本文整理汇总了C#中ISimpleDeobfuscator类的典型用法代码示例。如果您正苦于以下问题：C# ISimpleDeobfuscator类的具体用法？C# ISimpleDeobfuscator怎么用？C# ISimpleDeobfuscator使用的例子？那么恭喜您, 这里精选的类代码示例或许可以为您提供帮助。
ISimpleDeobfuscator类属于命名空间，在下文中一共展示了ISimpleDeobfuscator类的20个代码示例，这些例子默认根据受欢迎程度排序。您可以为喜欢或者感觉有用的代码点赞，您的评价将有助于我们的系统推荐出更棒的C#代码示例。
示例1: findEmbeddedResource
public static EmbeddedResource findEmbeddedResource(ModuleDefinition module, TypeDefinition decrypterType, ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
{
return findEmbeddedResource(module, decrypterType, (method) => {
simpleDeobfuscator.deobfuscate(method);
simpleDeobfuscator.decryptStrings(method, deob);
});
}
开发者ID:Joelone，项目名称:de4dot，代码行数:7，代码来源:BabelUtils.cs
示例2: find
public void find(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
{
foreach (var type in module.Types) {
if (type.Fields.Count != 1)
continue;
if (type.HasNestedTypes || type.HasGenericParameters || type.IsValueType)
continue;
if (DotNetUtils.getField(type, "System.Reflection.Assembly") == null)
continue;
if (DotNetUtils.getMethod(type, ".cctor") == null)
continue;
var getStream2 = getTheOnlyMethod(type, "System.IO.Stream", "(System.Reflection.Assembly,System.Type,System.String)");
var getNames = getTheOnlyMethod(type, "System.String[]", "(System.Reflection.Assembly)");
if (getStream2 == null && getNames == null)
continue;
var resource = findGetManifestResourceStreamTypeResource(type, simpleDeobfuscator, deob);
if (resource == null && getStream2 != null)
continue;
getManifestResourceStreamType = type;
getManifestResourceStream1Method = null;
getManifestResourceStream2Method = getStream2;
getManifestResourceNamesMethod = getNames;
getManifestResourceStreamTypeResource = resource;
break;
}
}
开发者ID:ByteCatcher，项目名称:de4dot，代码行数:29，代码来源:GetManifestResourceRestorer.cs
示例3: Find
public void Find(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) {
foreach (var type in module.Types) {
if (type.Fields.Count != 1)
continue;
if (type.HasNestedTypes || type.HasGenericParameters || type.IsValueType)
continue;
if (DotNetUtils.GetField(type, "System.Reflection.Assembly") == null)
continue;
if (type.FindStaticConstructor() == null)
continue;
var getStream2 = GetTheOnlyMethod(type, "System.IO.Stream", "(System.Reflection.Assembly,System.Type,System.String)");
var getNames = GetTheOnlyMethod(type, "System.String[]", "(System.Reflection.Assembly)");
var getRefAsms = GetTheOnlyMethod(type, "System.Reflection.AssemblyName[]", "(System.Reflection.Assembly)");
var bitmapCtor = GetTheOnlyMethod(type, "System.Drawing.Bitmap", "(System.Type,System.String)");
var iconCtor = GetTheOnlyMethod(type, "System.Drawing.Icon", "(System.Type,System.String)");
if (getStream2 == null && getNames == null && getRefAsms == null &&
bitmapCtor == null && iconCtor == null)
continue;
var resource = FindGetManifestResourceStreamTypeResource(type, simpleDeobfuscator, deob);
if (resource == null && getStream2 != null)
continue;
getManifestResourceStreamType = type;
CreateGetManifestResourceStream2(getStream2);
CreateGetManifestResourceNames(getNames);
CreateGetReferencedAssemblies(getRefAsms);
CreateBitmapCtor(bitmapCtor);
CreateIconCtor(iconCtor);
getManifestResourceStreamTypeResource = resource;
break;
}
}
开发者ID:SAD1992，项目名称:justdecompile-plugins，代码行数:34，代码来源:ResourceMethodsRestorer.cs
