├── .gitattributes ├── ConfuserEx String Decryptor ├── obj │ └── Debug │ │ ├── ConfuserEx String Decryptor.csproj.CopyComplete │ │ ├── TemporaryGeneratedFile_036C0B5B-1481-4323-8D20-8F5ADCB23D92.cs │ │ ├── TemporaryGeneratedFile_5937a670-0e60-4077-877b-f7221da3dda1.cs │ │ ├── TemporaryGeneratedFile_E7A71F73-0F8D-4B9B-B56E-8E70B10BC5D3.cs │ │ ├── ConfuserEx String Decryptor.csproj.CoreCompileInputs.cache │ │ ├── ConfuserEx String Decryptor.exe │ │ ├── ConfuserEx String Decryptor.pdb │ │ ├── DesignTimeResolveAssemblyReferencesInput.cache │ │ ├── ConfuserEx String Decryptor.csprojAssemblyReference.cache │ │ └── ConfuserEx String Decryptor.csproj.FileListAbsolute.txt ├── bin │ └── Debug │ │ ├── dnlib.dll │ │ ├── dnlib.pdb │ │ ├── SharpDisasm.dll │ │ ├── CawkEmulatorV4.dll │ │ ├── CawkEmulatorV4.pdb │ │ ├── ConfuserEx String Decryptor.exe │ │ ├── ConfuserEx String Decryptor.pdb │ │ └── ConfuserEx String Decryptor.exe.config ├── App.config ├── Program.cs └── Properties │ └── AssemblyInfo.cs ├── .NET-Instruction-Emulator-master ├── CawkEmulatorV4 │ ├── obj │ │ └── Debug │ │ │ ├── CawkEmulatorV4.csproj.CopyComplete │ │ │ ├── TemporaryGeneratedFile_036C0B5B-1481-4323-8D20-8F5ADCB23D92.cs │ │ │ ├── TemporaryGeneratedFile_5937a670-0e60-4077-877b-f7221da3dda1.cs │ │ │ ├── TemporaryGeneratedFile_E7A71F73-0F8D-4B9B-B56E-8E70B10BC5D3.cs │ │ │ ├── CoreCompileInputs.cache │ │ │ ├── CawkEmulatorV4.csproj.CoreCompileInputs.cache │ │ │ ├── CawkEmulatorV4.dll │ │ │ ├── CawkEmulatorV4.pdb │ │ │ ├── CawkEmulatorV4.dll.orig │ │ │ ├── CawkEmulatorV4.instr.pdb │ │ │ ├── CawkEmulatorV4.csprojAssemblyReference.cache │ │ │ ├── DesignTimeResolveAssemblyReferencesInput.cache │ │ │ └── CawkEmulatorV4.csprojResolveAssemblyReference.cache │ ├── Instructions │ │ ├── Constants │ │ │ └── LdcI4.cs │ │ ├── Arithmatic │ │ │ ├── Not.cs │ │ │ ├── And.cs │ │ │ ├── Mul.cs │ │ │ ├── Or.cs │ │ │ ├── Shl.cs │ │ │ ├── Xor.cs │ │ │ ├── Div.cs │ │ │ ├── Add.cs │ │ │ ├── Sub.cs │ │ │ ├── Rem.cs │ │ │ └── Shr.cs │ │ ├── Arrays │ │ │ ├── LdelemRef.cs │ │ │ ├── StelemI1.cs │ │ │ ├── Stelem_I4.cs │ │ │ ├── LdelemI4.cs │ │ │ └── LdelemI1.cs │ │ ├── Branches │ │ │ ├── Ceq.cs │ │ │ ├── Cgt.cs │ │ │ ├── Clt.cs │ │ │ ├── Br.cs │ │ │ ├── LEave.cs │ │ │ ├── Beq.cs │ │ │ ├── Bge.cs │ │ │ ├── Bgt.cs │ │ │ ├── Ble.cs │ │ │ ├── Blt.cs │ │ │ ├── Bne.cs │ │ │ ├── BrTrue.cs │ │ │ ├── BrFalse.cs │ │ │ └── Switch.cs │ │ ├── Fields │ │ │ ├── Stsfld.cs │ │ │ └── Ldsfld.cs │ │ ├── Misc │ │ │ ├── Ldlen.cs │ │ │ ├── Localloc.cs │ │ │ ├── Ldobj.cs │ │ │ ├── Ldtoken.cs │ │ │ ├── NewArr.cs │ │ │ ├── CastClass.cs │ │ │ ├── Ldelema.cs │ │ │ ├── IsInst.cs │ │ │ ├── Stobj.cs │ │ │ └── Box.cs │ │ ├── Parameters │ │ │ ├── Ldarg.cs │ │ │ └── Starg.cs │ │ ├── Locals │ │ │ ├── Stloc.cs │ │ │ └── Ldloc.cs │ │ ├── Conv │ │ │ ├── ConvI4.cs │ │ │ ├── ConvI1.cs │ │ │ ├── ConvI2.cs │ │ │ ├── ConvI8.cs │ │ │ └── ConvI.cs │ │ ├── Native │ │ │ ├── MiscExt.cs │ │ │ ├── X86DIV.cs │ │ │ ├── X86NEG.cs │ │ │ ├── X86NOT.cs │ │ │ ├── X86POP.cs │ │ │ ├── X86ADD.cs │ │ │ ├── X86MOV.cs │ │ │ ├── X86SUB.cs │ │ │ ├── X86XOR.cs │ │ │ ├── X86IMUL.cs │ │ │ └── X86Instruction.cs │ │ └── Pointer │ │ │ ├── StindI4.cs │ │ │ ├── StindI1.cs │ │ │ ├── LdindI4.cs │ │ │ ├── LdindI2.cs │ │ │ └── LdindI1.cs │ ├── bin │ │ └── Debug │ │ │ ├── dnlib.dll │ │ │ ├── dnlib.pdb │ │ │ ├── SharpDisasm.dll │ │ │ ├── CawkEmulatorV4.dll │ │ │ └── CawkEmulatorV4.pdb │ ├── ValueStack.cs │ ├── LEave.cs │ └── Properties │ │ └── AssemblyInfo.cs └── RequiredDlls │ └── SharpDisasm.dll ├── dnlib ├── dnlib.snk ├── .gitattributes ├── .gitignore ├── Directory.Build.props ├── Examples │ ├── app.config │ ├── Program.cs │ ├── Properties │ │ └── AssemblyInfo.cs │ ├── Example5.cs │ └── Example1.cs ├── src │ ├── IO │ │ ├── IOExtensions.cs │ │ ├── IFileSection.cs │ │ ├── FileOffset.cs │ │ ├── DataReaderFactoryFactory.cs │ │ ├── FileSection.cs │ │ ├── EmptyDataStream.cs │ │ └── DataStreamFactory.cs │ ├── DotNet │ │ ├── Extensions.cs │ │ ├── Emit │ │ │ ├── Extensions.cs │ │ │ ├── OpCodeType.cs │ │ │ ├── ExceptionHandlerType.cs │ │ │ ├── FlowControl.cs │ │ │ ├── InvalidMethodException.cs │ │ │ ├── StackBehaviour.cs │ │ │ └── ExceptionHandler.cs │ │ ├── Pdb │ │ │ ├── WindowsPdb │ │ │ │ ├── CorSymVarFlag.cs │ │ │ │ └── CustomDebugInfoConstants.cs │ │ │ ├── Portable │ │ │ │ ├── SequencePointConstants.cs │ │ │ │ ├── ListCache.cs │ │ │ │ ├── SymbolVariableImpl.cs │ │ │ │ └── SymbolMethodImpl.cs │ │ │ ├── PdbUtils.cs │ │ │ ├── Symbols │ │ │ │ ├── SymbolNamespace.cs │ │ │ │ ├── SymbolVariable.cs │ │ │ │ ├── SymbolAsyncStepInfo.cs │ │ │ │ ├── SymbolMethod.cs │ │ │ │ ├── SymbolDocument.cs │ │ │ │ └── SymbolSequencePoint.cs │ │ │ ├── Managed │ │ │ │ ├── DbiNamespace.cs │ │ │ │ ├── ModuleStreamType.cs │ │ │ │ ├── MsfStream.cs │ │ │ │ ├── NumericLeaf.cs │ │ │ │ ├── DbiVariable.cs │ │ │ │ ├── PdbException.cs │ │ │ │ └── SymbolReaderFactory.cs │ │ │ ├── PdbFileKind.cs │ │ │ ├── PdbMethod.cs │ │ │ ├── PdbLocalAttributes.cs │ │ │ ├── IMAGE_DEBUG_DIRECTORY.cs │ │ │ ├── Dss │ │ │ │ ├── SymbolNamespaceImpl.cs │ │ │ │ ├── SymbolDocumentWriter.cs │ │ │ │ └── SymbolVariableImpl.cs │ │ │ ├── DataReaderFactoryUtils.cs │ │ │ ├── PdbDocumentConstants.cs │ │ │ ├── SequencePoint.cs │ │ │ ├── CustomDebugInfoGuids.cs │ │ │ └── PdbReaderOptions.cs │ │ ├── MD │ │ │ ├── HeapType.cs │ │ │ ├── StorageFlags.cs │ │ │ ├── CustomDotNetStream.cs │ │ │ ├── MDStreamFlags.cs │ │ │ ├── GuidStream.cs │ │ │ ├── IRowReaders.cs │ │ │ ├── StringsStream.cs │ │ │ ├── PdbStream.cs │ │ │ ├── ComImageFlags.cs │ │ │ ├── USStream.cs │ │ │ └── TableInfo.cs │ │ ├── FileAttributes.cs │ │ ├── EventAttributes.cs │ │ ├── WinMDStatus.cs │ │ ├── Writer │ │ │ ├── ChecksumAlgorithm.cs │ │ │ ├── IHeap.cs │ │ │ ├── Extensions.cs │ │ │ ├── IWriterError.cs │ │ │ ├── RoslynContentIdProvider.cs │ │ │ ├── PortablePdbConstants.cs │ │ │ ├── IModuleWriterListener.cs │ │ │ ├── StrongNameSignature.cs │ │ │ ├── WriterUtils.cs │ │ │ ├── ModuleWriterException.cs │ │ │ ├── IOffsetHeap.cs │ │ │ ├── DataReaderHeap.cs │ │ │ ├── ChunkList.cs │ │ │ ├── ImportAddressTable.cs │ │ │ ├── SerializerMethodContext.cs │ │ │ └── UniqueChunkList.cs │ │ ├── IVariable.cs │ │ ├── ManifestResourceAttributes.cs │ │ ├── ModuleKind.cs │ │ ├── Resources │ │ │ ├── ResourceElement.cs │ │ │ ├── ResourceElementSet.cs │ │ │ ├── UserResourceType.cs │ │ │ └── IResourceData.cs │ │ ├── PropertyAttributes.cs │ │ ├── NullResolver.cs │ │ ├── ParamAttributes.cs │ │ ├── MethodSemanticsAttributes.cs │ │ ├── MemberMDInitializer.cs │ │ ├── MethodOverride.cs │ │ ├── GenericParamAttributes.cs │ │ ├── ITokenResolver.cs │ │ ├── PublicKeyToken.cs │ │ ├── AllTypesHelper.cs │ │ ├── ICustomAttribute.cs │ │ ├── CallingConvention.cs │ │ ├── IDecrypters.cs │ │ ├── RecursionCounter.cs │ │ ├── SecurityAction.cs │ │ ├── SerializationType.cs │ │ ├── MethodImplAttributes.cs │ │ ├── PublicKey.cs │ │ ├── PInvokeAttributes.cs │ │ └── AssemblyHashAlgorithm.cs │ ├── HandleProcessCorruptedStateExceptionsAttribute.cs │ ├── Utils │ │ ├── ILazyList.cs │ │ ├── ArrayEmpty.cs │ │ └── CollectionDebugView.cs │ ├── Threading │ │ └── ICancellationToken.cs │ ├── Settings.cs │ ├── Properties │ │ └── AssemblyInfo.cs │ ├── W32Resources │ │ └── ResourceDirectoryEntry.cs │ ├── DefaultDllImportSearchPathsAttribute.cs │ ├── PE │ │ ├── RVA.cs │ │ ├── IPEType.cs │ │ ├── ImageDosHeader.cs │ │ ├── ImageDebugType.cs │ │ ├── Subsystem.cs │ │ ├── ImageDataDirectory.cs │ │ └── DllCharacteristics.cs │ └── dnlib.netstandard.csproj ├── dnlib.netstandard.sln └── LICENSE.txt ├── .gitmodules └── README.md /.gitattributes: -------------------------------------------------------------------------------- 1 | # Auto detect text files and perform LF normalization 2 | * text=auto 3 | -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/obj/Debug/ConfuserEx String Decryptor.csproj.CopyComplete: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/obj/Debug/CawkEmulatorV4.csproj.CopyComplete: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/obj/Debug/TemporaryGeneratedFile_036C0B5B-1481-4323-8D20-8F5ADCB23D92.cs: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/obj/Debug/TemporaryGeneratedFile_5937a670-0e60-4077-877b-f7221da3dda1.cs: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/obj/Debug/TemporaryGeneratedFile_E7A71F73-0F8D-4B9B-B56E-8E70B10BC5D3.cs: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /dnlib/dnlib.snk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/dnlib/dnlib.snk -------------------------------------------------------------------------------- /dnlib/.gitattributes: -------------------------------------------------------------------------------- 1 | * text=auto 2 | *.cs text diff=csharp 3 | *.sln text eol=crlf 4 | *.csproj text eol=crlf 5 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/obj/Debug/TemporaryGeneratedFile_036C0B5B-1481-4323-8D20-8F5ADCB23D92.cs: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/obj/Debug/TemporaryGeneratedFile_5937a670-0e60-4077-877b-f7221da3dda1.cs: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/obj/Debug/TemporaryGeneratedFile_E7A71F73-0F8D-4B9B-B56E-8E70B10BC5D3.cs: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/obj/Debug/CoreCompileInputs.cache: -------------------------------------------------------------------------------- 1 | 40bbc74c059a2ff4f711df249a1eaa280fac24c1 2 | -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/obj/Debug/ConfuserEx String Decryptor.csproj.CoreCompileInputs.cache: -------------------------------------------------------------------------------- 1 | 75f4aed2e43555e86271069286ca87688c63068b 2 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/obj/Debug/CawkEmulatorV4.csproj.CoreCompileInputs.cache: -------------------------------------------------------------------------------- 1 | 82edcdd5e0cd9074c957ec4684844a6e3d45528b 2 | -------------------------------------------------------------------------------- /dnlib/.gitignore: -------------------------------------------------------------------------------- 1 | *~ 2 | */obj/ 3 | *.csproj.user 4 | *.sdf 5 | *.opensdf 6 | *.suo 7 | /.vs/ 8 | /Debug/ 9 | /Release/ 10 | /Examples/bin/ 11 | *.tmp_proj 12 | -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/bin/Debug/dnlib.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/ConfuserEx String Decryptor/bin/Debug/dnlib.dll -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/bin/Debug/dnlib.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/ConfuserEx String Decryptor/bin/Debug/dnlib.pdb -------------------------------------------------------------------------------- /dnlib/Directory.Build.props: -------------------------------------------------------------------------------- 1 | 2 | 3 | -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/bin/Debug/SharpDisasm.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/ConfuserEx String Decryptor/bin/Debug/SharpDisasm.dll -------------------------------------------------------------------------------- /dnlib/Examples/app.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Constants/LdcI4.