public void Initialize(ResourceDecrypter resourceDecrypter) { if (decryptedData != null || stringDecrypterType == null) return; var resourceName = GetResourceName(); stringResource = DotNetUtils.GetResource(module, resourceName) as EmbeddedResource; if (stringResource == null) return; Logger.v("Adding string decrypter. Resource: {0}", Utils.ToCsharpString(stringResource.Name)); decryptedData = resourceDecrypter.Decrypt(stringResource.GetResourceStream()); }
void dumpEmbeddedFile(EmbeddedResource resource, string assemblyName, string extension, string reason) { DeobfuscatedFile.createAssemblyFile(resourceDecrypter.decrypt(resource.GetResourceStream()), Utils.getAssemblySimpleName(assemblyName), extension); addResourceToBeRemoved(resource, reason); }
public void Decrypt(ResourceDecrypter resourceDecrypter, ISimpleDeobfuscator simpleDeobfuscator) { if (decryptMethod == null) return; resource = CoUtils.GetResource(module, decrypterCctor); if (resource == null) return; var decrypted = resourceDecrypter.Decrypt(resource.GetResourceStream()); var reader = MemoryImageStream.Create(decrypted); int numEncrypted = reader.ReadInt32(); Logger.v("Restoring {0} encrypted methods", numEncrypted); Logger.Instance.Indent(); for (int i = 0; i < numEncrypted; i++) { int delegateTypeToken = reader.ReadInt32(); uint codeOffset = reader.ReadUInt32(); var origOffset = reader.Position; reader.Position = codeOffset; Decrypt(reader, delegateTypeToken, simpleDeobfuscator); reader.Position = origOffset; } Logger.Instance.DeIndent(); }