C# ISimpleDeobfuscator类代码示例

 public static EmbeddedResource findEmbeddedResource(ModuleDefinition module, TypeDefinition decrypterType, ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
 {
     return findEmbeddedResource(module, decrypterType, (method) => {
         simpleDeobfuscator.deobfuscate(method);
         simpleDeobfuscator.decryptStrings(method, deob);
     });
 }

        public void find(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
        {
            foreach (var type in module.Types) {
                if (type.Fields.Count != 1)
                    continue;
                if (type.HasNestedTypes || type.HasGenericParameters || type.IsValueType)
                    continue;
                if (DotNetUtils.getField(type, "System.Reflection.Assembly") == null)
                    continue;
                if (DotNetUtils.getMethod(type, ".cctor") == null)
                    continue;

                var getStream2 = getTheOnlyMethod(type, "System.IO.Stream", "(System.Reflection.Assembly,System.Type,System.String)");
                var getNames = getTheOnlyMethod(type, "System.String[]", "(System.Reflection.Assembly)");
                if (getStream2 == null && getNames == null)
                    continue;

                var resource = findGetManifestResourceStreamTypeResource(type, simpleDeobfuscator, deob);
                if (resource == null && getStream2 != null)
                    continue;

                getManifestResourceStreamType = type;
                getManifestResourceStream1Method = null;
                getManifestResourceStream2Method = getStream2;
                getManifestResourceNamesMethod = getNames;
                getManifestResourceStreamTypeResource = resource;
                break;
            }
        }

		public void Find(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) {
			foreach (var type in module.Types) {
				if (type.Fields.Count != 1)
					continue;
				if (type.HasNestedTypes || type.HasGenericParameters || type.IsValueType)
					continue;
				if (DotNetUtils.GetField(type, "System.Reflection.Assembly") == null)
					continue;
				if (type.FindStaticConstructor() == null)
					continue;

				var getStream2 = GetTheOnlyMethod(type, "System.IO.Stream", "(System.Reflection.Assembly,System.Type,System.String)");
				var getNames = GetTheOnlyMethod(type, "System.String[]", "(System.Reflection.Assembly)");
				var getRefAsms = GetTheOnlyMethod(type, "System.Reflection.AssemblyName[]", "(System.Reflection.Assembly)");
				var bitmapCtor = GetTheOnlyMethod(type, "System.Drawing.Bitmap", "(System.Type,System.String)");
				var iconCtor = GetTheOnlyMethod(type, "System.Drawing.Icon", "(System.Type,System.String)");
				if (getStream2 == null && getNames == null && getRefAsms == null &&
					bitmapCtor == null && iconCtor == null)
					continue;

				var resource = FindGetManifestResourceStreamTypeResource(type, simpleDeobfuscator, deob);
				if (resource == null && getStream2 != null)
					continue;

				getManifestResourceStreamType = type;
				CreateGetManifestResourceStream2(getStream2);
				CreateGetManifestResourceNames(getNames);
				CreateGetReferencedAssemblies(getRefAsms);
				CreateBitmapCtor(bitmapCtor);
				CreateIconCtor(iconCtor);
				getManifestResourceStreamTypeResource = resource;
				break;
			}
		}

 public ResolverBase(ModuleDefinition module, ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
 {
     this.module = module;
     this.frameworkType = DotNetUtils.getFrameworkType(module);
     this.simpleDeobfuscator = simpleDeobfuscator;
     this.deob = deob;
 }

		bool CheckMethod(ISimpleDeobfuscator simpleDeobfuscator, MethodDef method) {
			if (method == null || method.Body == null)
				return false;

			foreach (var instr in method.Body.Instructions) {
				if (instr.OpCode.Code != Code.Call)
					continue;
				var calledMethod = instr.Operand as MethodDef;
				if (calledMethod == null)
					continue;
				if (calledMethod == null || !calledMethod.IsStatic)
					continue;
				if (!DotNetUtils.IsMethod(calledMethod, "System.Void", "()"))
					continue;
				var type = calledMethod.DeclaringType;
				if (type.NestedTypes.Count > 0)
					continue;