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Constants 2 | { 3 | internal class LdcI4 4 | { 5 | } 6 | } -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/bin/Debug/CawkEmulatorV4.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/ConfuserEx String Decryptor/bin/Debug/CawkEmulatorV4.dll -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/bin/Debug/CawkEmulatorV4.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/ConfuserEx String Decryptor/bin/Debug/CawkEmulatorV4.pdb -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/RequiredDlls/SharpDisasm.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/.NET-Instruction-Emulator-master/RequiredDlls/SharpDisasm.dll -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/bin/Debug/dnlib.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/.NET-Instruction-Emulator-master/CawkEmulatorV4/bin/Debug/dnlib.dll -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/bin/Debug/dnlib.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/.NET-Instruction-Emulator-master/CawkEmulatorV4/bin/Debug/dnlib.pdb -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/bin/Debug/ConfuserEx String Decryptor.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/ConfuserEx String Decryptor/bin/Debug/ConfuserEx String Decryptor.exe -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/bin/Debug/ConfuserEx String Decryptor.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/ConfuserEx String Decryptor/bin/Debug/ConfuserEx String Decryptor.pdb -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/obj/Debug/ConfuserEx String Decryptor.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/ConfuserEx String Decryptor/obj/Debug/ConfuserEx String Decryptor.exe -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/obj/Debug/ConfuserEx String Decryptor.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/ConfuserEx String Decryptor/obj/Debug/ConfuserEx String Decryptor.pdb -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/bin/Debug/SharpDisasm.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/.NET-Instruction-Emulator-master/CawkEmulatorV4/bin/Debug/SharpDisasm.dll -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/bin/Debug/CawkEmulatorV4.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/.NET-Instruction-Emulator-master/CawkEmulatorV4/bin/Debug/CawkEmulatorV4.dll -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/bin/Debug/CawkEmulatorV4.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/.NET-Instruction-Emulator-master/CawkEmulatorV4/bin/Debug/CawkEmulatorV4.pdb -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/obj/Debug/CawkEmulatorV4.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/.NET-Instruction-Emulator-master/CawkEmulatorV4/obj/Debug/CawkEmulatorV4.dll -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/obj/Debug/CawkEmulatorV4.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/.NET-Instruction-Emulator-master/CawkEmulatorV4/obj/Debug/CawkEmulatorV4.pdb -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/obj/Debug/CawkEmulatorV4.dll.orig: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/.NET-Instruction-Emulator-master/CawkEmulatorV4/obj/Debug/CawkEmulatorV4.dll.orig -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/obj/Debug/CawkEmulatorV4.instr.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/.NET-Instruction-Emulator-master/CawkEmulatorV4/obj/Debug/CawkEmulatorV4.instr.pdb -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/App.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | -------------------------------------------------------------------------------- /dnlib/src/IO/IOExtensions.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.IO { 4 | /// 5 | /// Extension methods 6 | /// 7 | public static partial class IOExtensions { 8 | } 9 | } 10 | -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/ConfuserEx String Decryptor/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache -------------------------------------------------------------------------------- /dnlib/src/DotNet/Extensions.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet { 4 | /// 5 | /// Extension methods 6 | /// 7 | public static partial class Extensions { 8 | } 9 | } 10 | -------------------------------------------------------------------------------- /.gitmodules: -------------------------------------------------------------------------------- 1 | [submodule "dnlib"] 2 | path = dnlib 3 | url = https://github.com/0xd4d/dnlib.git 4 | [submodule ".NET-Instruction-Emulator"] 5 | path = .NET-Instruction-Emulator 6 | url = https://github.com/cawk-untested/.NET-Instruction-Emulator.git 7 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Emit/Extensions.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Emit { 4 | /// 5 | /// Extension methods 6 | /// 7 | public static partial class Extensions { 8 | } 9 | } 10 | -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/obj/Debug/ConfuserEx String Decryptor.csprojAssemblyReference.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/ConfuserEx String Decryptor/obj/Debug/ConfuserEx String Decryptor.csprojAssemblyReference.cache -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/WindowsPdb/CorSymVarFlag.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet.Pdb.WindowsPdb { 6 | [Flags] 7 | enum CorSymVarFlag : uint { 8 | VAR_IS_COMP_GEN = 0x00000001, 9 | } 10 | } 11 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/obj/Debug/CawkEmulatorV4.csprojAssemblyReference.