本文整理汇总了C#中IDeobfuscator类的典型用法代码示例。如果您正苦于以下问题：C# IDeobfuscator类的具体用法？C# IDeobfuscator怎么用？C# IDeobfuscator使用的例子？那么恭喜您, 这里精选的类代码示例或许可以为您提供帮助。
IDeobfuscator类属于命名空间，在下文中一共展示了IDeobfuscator类的15个代码示例，这些例子默认根据受欢迎程度排序。您可以为喜欢或者感觉有用的代码点赞，您的评价将有助于系统推荐出更棒的C#代码示例。
示例1: Find
public void Find(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) {
foreach (var type in module.Types) {
if (type.Fields.Count != 1)
continue;
if (type.HasNestedTypes || type.HasGenericParameters || type.IsValueType)
continue;
if (DotNetUtils.GetField(type, "System.Reflection.Assembly") == null)
continue;
if (type.FindStaticConstructor() == null)
continue;
var getStream2 = GetTheOnlyMethod(type, "System.IO.Stream", "(System.Reflection.Assembly,System.Type,System.String)");
var getNames = GetTheOnlyMethod(type, "System.String[]", "(System.Reflection.Assembly)");
var getRefAsms = GetTheOnlyMethod(type, "System.Reflection.AssemblyName[]", "(System.Reflection.Assembly)");
var bitmapCtor = GetTheOnlyMethod(type, "System.Drawing.Bitmap", "(System.Type,System.String)");
var iconCtor = GetTheOnlyMethod(type, "System.Drawing.Icon", "(System.Type,System.String)");
if (getStream2 == null && getNames == null && getRefAsms == null &&
bitmapCtor == null && iconCtor == null)
continue;
var resource = FindGetManifestResourceStreamTypeResource(type, simpleDeobfuscator, deob);
if (resource == null && getStream2 != null)
continue;
getManifestResourceStreamType = type;
CreateGetManifestResourceStream2(getStream2);
CreateGetManifestResourceNames(getNames);
CreateGetReferencedAssemblies(getRefAsms);
CreateBitmapCtor(bitmapCtor);
CreateIconCtor(iconCtor);
getManifestResourceStreamTypeResource = resource;
break;
}
}示例2: ResolverInfoBase
public ResolverInfoBase(ModuleDefinition module, ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
{
this.module = module;
this.simpleDeobfuscator = simpleDeobfuscator;
this.deob = deob;
findTypes();
}示例3: find
public void find(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
{
if (checkInitMethod(DotNetUtils.getModuleTypeCctor(module), simpleDeobfuscator, deob))
return;
if (checkInitMethod(module.EntryPoint, simpleDeobfuscator, deob))
return;
}示例4: find
public void find(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
{
foreach (var type in module.Types) {
if (type.Fields.Count != 1)
continue;
if (type.HasNestedTypes || type.HasGenericParameters || type.IsValueType)
continue;
if (DotNetUtils.getField(type, "System.Reflection.Assembly") == null)
continue;
if (DotNetUtils.getMethod(type, ".cctor") == null)
continue;
var getStream2 = getTheOnlyMethod(type, "System.IO.Stream", "(System.Reflection.Assembly,System.Type,System.String)");
var getNames = getTheOnlyMethod(type, "System.String[]", "(System.Reflection.Assembly)");
if (getStream2 == null && getNames == null)
continue;
var resource = findGetManifestResourceStreamTypeResource(type, simpleDeobfuscator, deob);
if (resource == null && getStream2 != null)
continue;
getManifestResourceStreamType = type;
getManifestResourceStream1Method = null;
getManifestResourceStream2Method = getStream2;
getManifestResourceNamesMethod = getNames;
getManifestResourceStreamTypeResource = resource;
break;
}
}示例5: findEmbeddedResource
public static EmbeddedResource findEmbeddedResource(ModuleDefinition module, TypeDefinition decrypterType, ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
{
return findEmbeddedResource(module, decrypterType, (method) => {
simpleDeobfuscator.deobfuscate(method);
simpleDeobfuscator.decryptStrings(method, deob);
});
}示例6: ResolverBase
public ResolverBase(ModuleDefinition module, ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
