string GetResourceName() { var defaultName = module.Assembly.Name.String + module.Assembly.Name.String; var cctor = stringDecrypterType.FindStaticConstructor(); if (cctor == null) { return(defaultName); } foreach (var s in DotNetUtils.GetCodeStrings(cctor)) { if (DotNetUtils.GetResource(module, s) != null) { return(s); } try { return(Encoding.UTF8.GetString(Convert.FromBase64String(s))); } catch { string s2 = CoUtils.DecryptResourceName(module, cctor); try { return(Encoding.UTF8.GetString(Convert.FromBase64String(s2))); } catch { } } } return(defaultName); }
public void Decrypt(ResourceDecrypter resourceDecrypter, ISimpleDeobfuscator simpleDeobfuscator) { if (decryptMethod == null) { return; } resource = CoUtils.GetResource(module, decrypterCctor); if (resource == null) { return; } var decrypted = resourceDecrypter.Decrypt(resource.GetResourceStream()); var reader = MemoryImageStream.Create(decrypted); int numEncrypted = reader.ReadInt32(); Logger.v("Restoring {0} encrypted methods", numEncrypted); Logger.Instance.Indent(); for (int i = 0; i < numEncrypted; i++) { int delegateTypeToken = reader.ReadInt32(); uint codeOffset = reader.ReadUInt32(); var origOffset = reader.Position; reader.Position = codeOffset; Decrypt(reader, delegateTypeToken, simpleDeobfuscator); reader.Position = origOffset; } Logger.Instance.DeIndent(); }
public void decrypt(ResourceDecrypter resourceDecrypter) { if (decryptMethod == null) { return; } resource = CoUtils.getResource(module, decrypterCctor); if (resource == null) { return; } var decrypted = resourceDecrypter.decrypt(resource.GetResourceStream()); var reader = new BinaryReader(new MemoryStream(decrypted)); int numEncrypted = reader.ReadInt32(); Log.v("Restoring {0} encrypted methods", numEncrypted); Log.indent(); for (int i = 0; i < numEncrypted; i++) { int delegateTypeToken = reader.ReadInt32(); uint codeOffset = reader.ReadUInt32(); var origOffset = reader.BaseStream.Position; reader.BaseStream.Position = codeOffset; decrypt(reader, delegateTypeToken); reader.BaseStream.Position = origOffset; } Log.deIndent(); }
public void init(ResourceDecrypter resourceDecrypter) { if (decrypterType == null) { return; } encryptedResource = CoUtils.getResource(module, DotNetUtils.getCodeStrings(DotNetUtils.getMethod(decrypterType, ".cctor"))); constantsData = resourceDecrypter.decrypt(encryptedResource.GetResourceStream()); }
public void init(ResourceDecrypter resourceDecrypter) { if (decrypterType == null) { return; } encryptedResource = CoUtils.getResource(module, DotNetUtils.getCodeStrings(decrypterType.FindStaticConstructor())); encryptedResource.Data.Position = 0; constantsData = resourceDecrypter.decrypt(encryptedResource.Data.CreateStream()); }
public void Initialize(ResourceDecrypter resourceDecrypter) { if (decrypterType == null) { return; } var cctor = decrypterType.FindStaticConstructor(); encryptedResource = CoUtils.GetResource(module, DotNetUtils.GetCodeStrings(cctor)); //if the return value is null, it is possible that resource name is encrypted if (encryptedResource == null) { var Resources = new string[] { CoUtils.DecryptResourceName(module, cctor) }; encryptedResource = CoUtils.GetResource(module, Resources); } constantsData = resourceDecrypter.Decrypt(encryptedResource.GetReader().AsStream()); }