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/.NET-Instruction-Emulator-master/CawkEmulatorV4/obj/Debug/CawkEmulatorV4.csprojAssemblyReference.cache -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/bin/Debug/ConfuserEx String Decryptor.exe.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/.NET-Instruction-Emulator-master/CawkEmulatorV4/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/WindowsPdb/CustomDebugInfoConstants.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Pdb.WindowsPdb { 4 | static class CustomDebugInfoConstants { 5 | public const int Version = 4; 6 | public const int RecordVersion = 4; 7 | } 8 | } 9 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/Portable/SequencePointConstants.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Pdb.Portable { 4 | static class SequencePointConstants { 5 | public const int HIDDEN_LINE = 0xFEEFEE; 6 | public const int HIDDEN_COLUMN = 0; 7 | } 8 | } 9 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/obj/Debug/CawkEmulatorV4.csprojResolveAssemblyReference.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Loksie/ConfuserEx-Static-String-Decryptor/HEAD/.NET-Instruction-Emulator-master/CawkEmulatorV4/obj/Debug/CawkEmulatorV4.csprojResolveAssemblyReference.cache -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/PdbUtils.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Pdb { 4 | static class PdbUtils { 5 | public static bool IsEndInclusive(PdbFileKind pdbFileKind, Compiler compiler) => 6 | pdbFileKind == PdbFileKind.WindowsPDB && compiler == Compiler.VisualBasic; 7 | } 8 | } 9 | -------------------------------------------------------------------------------- /dnlib/src/HandleProcessCorruptedStateExceptionsAttribute.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace System.Runtime.ExceptionServices { 4 | [AttributeUsage(AttributeTargets.Method, AllowMultiple = false, Inherited = false)] 5 | sealed class HandleProcessCorruptedStateExceptionsAttribute : Attribute { 6 | } 7 | } 8 | -------------------------------------------------------------------------------- /dnlib/Examples/Program.cs: -------------------------------------------------------------------------------- 1 | namespace dnlib.Examples { 2 | class Program { 3 | static void Main(string[] args) { 4 | // Just uncomment whatever you want to debug 5 | // Example1.Run(); 6 | // Example2.Run(); 7 | // Example3.Run(); 8 | // Example4.Run(); 9 | // Example5.Run(); 10 | Example6.Run(); 11 | } 12 | } 13 | } 14 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/Symbols/SymbolNamespace.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Pdb.Symbols { 4 | /// 5 | /// A namespace 6 | /// 7 | public abstract class SymbolNamespace { 8 | /// 9 | /// Gets the name 10 | /// 11 | public abstract string Name { get; } 12 | } 13 | } 14 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/Managed/DbiNamespace.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using dnlib.DotNet.Pdb.Symbols; 4 | 5 | namespace dnlib.DotNet.Pdb.Managed { 6 | sealed class DbiNamespace : SymbolNamespace { 7 | public override string Name => name; 8 | readonly string name; 9 | 10 | public DbiNamespace(string ns) => name = ns; 11 | } 12 | } 13 | -------------------------------------------------------------------------------- /dnlib/src/Utils/ILazyList.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System.Collections.Generic; 4 | 5 | namespace dnlib.Utils { 6 | /// 7 | /// Interface to access a lazily initialized list 8 | /// 9 | /// Type to store in list 10 | interface ILazyList : IList { 11 | } 12 | } 13 | -------------------------------------------------------------------------------- /dnlib/src/Utils/ArrayEmpty.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | // System namespace so it can easily be replaced with Array.Empty later 4 | namespace System { 5 | static class Array2 { 6 | public static T[] Empty() => EmptyClass.Empty; 7 | 8 | static class EmptyClass { 9 | public static readonly T[] Empty = new T[0]; 10 | } 11 | } 12 | } 13 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # ConfuserEx-Static-String-Decryptor 2 | A static String Decryptor Based Off Instruction Emulator 3 | 4 | This string decryptor is an example of how to use my emulator effectively this will decrypt confuserex strings no matter what 5 | protetions are applied aslong as it can find the parameters properly 6 | 7 | simply run the decryptor enter the path to your file and press enter 8 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Arithmatic/Not.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Arithmatic 2 | { 3 | internal class Not 4 | { 5 | public static void Emulate(ValueStack valueStack) 6 | { 7 | var value1 = valueStack.CallStack.Pop(); 8 | 9 | var addedValue = ~ value1; 10 | 11 | valueStack.CallStack.Push(addedValue); 12 | } 13 | } 14 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Arrays/LdelemRef.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Arrays 2 | { 3 | internal class LdelemRef 4 | { 5 | public static void Emulate(ValueStack valueStack) 6 | { 7 | var location = valueStack.CallStack.Pop(); 8 | var array = valueStack.CallStack.Pop(); 9 | valueStack.CallStack.Push(array[location]); 10 | } 11 | } 12 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Branches/Ceq.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Branches 2 | { 3 | internal class Ceq 4 | { 5 | public static void Emulate(ValueStack valueStack) 6 | { 7 | var value2 = valueStack.CallStack.Pop(); 8 | var value1 = valueStack.CallStack.Pop(); 9 | valueStack.CallStack.Push(value2 == value1 ? 