本文整理汇总了C#中de4dot.blocks.Blocks类的典型用法代码示例。如果您正苦于以下问题：C# Blocks类的具体用法？C# Blocks怎么用？C# Blocks使用的例子？那么恭喜您, 这里精选的类代码示例或许可以为您提供帮助。
Blocks类属于de4dot.blocks命名空间，在下文中一共展示了Blocks类的15个代码示例，这些例子默认根据受欢迎程度排序。您可以为喜欢或者感觉有用的代码点赞，您的评价将有助于系统推荐出更棒的C#代码示例。
示例1: deobfuscate
public bool deobfuscate(Blocks blocks)
{
if (blocks.Method.Name != ".cctor" && blocks.Method.Name != ".ctor")
return false;
foreach (var block in blocks.MethodBlocks.getAllBlocks()) {
var instrs = block.Instructions;
for (int i = 0; i < instrs.Count - 2; i++) {
var ldtoken = instrs[i];
if (ldtoken.OpCode.Code != Code.Ldtoken)
continue;
var call1 = instrs[i + 1];
if (call1.OpCode.Code != Code.Call && call1.OpCode.Code != Code.Callvirt)
continue;
if (!DotNetUtils.isMethod(call1.Operand as IMethod, "System.Type", "(System.RuntimeTypeHandle)"))
continue;
var call2 = instrs[i + 2];
if (call2.OpCode.Code != Code.Call && call2.OpCode.Code != Code.Callvirt)
continue;
if (!MethodEqualityComparer.CompareDeclaringTypes.Equals(call2.Operand as IMethod, strongNameCheckMethod))
continue;
block.remove(i, 3);
return true;
}
}
return false;
}示例2: ParseBody
public void ParseBody()
{
var blocks = new Blocks(Method).MethodBlocks.GetAllBlocks();
foreach (var blockAnalyzer in blocks.Select(block => new BlockAnalyzer(block)))
Expressions.AddRange(blockAnalyzer.GenerateExpressions());
}示例3: deobfuscate
public void deobfuscate(Blocks blocks)
{
foreach (var block in blocks.MethodBlocks.getAllBlocks()) {
var instrs = block.Instructions;
for (int i = 0; i < instrs.Count; i++) {
var call = instrs[i];
if (call.OpCode.Code != Code.Call)
continue;
var calledMethod = call.Operand as MethodDefinition;
if (calledMethod == null)
continue;
MethodReference newMethod = null;
if (calledMethod == getManifestResourceStream1Method)
newMethod = Assembly_GetManifestResourceStream1;
else if (calledMethod == getManifestResourceStream2Method)
newMethod = Assembly_GetManifestResourceStream2;
else if (calledMethod == getManifestResourceNamesMethod)
newMethod = Assembly_GetManifestResourceNames;
if (newMethod == null)
continue;
instrs[i] = new Instr(Instruction.Create(OpCodes.Callvirt, newMethod));
}
}
}示例4: remove
public bool remove(Blocks blocks)
{
if (antiStrongNameMethod == null)
return false;
Block antiSnBlock;
int numInstructions;
if (!findBlock(blocks, out antiSnBlock, out numInstructions))
return false;
if (antiSnBlock.FallThrough == null || antiSnBlock.Targets == null || antiSnBlock.Targets.Count != 1)
throw new ApplicationException("Invalid state");
var goodBlock = antiSnBlock.Targets[0];
var badBlock = antiSnBlock.FallThrough;
antiSnBlock.replaceLastInstrsWithBranch(numInstructions, goodBlock);
if (badBlock.FallThrough == badBlock && badBlock.Sources.Count == 1 && badBlock.Targets == null) {
badBlock.Parent.removeGuaranteedDeadBlock(badBlock);
return true;
}
if (badBlock.Instructions.Count <= 1 && badBlock.LastInstr.OpCode.Code == Code.Nop) {
if (badBlock.FallThrough != null && badBlock.Targets == null && badBlock.Sources.Count == 0) {
var badBlock2 = badBlock.FallThrough;
if (badBlock2.FallThrough == badBlock2 && badBlock2.Sources.Count == 2 && badBlock2.Targets == null) {
badBlock.Parent.removeGuaranteedDeadBlock(badBlock);
badBlock2.Parent.removeGuaranteedDeadBlock(badBlock2);
return true;
}
}
}
throw new ApplicationException("Invalid state");
}示例5: Deobfuscate
public void Deobfuscate(Blocks blocks) {
if (type == null)
return;
foreach (var block in blocks.MethodBlocks.GetAllBlocks()) {
var instrs = block.Instructions;
for (int i = 0; i < instrs.Count - 1; i++) {
var instr = instrs[i];
if (instr.OpCode.Code != Code.Ldc_I4)
continue;
var call = instrs[i + 1];
if (call.OpCode.Code != Code.Call)
continue;
var method = call.Operand as IMethod;
if (method == null)
continue;
if (!new SigComparer().Equals(type, method.DeclaringType))
continue;
var methodDef = DotNetUtils.GetMethod(module, method);
if (methodDef == null)
