void deobfuscate(MethodDef method, BlocksCflowDeobfuscator cflowDeobfuscator, MethodPrinter methodPrinter, bool isVerbose, bool isVV) { if (!hasNonEmptyBody(method)) return; var blocks = new Blocks(method); int numRemovedLocals = 0; int oldNumInstructions = method.Body.Instructions.Count; deob.deobfuscateMethodBegin(blocks); if (options.ControlFlowDeobfuscation) { cflowDeobfuscator.init(blocks); cflowDeobfuscator.deobfuscate(); } if (deob.deobfuscateOther(blocks) && options.ControlFlowDeobfuscation) cflowDeobfuscator.deobfuscate(); if (options.ControlFlowDeobfuscation) { if (CanOptimizeLocals()) numRemovedLocals = blocks.optimizeLocals(); blocks.repartitionBlocks(); } deobfuscateStrings(blocks); deob.deobfuscateMethodEnd(blocks); IList<Instruction> allInstructions; IList<ExceptionHandler> allExceptionHandlers; blocks.getCode(out allInstructions, out allExceptionHandlers); DotNetUtils.restoreBody(method, allInstructions, allExceptionHandlers); if (isVerbose && numRemovedLocals > 0) Logger.v("Removed {0} unused local(s)", numRemovedLocals); int numRemovedInstructions = oldNumInstructions - method.Body.Instructions.Count; if (isVerbose && numRemovedInstructions > 0) Logger.v("Removed {0} dead instruction(s)", numRemovedInstructions); if (isVV) { Logger.log(LoggerEvent.VeryVerbose, "Deobfuscated code:"); Logger.Instance.indent(); methodPrinter.print(LoggerEvent.VeryVerbose, allInstructions, allExceptionHandlers); Logger.Instance.deIndent(); } }
void deobfuscate(MethodDefinition method, BlocksCflowDeobfuscator cflowDeobfuscator, MethodPrinter methodPrinter) { if (!hasNonEmptyBody(method)) return; var blocks = new Blocks(method); int numRemovedLocals = 0; int oldNumInstructions = method.Body.Instructions.Count; deob.deobfuscateMethodBegin(blocks); if (options.ControlFlowDeobfuscation) { cflowDeobfuscator.init(blocks); cflowDeobfuscator.deobfuscate(); } if (deob.deobfuscateOther(blocks) && options.ControlFlowDeobfuscation) cflowDeobfuscator.deobfuscate(); if (options.ControlFlowDeobfuscation) { numRemovedLocals = blocks.optimizeLocals(); blocks.repartitionBlocks(); } deobfuscateStrings(blocks); deob.deobfuscateMethodEnd(blocks); IList<Instruction> allInstructions; IList<ExceptionHandler> allExceptionHandlers; blocks.getCode(out allInstructions, out allExceptionHandlers); DotNetUtils.restoreBody(method, allInstructions, allExceptionHandlers); if (numRemovedLocals > 0) Log.v("Removed {0} unused local(s)", numRemovedLocals); int numRemovedInstructions = oldNumInstructions - method.Body.Instructions.Count; if (numRemovedInstructions > 0) Log.v("Removed {0} dead instruction(s)", numRemovedInstructions); const Log.LogLevel dumpLogLevel = Log.LogLevel.veryverbose; if (Log.isAtLeast(dumpLogLevel)) { Log.log(dumpLogLevel, "Deobfuscated code:"); Log.indent(); methodPrinter.print(dumpLogLevel, allInstructions, allExceptionHandlers); Log.deIndent(); } }
void deobfuscateMethods() { if (savedMethodBodies != null) { savedMethodBodies.restoreAll(); savedMethodBodies = null; } deob.DeobfuscatedFile = null; Log.v("Deobfuscating methods"); var methodPrinter = new MethodPrinter(); var cflowDeobfuscator = new BlocksCflowDeobfuscator { InlineMethods = deob.CanInlineMethods }; foreach (var method in allMethods) { Log.v("Deobfuscating {0} ({1:X8})", method, method.MetadataToken.ToUInt32()); Log.indent(); if (hasNonEmptyBody(method)) { var blocks = new Blocks(method); int numRemovedLocals = 0; int oldNumInstructions = method.Body.Instructions.Count; deob.deobfuscateMethodBegin(blocks); if (options.ControlFlowDeobfuscation) { cflowDeobfuscator.init(blocks); cflowDeobfuscator.deobfuscate(); } if (deob.deobfuscateOther(blocks) && options.ControlFlowDeobfuscation) cflowDeobfuscator.deobfuscate(); if (options.ControlFlowDeobfuscation) { numRemovedLocals = blocks.optimizeLocals(); blocks.repartitionBlocks(); } deobfuscateStrings(blocks); deob.deobfuscateMethodEnd(blocks); IList<Instruction> allInstructions; IList<ExceptionHandler> allExceptionHandlers; blocks.getCode(out allInstructions, out allExceptionHandlers); DotNetUtils.restoreBody(method, allInstructions, allExceptionHandlers); if (numRemovedLocals > 0) Log.v("Removed {0} unused local(s)", numRemovedLocals); int numRemovedInstructions = oldNumInstructions - method.Body.Instructions.Count; if (numRemovedInstructions > 0) Log.v("Removed {0} dead instruction(s)", numRemovedInstructions); const Log.LogLevel dumpLogLevel = Log.LogLevel.veryverbose; if (Log.isAtLeast(dumpLogLevel)) { Log.log(dumpLogLevel, "Deobfuscated code:"); Log.indent(); methodPrinter.print(dumpLogLevel, method, allInstructions, allExceptionHandlers); Log.deIndent(); } } removeNoInliningAttribute(method); Log.deIndent(); } }