1 : 0); 10 | } 11 | } 12 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Branches/Cgt.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Branches 2 | { 3 | internal class Cgt 4 | { 5 | public static void Emulate(ValueStack valueStack) 6 | { 7 | var value2 = valueStack.CallStack.Pop(); 8 | var value1 = valueStack.CallStack.Pop(); 9 | valueStack.CallStack.Push(value1 > value2 ? 1 : 0); 10 | } 11 | } 12 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Branches/Clt.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Branches 2 | { 3 | internal class Clt 4 | { 5 | public static void Emulate(ValueStack valueStack) 6 | { 7 | var value2 = valueStack.CallStack.Pop(); 8 | var value1 = valueStack.CallStack.Pop(); 9 | valueStack.CallStack.Push(value1 < value2 ? 1 : 0); 10 | } 11 | } 12 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Fields/Stsfld.cs: -------------------------------------------------------------------------------- 1 | using dnlib.DotNet; 2 | using dnlib.DotNet.Emit; 3 | 4 | namespace CawkEmulatorV4.Instructions.Fields 5 | { 6 | internal class Stsfld 7 | { 8 | public static void Emulate(ValueStack valueStack, Instruction instruction) 9 | { 10 | valueStack.Fields[instruction.Operand as FieldDef] = valueStack.CallStack.Pop(); 11 | } 12 | } 13 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/Emit/OpCodeType.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Emit { 4 | /// 5 | /// CIL opcode type 6 | /// 7 | public enum OpCodeType : byte { 8 | /// 9 | Annotation, 10 | /// 11 | Macro, 12 | /// 13 | Nternal, 14 | /// 15 | Objmodel, 16 | /// 17 | Prefix, 18 | /// 19 | Primitive, 20 | } 21 | } 22 | -------------------------------------------------------------------------------- /dnlib/src/Threading/ICancellationToken.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.Threading { 6 | /// 7 | /// Cancellation token interface 8 | /// 9 | public interface ICancellationToken { 10 | /// 11 | /// Throws a if the operation should be canceled 12 | /// 13 | void ThrowIfCancellationRequested(); 14 | } 15 | } 16 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Misc/Ldlen.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Misc 2 | { 3 | internal class Ldlen 4 | { 5 | public static void Emulate(ValueStack valueStack) 6 | { 7 | var val = valueStack.CallStack.Pop(); 8 | if (val == null) 9 | valueStack.CallStack.Push(0); 10 | else 11 | valueStack.CallStack.Push(val.Length); 12 | } 13 | } 14 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Arithmatic/And.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Arithmatic 2 | { 3 | internal class And 4 | { 5 | public static void Emulate(ValueStack valueStack) 6 | { 7 | var value1 = valueStack.CallStack.Pop(); 8 | var value2 = valueStack.CallStack.Pop(); 9 | var addedValue = value2 & value1; 10 | valueStack.CallStack.Push(addedValue); 11 | } 12 | } 13 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Arithmatic/Mul.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Arithmatic 2 | { 3 | internal class Mul 4 | { 5 | public static void Emulate(ValueStack valueStack) 6 | { 7 | var value1 = valueStack.CallStack.Pop(); 8 | var value2 = valueStack.CallStack.Pop(); 9 | var addedValue = value2 * value1; 10 | 11 | valueStack.CallStack.Push(addedValue); 12 | } 13 | } 14 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Arithmatic/Or.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Arithmatic 2 | { 3 | internal class Or 4 | { 5 | public static void Emulate(ValueStack valueStack) 6 | { 7 | var value1 = valueStack.CallStack.Pop(); 8 | var value2 = valueStack.CallStack.Pop(); 9 | var addedValue = value2 | value1; 10 | 11 | valueStack.CallStack.Push(addedValue); 12 | } 13 | } 14 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/MD/HeapType.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.MD { 4 | /// 5 | /// Heap type. The values are set in stone by MS. Don't change. 6 | /// 7 | public enum HeapType : uint { 8 | /// #Strings heap 9 | Strings = 0, 10 | /// #GUID heap 11 | Guid = 1, 12 | /// #Blob heap 13 | Blob = 2, 14 | /// #US heap 15 | US = 3, 16 | } 17 | } 18 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Arithmatic/Shl.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Arithmatic 2 | { 3 | internal class Shl 4 | { 5 | public static void Emulate(ValueStack valueStack) 6 | { 7 | var value1 = valueStack.CallStack.Pop(); 8 | var value2 = valueStack.CallStack.Pop(); 9 | var addedValue = value2 << value1; 10 | 11 | valueStack.CallStack.Push(addedValue); 12 | } 13 | } 14 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Arrays/StelemI1.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Arrays 2 | { 3 | internal class StelemI1 4 | { 5 | public static void Emulate(ValueStack valueStack) 6 | { 7 | var value = valueStack.CallStack.Pop(); 8 | var location = valueStack.CallStack.Pop(); 9 | var array = valueStack.CallStack.Pop(); 10 | 11 | array[location] = (byte) value; 12 | } 13 | } 14 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/Managed/ModuleStreamType.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Pdb.Managed { 4 | enum ModuleStreamType : uint { 5 | Symbols = 0xF1, 6 | Lines = 0xF2, 7 | StringTable = 0xF3, 8 | FileInfo = 0xF4, 9 | FrameData = 0xF5, 10 | InlineeLines = 0xF6, 11 | CrossScopeImports = 0xF7, 12 | CrossScopeExports = 0xF8, 13 | ILLines = 0xF9, 14 | FuncMDTokenMap = 0xFA, 15 | TypeMDTokenMap = 0xFB, 16 | MergedAssemblyInput = 0xFC, 17 | } 18 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/PdbFileKind.