continue;
if (methodDef != typeMethod && methodDef != fieldMethod)
continue;
uint token = (uint)(int)instrs[i].Operand;
instrs[i] = new Instr(OpCodes.Nop.ToInstruction());
instrs[i + 1] = new Instr(new Instruction(OpCodes.Ldtoken, module.ResolveToken(token) as ITokenOperand));
}
}
}示例6: deobfuscate
public void deobfuscate(Blocks blocks)
{
foreach (var block in blocks.MethodBlocks.getAllBlocks()) {
var instrs = block.Instructions;
for (int i = 0; i < instrs.Count; i++) {
var instr = instrs[i];
if (instr.OpCode.Code == Code.Call || instr.OpCode.Code == Code.Callvirt) {
if (blocks.Method.DeclaringType == decrypterType)
continue;
var calledMethod = instr.Operand as MethodReference;
if (calledMethod != null && calledMethod.DeclaringType == decrypterType)
canRemoveType = false;
}
else if (instr.OpCode.Code == Code.Ldsfld) {
if (instr.OpCode.Code != Code.Ldsfld)
continue;
var field = instr.Operand as FieldReference;
if (field == null)
continue;
var decrypted = fieldToDecryptedString.find(field);
if (decrypted == null)
continue;
instrs[i] = new Instr(Instruction.Create(OpCodes.Ldstr, decrypted));
Log.v("Decrypted string: {0}", Utils.toCsharpString(decrypted));
}
}
}
}示例7: deobfuscate
public void deobfuscate(Blocks blocks)
{
if (type == null)
return;
foreach (var block in blocks.MethodBlocks.getAllBlocks()) {
var instrs = block.Instructions;
for (int i = 0; i < instrs.Count - 1; i++) {
var instr = instrs[i];
if (instr.OpCode.Code != Code.Ldc_I4)
continue;
var call = instrs[i + 1];
if (call.OpCode.Code != Code.Call)
continue;
var method = call.Operand as MethodReference;
if (method == null)
continue;
if (!MemberReferenceHelper.compareTypes(type, method.DeclaringType))
continue;
var methodDef = DotNetUtils.getMethod(module, method);
if (methodDef == null)
continue;
if (methodDef != typeMethod && methodDef != fieldMethod)
continue;
int token = (int)instrs[i].Operand;
instrs[i] = new Instr(Instruction.Create(OpCodes.Nop));
instrs[i + 1] = new Instr(new Instruction(OpCodes.Ldtoken, module.LookupToken(token) as MemberReference));
}
}
}示例8: cleanUp
public IEnumerable<FieldDef> cleanUp()
{
var removedFields = new List<FieldDef>();
var moduleCctor = DotNetUtils.getModuleTypeCctor(module);
if (moduleCctor == null)
return removedFields;
var moduleCctorBlocks = new Blocks(moduleCctor);
var keep = findFieldsToKeep();
foreach (var fieldInfo in fieldToInfo.getValues()) {
if (keep.ContainsKey(fieldInfo))
continue;
if (removeInitCode(moduleCctorBlocks, fieldInfo)) {
removedFields.Add(fieldInfo.field);
removedFields.Add(fieldInfo.arrayInitField);
}
fieldInfo.arrayInitField.InitialValue = new byte[1];
fieldInfo.arrayInitField.FieldSig.Type = module.CorLibTypes.Byte;
fieldInfo.arrayInitField.RVA = 0;
}
IList<Instruction> allInstructions;
IList<ExceptionHandler> allExceptionHandlers;
moduleCctorBlocks.getCode(out allInstructions, out allExceptionHandlers);
DotNetUtils.restoreBody(moduleCctorBlocks.Method, allInstructions, allExceptionHandlers);
return removedFields;
}示例9: deobfuscate
public void deobfuscate(Blocks blocks)
{
foreach (var block in blocks.MethodBlocks.getAllBlocks()) {
var instrs = block.Instructions;
for (int i = 0; i < instrs.Count - 2; i++) {
var ldsfld = instrs[i];
if (ldsfld.OpCode.Code != Code.Ldsfld)
continue;
var ldci4 = instrs[i + 1];
if (!ldci4.isLdcI4())
continue;
var stfld = instrs[i + 2];
if (stfld.OpCode.Code != Code.Stfld)
continue;
var field = stfld.Operand as FieldReference;
if (!MemberReferenceHelper.compareFieldReferenceAndDeclaringType(enumField, field))
continue;
block.remove(i, 3);
i--;
}
}
}示例10: deobfuscate
public void deobfuscate(Blocks blocks)
{
foreach (var block in blocks.MethodBlocks.getAllBlocks()) {
var instrs = block.Instructions;
for (int i = 0; i < instrs.Count - 2; i++) {
var ldsfld = instrs[i];
if (ldsfld.OpCode.Code != Code.Ldsfld)
continue;
var ldci4 = instrs[i + 1];
if (!ldci4.isLdcI4())