{
this.module = module;
this.frameworkType = DotNetUtils.getFrameworkType(module);
this.simpleDeobfuscator = simpleDeobfuscator;
this.deob = deob;
}示例7: FindGetManifestResourceStreamTypeResource
EmbeddedResource FindGetManifestResourceStreamTypeResource(TypeDef type, ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) {
foreach (var method in type.Methods) {
if (!method.IsPrivate || !method.IsStatic || method.Body == null)
continue;
if (!DotNetUtils.IsMethod(method, "System.String", "(System.Reflection.Assembly,System.Type,System.String)"))
continue;
simpleDeobfuscator.Deobfuscate(method);
simpleDeobfuscator.DecryptStrings(method, deob);
foreach (var s in DotNetUtils.GetCodeStrings(method)) {
var resource = DotNetUtils.GetResource(module, s) as EmbeddedResource;
if (resource != null)
return resource;
}
}
return null;
}示例8: checkInitMethod
bool checkInitMethod(MethodDef checkMethod, ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
{
var requiredFields = new string[] {
"System.Collections.Hashtable",
"System.Boolean",
};
foreach (var method in DotNetUtils.getCalledMethods(module, checkMethod)) {
if (method.Body == null)
continue;
if (!method.IsStatic)
continue;
if (!DotNetUtils.isMethod(method, "System.Void", "()"))
continue;
var type = method.DeclaringType;
if (!new FieldTypes(type).exactly(requiredFields))
continue;
var ctor = type.FindMethod(".ctor");
if (ctor == null)
continue;
var handler = DeobUtils.getResolveMethod(ctor);
if (handler == null)
continue;
simpleDeobfuscator.decryptStrings(handler, deob);
var resourcePrefix = getResourcePrefix(handler);
if (resourcePrefix == null)
continue;
for (int i = 0; ; i++) {
var resource = DotNetUtils.getResource(module, resourcePrefix + i.ToString("D5")) as EmbeddedResource;
if (resource == null)
break;
resources.Add(resource);
}
initMethod = method;
return true;
}
return false;
}示例9: Initialize
public void Initialize(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) {
if (decrypterType == null)
return;
encryptedResource = BabelUtils.FindEmbeddedResource(module, decrypterType, simpleDeobfuscator, deob);
if (encryptedResource == null) {
Logger.w("Could not find encrypted constants resource");
return;
}
var decrypted = resourceDecrypter.Decrypt(encryptedResource.Data.ReadAllBytes());
var reader = new BinaryReader(new MemoryStream(decrypted));
int count;
count = reader.ReadInt32();
decryptedInts = new int[count];
while (count-- > 0)
decryptedInts[count] = reader.ReadInt32();
count = reader.ReadInt32();
decryptedLongs = new long[count];
while (count-- > 0)
decryptedLongs[count] = reader.ReadInt64();
count = reader.ReadInt32();
decryptedFloats = new float[count];
while (count-- > 0)
decryptedFloats[count] = reader.ReadSingle();
count = reader.ReadInt32();
decryptedDoubles = new double[count];
while (count-- > 0)
decryptedDoubles[count] = reader.ReadDouble();
}示例10: FindStringsResource2
bool FindStringsResource2(IDeobfuscator deob, ISimpleDeobfuscator simpleDeobfuscator, MethodDef initMethod) {
if (initMethod == null)
return false;
stringsResource = FindStringResource(initMethod);
if (stringsResource != null)
return true;
simpleDeobfuscator.DecryptStrings(initMethod, deob);
stringsResource = FindStringResource(initMethod);
if (stringsResource != null)
return true;
return false;
}示例11: Initialize
public bool Initialize(IDeobfuscator deob, ISimpleDeobfuscator simpleDeobfuscator) {
var cctor = stringsEncodingClass.FindStaticConstructor();
if (cctor != null)
simpleDeobfuscator.Deobfuscate(cctor);
decrypterVersion = GuessVersion(cctor);
if (!FindDecrypterMethod())
