public abstract MethodBodyHeader Decrypt(MethodInfo methodInfo, out byte[] code, out byte[] extraSections);
public override MethodBodyHeader Decrypt(MethodInfo methodInfo, out byte[] code, out byte[] extraSections) { byte[] data = peImage.OffsetReadBytes(endOfMetadata + methodInfo.codeOffs, (int)methodInfo.codeSize); int numQwords = (int)(methodInfo.codeSize / 8); for (int i = 0; i < numQwords; i++) { int offset = i * 8; uint q0 = ReadUInt32_be(data, offset); uint q1 = ReadUInt32_be(data, offset + 4); const uint magic = 0x9E3779B8; uint val = 0xC6EF3700; // magic * 0x20 for (int j = 0; j < 32; j++) { q1 -= ((q0 << 4) + key[2]) ^ (val + q0) ^ ((q0 >> 5) + key[3]); q0 -= ((q1 << 4) + key[0]) ^ (val + q1) ^ ((q1 >> 5) + key[1]); val -= magic; } WriteUInt32_be(data, offset, q0); WriteUInt32_be(data, offset + 4, q1); } return GetCodeBytes(data, out code, out extraSections); }
public override MethodBodyHeader Decrypt(MethodInfo methodInfo, out byte[] code, out byte[] extraSections) { peImage.Reader.Position = endOfMetadata + methodInfo.codeOffs; return MethodBodyParser.ParseMethodBody(peImage.Reader, out code, out extraSections); }
public override MethodBodyHeader Decrypt(MethodInfo methodInfo, out byte[] code, out byte[] extraSections) { byte[] data = peImage.OffsetReadBytes(endOfMetadata + methodInfo.codeOffs, (int)methodInfo.codeSize); for (int i = 0; i < data.Length; i++) { byte b = data[i]; b ^= codeHeader.decryptionKey[(methodInfo.codeOffs - codeHeaderSize + i) % 16]; b ^= codeHeader.decryptionKey[(methodInfo.codeOffs - codeHeaderSize + i + 7) % 16]; data[i] = b; } return GetCodeBytes(data, out code, out extraSections); }
public override MethodBodyHeader decrypt(MethodInfo methodInfo, out byte[] code, out byte[] extraSections) { peImage.Reader.Position = peImage.rvaToOffset(methodInfo.codeOffs); return MethodBodyParser.parseMethodBody(peImage.Reader, out code, out extraSections); }