public McKey(MyPEImage peImage, PeHeader peHeader) {
this.peHeader = peHeader;
try {
this.data = peImage.ReadBytes(peHeader.GetMcKeyRva(), 0x2000);
}
catch (IOException) {
this.data = peImage.ReadBytes(peHeader.GetMcKeyRva(), 0x1000);
}
}
public McKey(MyPEImage peImage, PeHeader peHeader)
{
//this.peHeader = peHeader;
try {
this.data = peImage.ReadBytes(peHeader.GetMcKeyRva(), 0x2000);
}
catch (IOException) {
this.data = peImage.ReadBytes(peHeader.GetMcKeyRva(), 0x1000);
}
}
public McKey(MyPEImage peImage, PeHeader peHeader)
{
try {
data = peImage.ReadBytes(peHeader.GetMcKeyRva(), 0x2000);
}
catch (Exception ex) when(ex is IOException || ex is ArgumentException)
{
data = peImage.ReadBytes(peHeader.GetMcKeyRva(), 0x1000);
}
}
public string Decrypt(MethodDef method, int offset)
{
var info = GetDecrypterInfo(method);
if (info.key == null)
{
int length = BitConverter.ToInt32(decryptedData, offset);
return(Encoding.Unicode.GetString(decryptedData, offset + 4, length));
}
else
{
byte[] encryptedStringData;
if (stringDecrypterVersion == StringDecrypterVersion.VER_37)
{
int fileOffset = BitConverter.ToInt32(decryptedData, offset);
int length = BitConverter.ToInt32(fileData, fileOffset);
encryptedStringData = new byte[length];
Array.Copy(fileData, fileOffset + 4, encryptedStringData, 0, length);
}
else if (stringDecrypterVersion == StringDecrypterVersion.VER_38)
{
uint rva = BitConverter.ToUInt32(decryptedData, offset);
int length = peImage.ReadInt32(rva);
encryptedStringData = peImage.ReadBytes(rva + 4, length);
}
else
{
throw new ApplicationException("Unknown string decrypter version");
}
return(Encoding.Unicode.GetString(DeobUtils.AesDecrypt(encryptedStringData, info.key, info.iv)));
}
}