continue;
var stfld = instrs[i + 2];
if (stfld.OpCode.Code != Code.Stfld)
continue;
var field = stfld.Operand as IField;
if (!FieldEqualityComparer.CompareDeclaringTypes.Equals(enumField, field))
continue;
block.remove(i, 3);
i--;
}
}
}示例11: deobfuscate
public void deobfuscate(Blocks blocks)
{
var removeInfos = new Dictionary<Block, List<RemoveInfo>>();
var allBlocks = blocks.MethodBlocks.getAllBlocks();
foreach (var block in allBlocks) {
var instrs = block.Instructions;
for (int i = 0; i < instrs.Count; i++) {
var instr = instrs[i];
if (instr.OpCode == OpCodes.Ldsfld) {
var di = getDelegateInfo(instr.Operand as FieldReference);
if (di == null)
continue;
var visited = new Dictionary<Block, bool>();
var callInfo = findProxyCall(di, block, i, visited, 1);
if (callInfo != null) {
add(removeInfos, block, i, null);
add(removeInfos, callInfo.Block, callInfo.Index, di);
}
else {
Log.w("Could not fix proxy call. Method: {0} ({1:X8}), Proxy type: {2} ({3:X8})",
blocks.Method, blocks.Method.MetadataToken.ToInt32(),
di.field.DeclaringType, di.field.DeclaringType.MetadataToken.ToInt32());
}
}
else if (instr.OpCode == OpCodes.Call) {
var method = instr.Operand as MethodDefinition;
if (method == null)
continue;
FieldDefinition field;
if (!proxyMethodToField.TryGetValue(method, out field))
continue;
var di = getDelegateInfo(field);
if (di == null)
continue;
add(removeInfos, block, i, di);
}
}
}
foreach (var block in removeInfos.Keys) {
var list = removeInfos[block];
var removeIndexes = new List<int>(list.Count);
foreach (var info in list) {
if (info.IsCall) {
var opcode = info.DelegateInfo.callOpcode;
var newInstr = Instruction.Create(opcode, info.DelegateInfo.methodRef);
block.replace(info.Index, 1, newInstr);
}
else
removeIndexes.Add(info.Index);
}
block.remove(removeIndexes);
}
fixBrokenCalls(blocks.Method, allBlocks);
}示例12: Remove
public bool Remove(Blocks blocks) {
var allBlocks = blocks.MethodBlocks.GetAllBlocks();
foreach (var block in allBlocks) {
if (Remove(blocks, block))
return true;
}
return false;
}示例13: find
bool find(Blocks blocks, out TryBlock tryBlock)
{
tryBlock = null;
foreach (var bb in blocks.MethodBlocks.BaseBlocks) {
tryBlock = bb as TryBlock;
if (tryBlock == null)
continue;
if (tryBlock.TryHandlerBlocks.Count != 1)
continue;
var catchBlock = tryBlock.TryHandlerBlocks[0];
if (catchBlock.HandlerType != ExceptionHandlerType.Catch ||
catchBlock.CatchType.FullName != "System.Exception") {
continue;
}
if (catchBlock.BaseBlocks.Count != 1)
continue;
var handlerBlock = catchBlock.BaseBlocks[0] as HandlerBlock;
if (handlerBlock == null)
continue;
int calls = 0;
Instr callInstr = null;
bool failed = false;
foreach (var bb2 in handlerBlock.BaseBlocks) {
var block = bb2 as Block;
if (block == null) {
failed = true;
break;
}
foreach (var instr in block.Instructions) {
switch (instr.OpCode.Code) {
case Code.Call:
case Code.Calli:
case Code.Callvirt:
calls++;
callInstr = instr;
break;
}
}
}
if (failed || calls != 1 || callInstr.OpCode.Code != Code.Call)
continue;
var calledMethod = callInstr.Operand as MethodReference;
if (calledMethod == null)
continue;
if (!isExceptionLogger(calledMethod))
continue;
return true;
}
return false;
}示例14: remove
public bool remove(Blocks blocks)
{
if (!HasExceptionLoggers)
return false;
TryBlock tryBlock;
if (!find(blocks, out tryBlock))
return false;
blocks.MethodBlocks.removeTryBlock(tryBlock);
NumRemovedExceptionLoggers++;
return true;
}示例15: FindTamperBlocks
TamperBlocks FindTamperBlocks(Blocks blocks, IList<Block> allBlocks) {
var tamperBlocks = new TamperBlocks();
if (!FindFirstBlocks(tamperBlocks, allBlocks, blocks.Locals))
return null;
var second = tamperBlocks.second;
var badBlock = second.Block.LastInstr.IsBrfalse() ? second.Block.Targets[0] : second.Block.FallThrough;
tamperBlocks.bad = FindBadBlock(badBlock);
if (tamperBlocks.bad == null)
return null;
return tamperBlocks;
}