public static List <MethodRecord> getDehashedRecords(ConcurrentDictionary <string, MethodRecord> methodSHADictKEYSHA, CST_MSG msg) { List <MethodRecord> mrList = new List <MethodRecord>(); string[] sha_methods = msg.SymT.Split(new char[] { ' ', '(', ')' }, StringSplitOptions.RemoveEmptyEntries); foreach (string method in sha_methods) { string[] partyNameSplit = method.Split(new char[] { ':' }, StringSplitOptions.RemoveEmptyEntries); if (partyNameSplit.Length <= 1) { continue; } string stripped_method = partyNameSplit[1]; MethodRecord mr = null; if (!methodSHADictKEYSHA.ContainsKey(stripped_method)) { if (!File.Exists(methodsFolder + @"\" + stripped_method + ".txt")) { DLLServerDownloader.downloadMethodRecord(stripped_method); } mr = MethodHasher.getMRFromFile(stripped_method); } else { mr = methodSHADictKEYSHA[stripped_method]; } if (!Directory.Exists(dllsFolder + @"\" + mr.SHA_of_DLL)) { DLLServerDownloader.downloadDLLandDep(mr.SHA_of_DLL); } mrList.Add(mr); } return(mrList); }
public static List <MethodRecord> getDehashedRecords(string SymT) { List <MethodRecord> mrList = new List <MethodRecord>(); string[] sha_methods = SymT.Split(new char[] { ' ', '(', ')' }, StringSplitOptions.RemoveEmptyEntries); foreach (string method in sha_methods) { string[] partyNameSplit = method.Split(new char[] { ':' }, StringSplitOptions.RemoveEmptyEntries); if (partyNameSplit.Length <= 1) { continue; } string stripped_method = partyNameSplit[1]; MethodRecord mr = MethodHasher.getMRFromFile(stripped_method); mrList.Add(mr); } return(mrList); }