示例4: ResolverBase
public ResolverBase(ModuleDefinition module, ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
{
this.module = module;
this.frameworkType = DotNetUtils.getFrameworkType(module);
this.simpleDeobfuscator = simpleDeobfuscator;
this.deob = deob;
}
开发者ID:huliang，项目名称:de4dot，代码行数:7，代码来源:ResolverBase.cs
示例5: CheckMethod
bool CheckMethod(ISimpleDeobfuscator simpleDeobfuscator, MethodDef method) {
if (method == null || method.Body == null)
return false;
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode.Code != Code.Call)
continue;
var calledMethod = instr.Operand as MethodDef;
if (calledMethod == null)
continue;
if (calledMethod == null || !calledMethod.IsStatic)
continue;
if (!DotNetUtils.IsMethod(calledMethod, "System.Void", "()"))
continue;
var type = calledMethod.DeclaringType;
if (type.NestedTypes.Count > 0)
continue;
simpleDeobfuscator.Deobfuscate(calledMethod, SimpleDeobfuscatorFlags.Force | SimpleDeobfuscatorFlags.DisableConstantsFolderExtraInstrs);
if (CheckType(type, calledMethod)) {
initMethod = calledMethod;
return true;
}
}
return false;
}
开发者ID:ximing-kooboo，项目名称:de4dot，代码行数:26，代码来源:AntiDumping.cs
示例6: find
public void find(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
{
if (checkInitMethod(DotNetUtils.getModuleTypeCctor(module), simpleDeobfuscator, deob))
return;
if (checkInitMethod(module.EntryPoint, simpleDeobfuscator, deob))
return;
}
开发者ID:GodLesZ，项目名称:ConfuserDeobfuscator，代码行数:7，代码来源:LibAssemblyResolver.cs
示例7: ResolverInfoBase
public ResolverInfoBase(ModuleDefinition module, ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
{
this.module = module;
this.simpleDeobfuscator = simpleDeobfuscator;
this.deob = deob;
findTypes();
}
开发者ID:ostuda，项目名称:de4dot，代码行数:7，代码来源:ResolverInfoBase.cs
示例8: Initialize
public void Initialize(byte[] fileData, ISimpleDeobfuscator simpleDeobfuscator) {
if (encryptedResource.Method == null)
return;
this.fileData = fileData;
encryptedResource.Initialize(simpleDeobfuscator);
if (!encryptedResource.FoundResource)
return;
Logger.v("Adding boolean decrypter. Resource: {0}", Utils.ToCsharpString(encryptedResource.Resource.Name));
decryptedData = encryptedResource.Decrypt();
}
开发者ID:SAD1992，项目名称:justdecompile-plugins，代码行数:12，代码来源:BooleanDecrypter.cs
示例9: Find
public void Find(ISimpleDeobfuscator simpleDeobfuscator) {
var cctor = DotNetUtils.GetModuleTypeCctor(module);
if (cctor == null)
return;
foreach (var method in DotNetUtils.GetCalledMethods(module, cctor)) {
if (method.Name == ".cctor" || method.Name == ".ctor")
continue;
if (!method.IsStatic || !DotNetUtils.IsMethod(method, "System.Void", "()"))
continue;
if (CheckType(method.DeclaringType, method, simpleDeobfuscator))
break;
}
}
开发者ID:RafaelRMachado，项目名称:de4dot，代码行数:14，代码来源:AssemblyResolver.cs
示例10: FindGetManifestResourceStreamTypeResource
EmbeddedResource FindGetManifestResourceStreamTypeResource(TypeDef type, ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) {
foreach (var method in type.Methods) {
if (!method.IsPrivate || !method.IsStatic || method.Body == null)
continue;
if (!DotNetUtils.IsMethod(method, "System.String", "(System.Reflection.Assembly,System.Type,System.String)"))
continue;
simpleDeobfuscator.Deobfuscate(method);
simpleDeobfuscator.DecryptStrings(method, deob);
foreach (var s in DotNetUtils.GetCodeStrings(method)) {