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Pdb { 4 | /// 5 | /// PDB file kind 6 | /// 7 | public enum PdbFileKind { 8 | /// 9 | /// Windows PDB 10 | /// 11 | WindowsPDB, 12 | 13 | /// 14 | /// Portable PDB 15 | /// 16 | PortablePDB, 17 | 18 | /// 19 | /// Embedded portable PDB 20 | /// 21 | EmbeddedPortablePDB, 22 | } 23 | } 24 | -------------------------------------------------------------------------------- /dnlib/src/Settings.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib { 4 | /// 5 | /// dnlib settings 6 | /// 7 | public static class Settings { 8 | /// 9 | /// true if dnlib is thread safe. (THREAD_SAFE was defined during compilation) 10 | /// 11 | public static bool IsThreadSafe { 12 | get { 13 | #if THREAD_SAFE 14 | return true; 15 | #else 16 | return false; 17 | #endif 18 | } 19 | } 20 | } 21 | } 22 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/FileAttributes.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet { 6 | /// 7 | /// File row flags. See CorHdr.h/CorFileFlags 8 | /// 9 | [Flags] 10 | public enum FileAttributes : uint { 11 | /// This is not a resource file 12 | ContainsMetadata = 0x0000, 13 | /// This is a resource file or other non-metadata-containing file 14 | ContainsNoMetadata = 0x0001, 15 | } 16 | } 17 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/ValueStack.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using dnlib.DotNet; 3 | 4 | namespace CawkEmulatorV4 5 | { 6 | public class ValueStack 7 | { 8 | public Stack CallStack = new Stack(); 9 | public Dictionary Fields = new Dictionary(); 10 | public dynamic[] Locals; 11 | public Dictionary Parameters = new Dictionary(); 12 | } 13 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Parameters/Ldarg.cs: -------------------------------------------------------------------------------- 1 | using dnlib.DotNet; 2 | using dnlib.DotNet.Emit; 3 | 4 | namespace CawkEmulatorV4.Instructions.Parameters 5 | { 6 | internal class Ldarg 7 | { 8 | public static void Emulate(ValueStack valueStack, Instruction instruction, MethodDef methods) 9 | { 10 | var loc = instruction.GetParameter(methods.Parameters); 11 | valueStack.CallStack.Push(valueStack.Parameters[loc]); 12 | } 13 | } 14 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/EventAttributes.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet { 6 | /// 7 | /// Event attributes, see CorHdr.h/CorEventAttr 8 | /// 9 | [Flags] 10 | public enum EventAttributes : ushort { 11 | /// event is special. Name describes how. 12 | SpecialName = 0x0200, 13 | /// Runtime(metadata internal APIs) should check name encoding. 14 | RTSpecialName = 0x0400, 15 | } 16 | } 17 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Branches/Br.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using dnlib.DotNet.Emit; 3 | 4 | namespace CawkEmulatorV4.Instructions.Branches 5 | { 6 | internal class Br 7 | { 8 | public static int Emulate(ValueStack valueStack, Instruction instruction, IList allinstructions) 9 | { 10 | var branchTo = (Instruction)instruction.Operand; 11 | return allinstructions.IndexOf(branchTo) - 1; 12 | } 13 | } 14 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Misc/Localloc.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.InteropServices; 3 | 4 | namespace CawkEmulatorV4.Instructions.Misc 5 | { 6 | internal class Localloc 7 | { 8 | public static void Emulate(ValueStack valueStack) 9 | { 10 | var amount = valueStack.CallStack.Pop(); 11 | IntPtr results = Marshal.AllocHGlobal(amount * IntPtr.Size); 12 | 13 | valueStack.CallStack.Push(results); 14 | } 15 | } 16 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/PdbMethod.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Pdb { 4 | /// 5 | /// A PDB method 6 | /// 7 | public sealed class PdbMethod { 8 | /// 9 | /// Gets/sets the root scope. It contains all scopes of the method, using namespaces, variables and constants 10 | /// 11 | public PdbScope Scope { get; set; } 12 | 13 | /// 14 | /// Constructor 15 | /// 16 | public PdbMethod() { 17 | } 18 | } 19 | } 20 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Locals/Stloc.cs: -------------------------------------------------------------------------------- 1 | using dnlib.DotNet; 2 | using dnlib.DotNet.Emit; 3 | 4 | namespace CawkEmulatorV4.Instructions.Locals 5 | { 6 | internal class Stloc 7 | { 8 | public static void Emulate(ValueStack valueStack, Instruction instruction, MethodDef method) 9 | { 10 | var value = valueStack.CallStack.Pop(); 11 | var loc = instruction.GetLocal(method.Body.Variables); 12 | valueStack.Locals[loc.Index] = value; 13 | } 14 | } 15 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/WinMDStatus.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet { 4 | /// 5 | /// WinMD status 6 | /// 7 | public enum WinMDStatus { 8 | /// 9 | /// This is not a WinMD file 10 | /// 11 | None, 12 | 13 | /// 14 | /// This is a pure WinMD file (not managed) 15 | /// 16 | Pure, 17 | 18 | /// 19 | /// This is a managed WinMD file (created by eg. winmdexp.exe) 20 | /// 21 | Managed, 22 | } 23 | } 24 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Emit/ExceptionHandlerType.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet.Emit { 6 | /// 7 | /// Type of exception handler. See CorHdr.h/CorExceptionFlag 8 | /// 9 | [Flags] 10 | public enum ExceptionHandlerType { 11 | /// 12 | Catch = 0x0000, 13 | /// 14 | Filter = 0x0001, 15 | /// 16 | Finally = 0x0002, 17 | /// 18 | Fault = 0x0004, 19 | /// 20 | Duplicated = 0x0008, 21 | } 22 | } 23 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Emit/FlowControl.