				simpleDeobfuscator.Deobfuscate(calledMethod, SimpleDeobfuscatorFlags.Force | SimpleDeobfuscatorFlags.DisableConstantsFolderExtraInstrs);
				if (CheckType(type, calledMethod)) {
					initMethod = calledMethod;
					return true;
				}
			}
			return false;
		}

 public void find(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
 {
     if (checkInitMethod(DotNetUtils.getModuleTypeCctor(module), simpleDeobfuscator, deob))
         return;
     if (checkInitMethod(module.EntryPoint, simpleDeobfuscator, deob))
         return;
 }

 public ResolverInfoBase(ModuleDefinition module, ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
 {
     this.module = module;
     this.simpleDeobfuscator = simpleDeobfuscator;
     this.deob = deob;
     findTypes();
 }

		public void Initialize(byte[] fileData, ISimpleDeobfuscator simpleDeobfuscator) {
			if (encryptedResource.Method == null)
				return;
			this.fileData = fileData;

			encryptedResource.Initialize(simpleDeobfuscator);
			if (!encryptedResource.FoundResource)
				return;

			Logger.v("Adding boolean decrypter. Resource: {0}", Utils.ToCsharpString(encryptedResource.Resource.Name));
			decryptedData = encryptedResource.Decrypt();
		}

		public void Find(ISimpleDeobfuscator simpleDeobfuscator) {
			var cctor = DotNetUtils.GetModuleTypeCctor(module);
			if (cctor == null)
				return;

			foreach (var method in DotNetUtils.GetCalledMethods(module, cctor)) {
				if (method.Name == ".cctor" || method.Name == ".ctor")
					continue;
				if (!method.IsStatic || !DotNetUtils.IsMethod(method, "System.Void", "()"))
					continue;
				if (CheckType(method.DeclaringType, method, simpleDeobfuscator))
					break;
			}
		}

		EmbeddedResource FindGetManifestResourceStreamTypeResource(TypeDef type, ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) {
			foreach (var method in type.Methods) {
				if (!method.IsPrivate || !method.IsStatic || method.Body == null)
					continue;
				if (!DotNetUtils.IsMethod(method, "System.String", "(System.Reflection.Assembly,System.Type,System.String)"))
					continue;
				simpleDeobfuscator.Deobfuscate(method);
				simpleDeobfuscator.DecryptStrings(method, deob);
				foreach (var s in DotNetUtils.GetCodeStrings(method)) {
					var resource = DotNetUtils.GetResource(module, s) as EmbeddedResource;
					if (resource != null)
						return resource;
				}
			}
			return null;
		}

		void Find(ISimpleDeobfuscator simpleDeobfuscator) {
			switch (frameworkType) {
			case FrameworkType.Silverlight:
				FindSilverlight();
				break;

			case FrameworkType.Desktop:
			case FrameworkType.CompactFramework:
				if (!module.IsClr1x) {
					if (FindDesktopOrCompactFramework())
						break;
				}
				FindDesktopOrCompactFrameworkV1();
				break;
			}

			InitializeHeaderInfo(simpleDeobfuscator);
		}

        bool checkInitMethod(MethodDef checkMethod, ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
        {
            var requiredFields = new string[] {
                "System.Collections.Hashtable",
                "System.Boolean",
            };

            foreach (var method in DotNetUtils.getCalledMethods(module, checkMethod)) {
                if (method.Body == null)
                    continue;
                if (!method.IsStatic)
                    continue;
                if (!DotNetUtils.isMethod(method, "System.Void", "()"))
                    continue;

                var type = method.DeclaringType;
                if (!new FieldTypes(type).exactly(requiredFields))
                    continue;
                var ctor = type.FindMethod(".ctor");
                if (ctor == null)
                    continue;
                var handler = DeobUtils.getResolveMethod(ctor);
                if (handler == null)
                    continue;
                simpleDeobfuscator.decryptStrings(handler, deob);
                var resourcePrefix = getResourcePrefix(handler);
                if (resourcePrefix == null)
                    continue;