var resource = DotNetUtils.GetResource(module, s) as EmbeddedResource;
if (resource != null)
return resource;
}
}
return null;
}
开发者ID:SAD1992，项目名称:justdecompile-plugins，代码行数:16，代码来源:ResourceMethodsRestorer.cs
示例11: Find
void Find(ISimpleDeobfuscator simpleDeobfuscator) {
switch (frameworkType) {
case FrameworkType.Silverlight:
FindSilverlight();
break;
case FrameworkType.Desktop:
case FrameworkType.CompactFramework:
if (!module.IsClr1x) {
if (FindDesktopOrCompactFramework())
break;
}
FindDesktopOrCompactFrameworkV1();
break;
}
InitializeHeaderInfo(simpleDeobfuscator);
}
开发者ID:RafaelRMachado，项目名称:de4dot，代码行数:18，代码来源:ResourceDecrypter.cs
示例12: checkInitMethod
bool checkInitMethod(MethodDef checkMethod, ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob)
{
var requiredFields = new string[] {
"System.Collections.Hashtable",
"System.Boolean",
};
foreach (var method in DotNetUtils.getCalledMethods(module, checkMethod)) {
if (method.Body == null)
continue;
if (!method.IsStatic)
continue;
if (!DotNetUtils.isMethod(method, "System.Void", "()"))
continue;
var type = method.DeclaringType;
if (!new FieldTypes(type).exactly(requiredFields))
continue;
var ctor = type.FindMethod(".ctor");
if (ctor == null)
continue;
var handler = DeobUtils.getResolveMethod(ctor);
if (handler == null)
continue;
simpleDeobfuscator.decryptStrings(handler, deob);
var resourcePrefix = getResourcePrefix(handler);
if (resourcePrefix == null)
continue;
for (int i = 0; ; i++) {
var resource = DotNetUtils.getResource(module, resourcePrefix + i.ToString("D5")) as EmbeddedResource;
if (resource == null)
break;
resources.Add(resource);
}
initMethod = method;
return true;
}
return false;
}
开发者ID:GodLesZ，项目名称:ConfuserDeobfuscator，代码行数:42，代码来源:LibAssemblyResolver.cs
示例13: RestoreMethodBodies
void RestoreMethodBodies(ISimpleDeobfuscator simpleDeobfuscator) {
var methodToOrigMethods = new MethodDefAndDeclaringTypeDict<List<MethodDef>>();
foreach (var t in module.Types) {
var types = new List<TypeDef>(AllTypesHelper.Types(new List<TypeDef> { t }));
foreach (var type in types) {
if (methodsTypes.Find(type))
continue;
foreach (var method in type.Methods) {
if (method.Name == ".ctor" || method.Name == ".cctor")
continue;
MethodDef calledMethod;
if (!CheckRestoreBody(method, out calledMethod))
continue;
if (!CheckSameMethods(method, calledMethod))
continue;
if (!methodsTypes.Find(calledMethod.DeclaringType))
continue;
if (types.IndexOf(calledMethod.DeclaringType) < 0)
continue;
var list = methodToOrigMethods.Find(calledMethod);
if (list == null)
methodToOrigMethods.Add(calledMethod, list = new List<MethodDef>());
list.Add(method);
}
}
}
foreach (var calledMethod in methodToOrigMethods.GetKeys()) {
var list = methodToOrigMethods.Find(calledMethod);
var method = list[0];
Logger.v("Restored method body {0:X8} from method {1:X8}",
method.MDToken.ToInt32(),
calledMethod.MDToken.ToInt32());
DotNetUtils.CopyBodyFromTo(calledMethod, method);
classMethods.Add(calledMethod, method);
simpleDeobfuscator.MethodModified(method);
}
}
开发者ID:SAD1992，项目名称:justdecompile-plugins，代码行数:41，代码来源:SpicesMethodCallInliner.cs
示例14: Initialize
void Initialize(ISimpleDeobfuscator simpleDeobfuscator, MethodDef method) {
var desList = new List<byte[]>(2);
var aesList = new List<byte[]>(2);
