public void Decrypt(ResourceDecrypter resourceDecrypter, ISimpleDeobfuscator simpleDeobfuscator) { if (decryptMethod == null) { return; } resource = CoUtils.GetResource(module, decrypterCctor); if (resource == null) { return; } var decrypted = resourceDecrypter.Decrypt(resource.GetResourceStream()); var reader = MemoryImageStream.Create(decrypted); int numEncrypted = reader.ReadInt32(); Logger.v("Restoring {0} encrypted methods", numEncrypted); Logger.Instance.Indent(); for (int i = 0; i < numEncrypted; i++) { int delegateTypeToken = reader.ReadInt32(); uint codeOffset = reader.ReadUInt32(); var origOffset = reader.Position; reader.Position = codeOffset; Decrypt(reader, delegateTypeToken, simpleDeobfuscator); reader.Position = origOffset; } Logger.Instance.DeIndent(); }
public void Initialize(ResourceDecrypter resourceDecrypter) { if (decrypterType == null) { return; } encryptedResource = CoUtils.GetResource(module, DotNetUtils.GetCodeStrings(decrypterType.FindStaticConstructor())); encryptedResource.Data.Position = 0; constantsData = resourceDecrypter.Decrypt(encryptedResource.Data.CreateStream()); }
public void Initialize(ResourceDecrypter resourceDecrypter) { if (decryptedData != null || stringDecrypterType == null) return; var resourceName = GetResourceName(); stringResource = DotNetUtils.GetResource(module, resourceName) as EmbeddedResource; if (stringResource == null) return; Logger.v("Adding string decrypter. Resource: {0}", Utils.ToCsharpString(stringResource.Name)); decryptedData = resourceDecrypter.Decrypt(stringResource.GetResourceStream()); }
public void Initialize(ResourceDecrypter resourceDecrypter) { if (decryptedData != null || stringDecrypterType == null) { return; } var resourceName = GetResourceName(); stringResource = DotNetUtils.GetResource(module, resourceName) as EmbeddedResource; if (stringResource == null) { return; } Logger.v("Adding string decrypter. Resource: {0}", Utils.ToCsharpString(stringResource.Name)); decryptedData = resourceDecrypter.Decrypt(stringResource.GetResourceStream()); }
public EmbeddedResource MergeResources() { if (mergedIt) { return(null); } var resource = DotNetUtils.GetResource(module, GetResourceNames()) as EmbeddedResource; if (resource == null) { return(null); } DeobUtils.DecryptAndAddResources(module, resource.Name.String, () => resourceDecrypter.Decrypt(resource.CreateReader().AsStream())); mergedIt = true; return(resource); }
public void Initialize(ResourceDecrypter resourceDecrypter) { if (decrypterType == null) { return; } var cctor = decrypterType.FindStaticConstructor(); encryptedResource = CoUtils.GetResource(module, DotNetUtils.GetCodeStrings(cctor)); //if the return value is null, it is possible that resource name is encrypted if (encryptedResource == null) { var Resources = new string[] { CoUtils.DecryptResourceName(module, cctor) }; encryptedResource = CoUtils.GetResource(module, Resources); } constantsData = resourceDecrypter.Decrypt(encryptedResource.GetReader().AsStream()); }
public void Initialize(ResourceDecrypter resourceDecrypter) { if (decrypterType == null) return; encryptedResource = CoUtils.GetResource(module, DotNetUtils.GetCodeStrings(decrypterType.FindStaticConstructor())); encryptedResource.Data.Position = 0; constantsData = resourceDecrypter.Decrypt(encryptedResource.Data.CreateStream()); }
void DumpEmbeddedFile(EmbeddedResource resource, string assemblyName, string extension, string reason) { DeobfuscatedFile.CreateAssemblyFile(resourceDecrypter.Decrypt(resource.GetResourceStream()), Utils.GetAssemblySimpleName(assemblyName), extension); AddResourceToBeRemoved(resource, reason); }
public void Decrypt(ResourceDecrypter resourceDecrypter, ISimpleDeobfuscator simpleDeobfuscator) { if (decryptMethod == null) return; resource = CoUtils.GetResource(module, decrypterCctor); if (resource == null) return; var decrypted = resourceDecrypter.Decrypt(resource.GetResourceStream()); var reader = MemoryImageStream.Create(decrypted); int numEncrypted = reader.ReadInt32(); Logger.v("Restoring {0} encrypted methods", numEncrypted); Logger.Instance.Indent(); for (int i = 0; i < numEncrypted; i++) { int delegateTypeToken = reader.ReadInt32(); uint codeOffset = reader.ReadUInt32(); var origOffset = reader.Position; reader.Position = codeOffset; Decrypt(reader, delegateTypeToken, simpleDeobfuscator); reader.Position = origOffset; } Logger.Instance.DeIndent(); }
public void Initialize(ResourceDecrypter resourceDecrypter) { if (decrypterType == null) return; MethodDef cctor = decrypterType.FindStaticConstructor(); encryptedResource = CoUtils.GetResource(module, DotNetUtils.GetCodeStrings(cctor)); //if the return value is null, it is possible that resource name is encrypted if (encryptedResource == null) { var Resources = new string[] { CoUtils.DecryptResourceName(module, cctor) }; encryptedResource = CoUtils.GetResource(module, Resources); } encryptedResource.Data.Position = 0; constantsData = resourceDecrypter.Decrypt(encryptedResource.Data.CreateStream()); }