                for (int i = 0; ; i++) {
                    var resource = DotNetUtils.getResource(module, resourcePrefix + i.ToString("D5")) as EmbeddedResource;
                    if (resource == null)
                        break;
                    resources.Add(resource);
                }

                initMethod = method;
                return true;
            }

            return false;
        }

		void RestoreMethodBodies(ISimpleDeobfuscator simpleDeobfuscator) {
			var methodToOrigMethods = new MethodDefAndDeclaringTypeDict<List<MethodDef>>();
			foreach (var t in module.Types) {
				var types = new List<TypeDef>(AllTypesHelper.Types(new List<TypeDef> { t }));
				foreach (var type in types) {
					if (methodsTypes.Find(type))
						continue;
					foreach (var method in type.Methods) {
						if (method.Name == ".ctor" || method.Name == ".cctor")
							continue;

						MethodDef calledMethod;
						if (!CheckRestoreBody(method, out calledMethod))
							continue;
						if (!CheckSameMethods(method, calledMethod))
							continue;
						if (!methodsTypes.Find(calledMethod.DeclaringType))
							continue;
						if (types.IndexOf(calledMethod.DeclaringType) < 0)
							continue;

						var list = methodToOrigMethods.Find(calledMethod);
						if (list == null)
							methodToOrigMethods.Add(calledMethod, list = new List<MethodDef>());
						list.Add(method);
					}
				}
			}

			foreach (var calledMethod in methodToOrigMethods.GetKeys()) {
				var list = methodToOrigMethods.Find(calledMethod);
				var method = list[0];

				Logger.v("Restored method body {0:X8} from method {1:X8}",
							method.MDToken.ToInt32(),
							calledMethod.MDToken.ToInt32());
				DotNetUtils.CopyBodyFromTo(calledMethod, method);
				classMethods.Add(calledMethod, method);
				simpleDeobfuscator.MethodModified(method);
			}
		}

		void Initialize(ISimpleDeobfuscator simpleDeobfuscator, MethodDef method) {
			var desList = new List<byte[]>(2);
			var aesList = new List<byte[]>(2);

			var instructions = method.Body.Instructions;
			simpleDeobfuscator.Deobfuscate(method);
			for (int i = 0; i <= instructions.Count - 2; i++) {
				var ldtoken = instructions[i];
				if (ldtoken.OpCode.Code != Code.Ldtoken)
					continue;
				var field = DotNetUtils.GetField(module, ldtoken.Operand as IField);
				if (field == null)
					continue;
				if (field.InitialValue == null)
					continue;

				var call = instructions[i + 1];
				if (call.OpCode.Code != Code.Call)
					continue;
				var calledMethod = call.Operand as IMethod;
				if (!DotNetUtils.IsMethod(calledMethod, "System.Void", "(System.Array,System.RuntimeFieldHandle)"))
					continue;

				if (field.InitialValue.Length == 8)
					desList.Add(field.InitialValue);
				else if (field.InitialValue.Length == 16)
					aesList.Add(field.InitialValue);
			}

			if (desList.Count >= 2) {
				DES_Key = desList[desList.Count - 2];
				DES_IV  = desList[desList.Count - 1];
			}
			if (aesList.Count >= 2) {
				AES_Key = aesList[aesList.Count - 2];
				AES_IV  = aesList[aesList.Count - 1];
			}
		}

		public void Find(ISimpleDeobfuscator simpleDeobfuscator) {
			var additionalTypes = new string[] {
				"System.String",
			};
			foreach (var type in module.Types) {
				if (type.BaseType == null || type.BaseType.FullName != "System.Object")
					continue;
				if (!CheckFields(type.Fields))
					continue;
				foreach (var method in type.Methods) {
					if (!method.IsStatic || !method.HasBody)
						continue;
					if (!DotNetUtils.IsMethod(method, "System.Reflection.Assembly", "(System.Object,System.ResolveEventArgs)") &&
						!DotNetUtils.IsMethod(method, "System.Reflection.Assembly", "(System.Object,System.Object)"))
						continue;
					if (!encryptedResource.CouldBeResourceDecrypter(method, additionalTypes, false))
						continue;

					encryptedResource.Method = method;
					return;
				}
			}
		}