var instructions = method.Body.Instructions;
simpleDeobfuscator.Deobfuscate(method);
for (int i = 0; i <= instructions.Count - 2; i++) {
var ldtoken = instructions[i];
if (ldtoken.OpCode.Code != Code.Ldtoken)
continue;
var field = DotNetUtils.GetField(module, ldtoken.Operand as IField);
if (field == null)
continue;
if (field.InitialValue == null)
continue;
var call = instructions[i + 1];
if (call.OpCode.Code != Code.Call)
continue;
var calledMethod = call.Operand as IMethod;
if (!DotNetUtils.IsMethod(calledMethod, "System.Void", "(System.Array,System.RuntimeFieldHandle)"))
continue;
if (field.InitialValue.Length == 8)
desList.Add(field.InitialValue);
else if (field.InitialValue.Length == 16)
aesList.Add(field.InitialValue);
}
if (desList.Count >= 2) {
DES_Key = desList[desList.Count - 2];
DES_IV = desList[desList.Count - 1];
}
if (aesList.Count >= 2) {
AES_Key = aesList[aesList.Count - 2];
AES_IV = aesList[aesList.Count - 1];
}
}
开发者ID:SAD1992，项目名称:justdecompile-plugins，代码行数:38，代码来源:ResourceDecrypterInfo.cs
示例15: Find
public void Find(ISimpleDeobfuscator simpleDeobfuscator) {
var additionalTypes = new string[] {
"System.String",
};
foreach (var type in module.Types) {
if (type.BaseType == null || type.BaseType.FullName != "System.Object")
continue;
if (!CheckFields(type.Fields))
continue;
foreach (var method in type.Methods) {
if (!method.IsStatic || !method.HasBody)
continue;
if (!DotNetUtils.IsMethod(method, "System.Reflection.Assembly", "(System.Object,System.ResolveEventArgs)") &&
!DotNetUtils.IsMethod(method, "System.Reflection.Assembly", "(System.Object,System.Object)"))
continue;
if (!encryptedResource.CouldBeResourceDecrypter(method, additionalTypes, false))
continue;
encryptedResource.Method = method;
return;
}
}
}
开发者ID:SAD1992，项目名称:justdecompile-plugins，代码行数:23，代码来源:ResourceResolver.cs
示例16: CheckType
bool CheckType(TypeDef type, MethodDef initMethod, ISimpleDeobfuscator simpleDeobfuscator) {
if (DotNetUtils.FindFieldType(type, "System.Collections.Hashtable", true) == null)
return false;
simpleDeobfuscator.Deobfuscate(initMethod);
if (!CheckInitMethod(initMethod))
return false;
if ((asmSeparator = FindAssemblySeparator(initMethod)) == null)
return false;
List<AssemblyInfo> newAssemblyInfos = null;
foreach (var s in DotNetUtils.GetCodeStrings(initMethod)) {
newAssemblyInfos = InitializeEmbeddedAssemblies(s);
if (newAssemblyInfos != null)
break;
}
if (newAssemblyInfos == null)
return false;
resolverType = type;
resolverMethod = initMethod;
assemblyInfos = newAssemblyInfos;
return true;
}
开发者ID:RafaelRMachado，项目名称:de4dot，代码行数:23，代码来源:AssemblyResolver.cs
示例17: FindStringDecrypterMethods
void FindStringDecrypterMethods(TypeDef type, ISimpleDeobfuscator simpleDeobfuscator) {
foreach (var method in DotNetUtils.FindMethods(type.Methods, "System.String", new string[] { "System.String", "System.Int32" })) {
if (method.Body.HasExceptionHandlers)
continue;
if (DotNetUtils.GetMethodCalls(method, "System.Char[] System.String::ToCharArray()") != 1)
continue;
if (DotNetUtils.GetMethodCalls(method, "System.String System.String::Intern(System.String)") != 1)
continue;
simpleDeobfuscator.Deobfuscate(method);
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count - 3; i++) {
var ldarg = instrs[i];
if (!ldarg.IsLdarg() || ldarg.GetParameterIndex() != 0)