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Emit { 4 | /// 5 | /// CIL opcode flow control 6 | /// 7 | public enum FlowControl { 8 | /// 9 | Branch, 10 | /// 11 | Break, 12 | /// 13 | Call, 14 | /// 15 | Cond_Branch, 16 | /// 17 | Meta, 18 | /// 19 | Next, 20 | /// 21 | Phi, 22 | /// 23 | Return, 24 | /// 25 | Throw, 26 | } 27 | } 28 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Writer/ChecksumAlgorithm.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Writer { 4 | /// 5 | /// Checksum algorithm 6 | /// 7 | public enum ChecksumAlgorithm { 8 | /// 9 | /// SHA-1 10 | /// 11 | SHA1, 12 | 13 | /// 14 | /// SHA-256 15 | /// 16 | SHA256, 17 | 18 | /// 19 | /// SHA-384 20 | /// 21 | SHA384, 22 | 23 | /// 24 | /// SHA-512 25 | /// 26 | SHA512, 27 | } 28 | } 29 | -------------------------------------------------------------------------------- /dnlib/src/IO/IFileSection.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.IO { 4 | /// 5 | /// Represents a section in a file 6 | /// 7 | public interface IFileSection { 8 | /// 9 | /// Start offset of the section in the file 10 | /// 11 | FileOffset StartOffset { get; } 12 | 13 | /// 14 | /// End offset of the section in the file. This is one byte after the last 15 | /// valid offset in the section. 16 | /// 17 | FileOffset EndOffset { get; } 18 | } 19 | } 20 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/PdbLocalAttributes.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet.Pdb { 6 | /// 7 | /// Local attributes 8 | /// 9 | [Flags] 10 | public enum PdbLocalAttributes { 11 | /// 12 | /// No bit is set 13 | /// 14 | None = 0, 15 | 16 | /// 17 | /// Local should be hidden in debugger variables windows. Not all compiler generated locals have this flag set. 18 | /// 19 | DebuggerHidden = 0x00000001, 20 | } 21 | } 22 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/IVariable.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet { 4 | /// 5 | /// Interface to access a local or a parameter 6 | /// 7 | public interface IVariable { 8 | /// 9 | /// Gets the variable type 10 | /// 11 | TypeSig Type { get; } 12 | 13 | /// 14 | /// Gets the 0-based position 15 | /// 16 | int Index { get; } 17 | 18 | /// 19 | /// Gets/sets the variable name 20 | /// 21 | string Name { get; set; } 22 | } 23 | } 24 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/ManifestResourceAttributes.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet { 6 | /// 7 | /// ManifestResource flags. See CorHdr.h/CorManifestResourceFlags 8 | /// 9 | [Flags] 10 | public enum ManifestResourceAttributes : uint { 11 | /// 12 | VisibilityMask = 0x0007, 13 | /// The Resource is exported from the Assembly. 14 | Public = 0x0001, 15 | /// The Resource is private to the Assembly. 16 | Private = 0x0002, 17 | } 18 | } 19 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/ModuleKind.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet { 4 | /// 5 | /// Module kind 6 | /// 7 | public enum ModuleKind { 8 | /// 9 | /// Console UI module 10 | /// 11 | Console, 12 | 13 | /// 14 | /// Windows GUI module 15 | /// 16 | Windows, 17 | 18 | /// 19 | /// DLL module 20 | /// 21 | Dll, 22 | 23 | /// 24 | /// Netmodule (it has no assembly manifest) 25 | /// 26 | NetModule, 27 | } 28 | } 29 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Resources/ResourceElement.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Resources { 4 | /// 5 | /// Resource element 6 | /// 7 | public sealed class ResourceElement { 8 | /// 9 | /// Name of resource 10 | /// 11 | public string Name { get; set; } 12 | 13 | /// 14 | /// Data of resource 15 | /// 16 | public IResourceData ResourceData { get; set; } 17 | 18 | /// 19 | public override string ToString() => $"N: {Name}, V: {ResourceData}"; 20 | } 21 | } 22 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Writer/IHeap.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Writer { 4 | /// 5 | /// .NET Heap interface 6 | /// 7 | public interface IHeap : IChunk { 8 | /// 9 | /// Gets the name of the heap 10 | /// 11 | string Name { get; } 12 | 13 | /// 14 | /// Checks whether the heap is empty 15 | /// 16 | bool IsEmpty { get; } 17 | 18 | /// 19 | /// Called when the heap should be set to read-only mode 20 | /// 21 | void SetReadOnly(); 22 | } 23 | } 24 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Conv/ConvI4.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Conv 2 | { 3 | internal class ConvI4 4 | { 5 | public static void Emulation(ValueStack valueStack) 6 | { 7 | var value = valueStack.CallStack.Pop(); 8 | valueStack.CallStack.Push((int) value); 9 | } 10 | 11 | public static void UEmulation(ValueStack valueStack) 12 | { 13 | dynamic value = (uint) valueStack.CallStack.Pop(); 14 | valueStack.CallStack.Push((int) value); 15 | } 16 | } 17 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Arrays/Stelem_I4.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Arrays 2 | { 3 | internal class Stelem_I4 4 | { 5 | public static void Emulate(ValueStack valueStack) 6 | { 7 | var value = valueStack.CallStack.Pop(); 8 | var location = valueStack.CallStack.Pop(); 9 | var array = valueStack.CallStack.Pop(); 10 | if (array is uint[]) 11 | array[location] = (uint) value; 12 | else 13 | array[location] = (int) value; 14 | } 15 | } 16 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/MD/StorageFlags.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet.MD { 6 | /// 7 | /// Storage flags found in the MD header 8 | /// 9 | [Flags] 10 | public enum StorageFlags : byte { 11 | /// 12 | /// Normal flags 13 | /// 14 | Normal = 0, 15 | 16 | /// 17 | /// More data after the header but before the streams. 