throw new ApplicationException("Could not find string decrypter method");
if (!FindStringsResource(deob, simpleDeobfuscator, cctor))
return false;
if (decrypterVersion <= StringDecrypterVersion.V3) {
MethodDef initMethod;
if (decrypterVersion == StringDecrypterVersion.V3)
initMethod = cctor;
else if (decrypterVersion == StringDecrypterVersion.V2)
initMethod = stringDecrypterMethod;
else
initMethod = stringDecrypterMethod;
stringOffset = 0;
if (decrypterVersion != StringDecrypterVersion.V1) {
if (CallsGetPublicKeyToken(initMethod)) {
var pkt = PublicKeyBase.ToPublicKeyToken(module.Assembly.PublicKeyToken);
if (!PublicKeyBase.IsNullOrEmpty2(pkt)) {
for (int i = 0; i < pkt.Data.Length - 1; i += 2)
stringOffset ^= ((int)pkt.Data[i] << 8) + pkt.Data[i + 1];
}
}
if (DeobUtils.HasInteger(initMethod, 0xFFFFFF) &&
DeobUtils.HasInteger(initMethod, 0xFFFF)) {
stringOffset ^= ((stringDecrypterMethod.MDToken.ToInt32() & 0xFFFFFF) - 1) % 0xFFFF;
}
}
}
else {
var offsetVal = FindOffsetValue(cctor);
if (offsetVal == null)
throw new ApplicationException("Could not find string offset");
stringOffset = offsetVal.Value;
decrypterVersion = StringDecrypterVersion.V4;
}
simpleZipTypeMethod = FindSimpleZipTypeMethod(cctor) ?? FindSimpleZipTypeMethod(stringDecrypterMethod);
if (simpleZipTypeMethod != null)
resourceDecrypter = new ResourceDecrypter(new ResourceDecrypterInfo(module, simpleZipTypeMethod, simpleDeobfuscator));
return true;
}示例12: initializeInfos
bool initializeInfos(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
{
if (handlerMethod == null)
return true;
foreach (var method in resolverType.Methods) {
if (!method.IsStatic || method.Body == null)
continue;
if (!DotNetUtils.isMethod(method, "System.Void", "()"))
continue;
if (!DeobUtils.hasInteger(method, ':') || !DeobUtils.hasInteger(method, '|'))
continue;
simpleDeobfuscator.deobfuscate(method);
simpleDeobfuscator.decryptStrings(method, deob);
if (!initializeInfos(method))
continue;
return true;
}
return false;
}示例13: detectObfuscator
void detectObfuscator(IEnumerable<IDeobfuscator> deobfuscators)
{
// The deobfuscators may call methods to deobfuscate control flow and decrypt
// strings (statically) in order to detect the obfuscator.
if (!options.ControlFlowDeobfuscation || options.StringDecrypterType == DecrypterType.None)
savedMethodBodies = new SavedMethodBodies();
// It's not null if it unpacked a native file
if (this.deob != null) {
deob.init(module);
deob.DeobfuscatedFile = this;
deob.earlyDetect();
deob.detect();
return;
}
foreach (var deob in deobfuscators) {
deob.init(module);
deob.DeobfuscatedFile = this;
}
if (options.ForcedObfuscatorType != null) {
foreach (var deob in deobfuscators) {
if (string.Equals(options.ForcedObfuscatorType, deob.Type, StringComparison.OrdinalIgnoreCase)) {
deob.earlyDetect();
this.deob = deob;
deob.detect();
return;
}
}
}
else {
this.deob = earlyDetectObfuscator(deobfuscators);
if (this.deob == null)
this.deob = detectObfuscator2(deobfuscators);
else
this.deob.detect();
}
}示例14: initialize
public void initialize(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
{
if (methodsDecrypter == null)
return;
encryptedResource = BabelUtils.findEmbeddedResource(module, methodsDecrypter, simpleDeobfuscator, deob);
if (encryptedResource == null) {
Log.w("Could not find encrypted methods resource");
return;
}
addImageReader("", new ResourceDecrypter(module).decrypt(encryptedResource.GetResourceData()));
}示例15: ResolverInfoBase
public ResolverInfoBase(ModuleDefMD module, ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
{
this.module = module;
this.simpleDeobfuscator = simpleDeobfuscator;
this.deob = deob;
}