continue;
var callvirt = instrs[i + 1];
if (callvirt.OpCode.Code != Code.Callvirt)
continue;
var calledMethod = callvirt.Operand as MemberRef;
if (calledMethod == null || calledMethod.FullName != "System.Char[] System.String::ToCharArray()")
continue;
var stloc = instrs[i + 2];
if (!stloc.IsStloc())
continue;
var ldci4 = instrs[i + 3];
if (!ldci4.IsLdcI4())
continue;
var info = new StringDecrypterInfo(method, ldci4.GetLdcI4Value());
stringDecrypterMethods.Add(info.method, info);
Logger.v("Found string decrypter method: {0}, magic: 0x{1:X8}", Utils.RemoveNewlines(info.method), info.magic);
break;
}
}
}
开发者ID:GreenDamTan，项目名称:de4dot，代码行数:36，代码来源:StringDecrypter.cs
示例18: FindStringsResource
bool FindStringsResource(IDeobfuscator deob, ISimpleDeobfuscator simpleDeobfuscator, MethodDef cctor) {
if (stringsResource != null)
return true;
if (decrypterVersion <= StringDecrypterVersion.V3) {
stringsResource = DotNetUtils.GetResource(module, (module.Mvid ?? Guid.NewGuid()).ToString("B")) as EmbeddedResource;
if (stringsResource != null)
return true;
}
if (FindStringsResource2(deob, simpleDeobfuscator, cctor))
return true;
if (FindStringsResource2(deob, simpleDeobfuscator, stringDecrypterMethod))
return true;
return false;
}
开发者ID:GreenDamTan，项目名称:de4dot，代码行数:17，代码来源:StringDecrypterInfo.cs
示例19: ResourceDecrypter
public ResourceDecrypter(ModuleDefMD module, ISimpleDeobfuscator simpleDeobfuscator) {
this.module = module;
frameworkType = DotNetUtils.GetFrameworkType(module);
Find(simpleDeobfuscator);
}
开发者ID:RafaelRMachado，项目名称:de4dot，代码行数:5，代码来源:ResourceDecrypter.cs
示例20: UpdateFlags
bool UpdateFlags(MethodDef method, ISimpleDeobfuscator simpleDeobfuscator) {
if (method == null || method.Body == null || method.Body.Variables.Count < 3)
return false;
var constants = new List<int>();
simpleDeobfuscator.Deobfuscate(method);
var instructions = method.Body.Instructions;
for (int i = 2; i < instructions.Count; i++) {
var and = instructions[i];
if (and.OpCode.Code != Code.And)
continue;
var ldci4 = instructions[i - 1];
if (!ldci4.IsLdcI4())
continue;
int flagValue = ldci4.GetLdcI4Value();
if (!IsFlag(flagValue))
continue;
var ldloc = instructions[i - 2];
if (!ldloc.IsLdloc())
continue;
var local = ldloc.GetLocal(method.Body.Variables);
if (local.Type.GetElementType().GetPrimitiveSize() < 0)
continue;
constants.Add(flagValue);
}
int notIndex, skipIndex;
flipFlagsBits = CheckFlipBits(method, out notIndex);
skipBytes = GetHeaderSkipBytes(method, out skipIndex);
skipBeforeFlag = skipIndex < notIndex;
switch (frameworkType) {
case FrameworkType.Desktop:
if (!module.IsClr1x) {
if (constants.Count == 2) {
desEncryptedFlag = (byte)constants[0];
deflatedFlag = (byte)constants[1];
return true;
}
}
if (constants.Count == 1) {
desEncryptedFlag = (byte)constants[0];
return true;
}
break;
case FrameworkType.Silverlight:
if (constants.Count == 1) {
bitwiseNotEncryptedFlag = (byte)constants[0];
return true;
}
break;
case FrameworkType.CompactFramework:
if (constants.Count == 1) {
desEncryptedFlag = (byte)constants[0];
return true;
}
break;
}
return false;
}
开发者ID:RafaelRMachado，项目名称:de4dot，代码行数:63，代码来源:ResourceDecrypter.cs
注：本文中的ISimpleDeobfuscator类示例整理自Github/MSDocs等源码及文档管理平台，相关代码片段筛选自各路编程大神贡献的开源项目，源码版权归原作者所有，传播和使用请参考对应项目的License；未经允许，请勿转载。 |
客服电话
APP下载
官方微信
请发表评论