef moduleDef, IMDTokenProvider decryptionMethod, IFullName declaringType)
{
var assembly = Assembly.LoadFile(moduleDef.Location);
var decryptCount = 0;
foreach (var type in moduleDef.Types)
{
foreach (var method in type.Methods)
{
if (!method.HasBody || !method.Body.HasInstructions)
{
continue;
}
var instructions = method.Body.Instructions;
for (var i = 0; i < instructions.Count; i++)
{
if (instructions[i].OpCode != OpCodes.Ldstr)
{
continue;
}
if (instructions[i + 1].OpCode != OpCodes.Ldstr)
{
continue;
}
if (!instructions[i + 2].Operand.ToString().
Equals(decryptionMethod.ToString()))
{
continue;
}
var param1 = instructions[i].Operand.ToString();
var param2 = instructions[i + 1].Operand.ToString();
var methodType = assembly.GetType(declaringType.Name);
if (methodType == null)
{
continue;
}
var metaData = decryptionMethod.MDToken.ToInt32();
var methodBase = methodType.Module.ResolveMethod(metaData);
if (methodBase == null)
{
continue;
}
var parameters = methodBase.GetParameters();
if (parameters.Length == 0)
{
continue;
}
var result
= methodBase.Invoke(null, new object[] { param1, param2 });
var body = method.Body;
body.Instructions[i].OpCode = OpCodes.Ldstr;
body.Instructions[i].Operand = result.ToString();
body.Instructions.RemoveAt(i + 1);
body.Instructions.RemoveAt(i + 1);
decryptCount++;
}
}
}
return(decryptCount);
}
IMDTokenProvider Create_SystemArray_get_Length()
{
if (Create_SystemArray_get_Length_result_initd)
return Create_SystemArray_get_Length_result;
Create_SystemArray_get_Length_result_initd = true;
var module = GetModule();
if (module == null)
return null;
const string propName = "Length";
var type = module.CorLibTypes.GetTypeRef("System", "Array");
var retType = module.CorLibTypes.Int32;
var mr = new MemberRefUser(module, "get_" + propName, MethodSig.CreateInstance(retType), type);
Create_SystemArray_get_Length_result = mr;
var md = mr.ResolveMethod();
if (md == null || md.DeclaringType == null)
return mr;
var prop = md.DeclaringType.FindProperty(propName);
if (prop == null)
return mr;
Create_SystemArray_get_Length_result = prop;
return prop;
}
/// <summary>
/// Writes a token
/// </summary>
/// <param name="output">Output</param>
/// <param name="tok">Token provider</param>
/// <param name="showToken">true to write tokens</param>
void WriteToken(ITextColorWriter output, IMDTokenProvider tok, bool showToken) {
if (!showToken)
return;
output.WriteSpace();
output.Write(BoxedTextColor.Operator, "@");
output.Write(BoxedTextColor.Number, string.Format("{0:X8}", tok.MDToken.Raw));
}
IMDTokenProvider Create_SystemType_get_TypeHandle()
{
if (Create_SystemType_get_TypeHandle_initd)
return Create_SystemType_get_TypeHandle_result;
Create_SystemType_get_TypeHandle_initd = true;
const string propName = "TypeHandle";
var type = corLib.GetTypeRef("System", "Type");
var retType = new ValueTypeSig(corLib.GetTypeRef("System", "RuntimeTypeHandle"));
var mr = new MemberRefUser(methodDef.Module, "get_" + propName, MethodSig.CreateInstance(retType), type);
Create_SystemType_get_TypeHandle_result = mr;
var md = mr.ResolveMethod();
if (md == null || md.DeclaringType == null)
return mr;
var prop = md.DeclaringType.FindProperty(propName);
if (prop == null)
return mr;
Create_SystemType_get_TypeHandle_result = prop;
return prop;
}
private void Add(IMDTokenProvider o)
{
AddToStack(o);
}
internal void Remove(IMDTokenProvider def)
{
Graph.Remove(def);
}
protected void Execute(IMDTokenProvider member) {
if (member == null)
return;
Clipboard.SetText(string.Format("0x{0:X8}", member.MDToken.Raw));
}
void WriteToken(ISyntaxHighlightOutput output, IMDTokenProvider tok, bool showToken)
{
if (!showToken)
return;
output.WriteSpace();
output.Write("@", TextTokenKind.Operator);
output.Write(string.Format("{0:X8}", tok.MDToken.Raw), TextTokenKind.Number);
}
internal void Add(IMDTokenProvider def)
{
Graph.Add(def);
}
void Add(IMDTokenProvider o) => AddToStack(o);