18 | /// 19 | /// The CLR will fail to load the file if this flag (or any other bits) is set. 20 | ExtraData = 1, 21 | } 22 | } 23 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Conv/ConvI1.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Conv 2 | { 3 | internal class ConvI1 4 | { 5 | public static void Emulation(ValueStack valueStack) 6 | { 7 | dynamic value = (sbyte) valueStack.CallStack.Pop(); 8 | valueStack.CallStack.Push((int) value); 9 | } 10 | 11 | public static void UEmulation(ValueStack valueStack) 12 | { 13 | dynamic value = (byte) valueStack.CallStack.Pop(); 14 | valueStack.CallStack.Push((int) value); 15 | } 16 | } 17 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/PropertyAttributes.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet { 6 | /// 7 | /// Property attributes, see CorHdr.h/CorPropertyAttr 8 | /// 9 | [Flags] 10 | public enum PropertyAttributes : ushort { 11 | /// property is special. Name describes how. 12 | SpecialName = 0x0200, 13 | /// Runtime(metadata internal APIs) should check name encoding. 14 | RTSpecialName = 0x0400, 15 | /// Property has default 16 | HasDefault = 0x1000, 17 | } 18 | } 19 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Conv/ConvI2.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Conv 2 | { 3 | internal class ConvI2 4 | { 5 | public static void Emulation(ValueStack valueStack) 6 | { 7 | dynamic value = (short) valueStack.CallStack.Pop(); 8 | valueStack.CallStack.Push((int) value); 9 | } 10 | 11 | public static void UEmulation(ValueStack valueStack) 12 | { 13 | dynamic value = (ushort) valueStack.CallStack.Pop(); 14 | valueStack.CallStack.Push((int) value); 15 | } 16 | } 17 | } -------------------------------------------------------------------------------- /dnlib/Examples/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection; 2 | using System.Runtime.InteropServices; 3 | 4 | [assembly: AssemblyTitle("dnlib.Examples")] 5 | [assembly: AssemblyDescription("dnlib examples")] 6 | [assembly: AssemblyConfiguration("")] 7 | [assembly: AssemblyCompany("")] 8 | [assembly: AssemblyProduct("dnlib.Examples")] 9 | [assembly: AssemblyCopyright("Copyright (C) 2012-2014 de4dot@gmail.com")] 10 | [assembly: AssemblyTrademark("")] 11 | [assembly: AssemblyCulture("")] 12 | [assembly: ComVisible(false)] 13 | [assembly: AssemblyVersion("1.0.0.0")] 14 | [assembly: AssemblyFileVersion("1.0.0.0")] 15 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/IMAGE_DEBUG_DIRECTORY.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using dnlib.PE; 4 | 5 | namespace dnlib.DotNet.Pdb { 6 | /// 7 | /// IMAGE_DEBUG_DIRECTORY 8 | /// 9 | public struct IMAGE_DEBUG_DIRECTORY { 10 | #pragma warning disable 1591 11 | public uint Characteristics; 12 | public uint TimeDateStamp; 13 | public ushort MajorVersion; 14 | public ushort MinorVersion; 15 | public ImageDebugType Type; 16 | public uint SizeOfData; 17 | public uint AddressOfRawData; 18 | public uint PointerToRawData; 19 | #pragma warning restore 1591 20 | } 21 | } 22 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Native/MiscExt.cs: -------------------------------------------------------------------------------- 1 | using ConfuserDeobfuscator.Engine.Routines.Ex.x86; 2 | using SharpDisasm; 3 | using SharpDisasm.Udis86; 4 | 5 | namespace EasyPredicateKiller 6 | { 7 | public static class MiscExt 8 | { 9 | public static IX86Operand GetOperand(this Operand argument) 10 | { 11 | if (argument.Type == ud_type.UD_OP_IMM) 12 | return 13 | new X86ImmediateOperand((int) argument.Value); 14 | 15 | return new X86RegisterOperand((X86Register) argument.Base); 16 | } 17 | } 18 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Arithmatic/Xor.cs: -------------------------------------------------------------------------------- 1 | using System.IO; 2 | 3 | namespace CawkEmulatorV4.Instructions.Arithmatic 4 | { 5 | internal class Xor 6 | { 7 | public static void Emulate(ValueStack valueStack) 8 | { 9 | var value1 = valueStack.CallStack.Pop(); 10 | var value2 = valueStack.CallStack.Pop(); 11 | var addedValue = value2 ^ value1; 12 | // File.AppendAllText("linesd.txt",addedValue.ToString("X2")+" "+addedValue.GetType()+"\n"); 13 | valueStack.CallStack.Push(addedValue); 14 | } 15 | } 16 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Pointer/StindI4.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | 3 | namespace CawkEmulatorV4.Instructions.Pointer 4 | { 5 | internal class StindI4 6 | { 7 | public static unsafe void Emulate(ValueStack valueStack) 8 | { 9 | var value1 = valueStack.CallStack.Pop(); 10 | var address = valueStack.CallStack.Pop(); 11 | 12 | var ptr = ((IntPtr) address).ToPointer(); 13 | *(int*) ptr = value1; 14 | // Console.WriteLine("GET "+address.ToString("X8") + " Value = " + value.ToString("X8")); 15 | } 16 | } 17 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/Writer/Extensions.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Writer { 4 | /// 5 | /// Extension methods 6 | /// 7 | static partial class Extensions { 8 | /// 9 | /// Write zeros 10 | /// 11 | /// this 12 | /// Number of zeros 13 | public static void WriteZeroes(this DataWriter writer, int count) { 14 | while (count >= 8) { 15 | writer.WriteUInt64(0); 16 | count -= 8; 17 | } 18 | for (int i = 0; i < count; i++) 19 | writer.WriteByte(0); 20 | } 21 | } 22 | } 23 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Conv/ConvI8.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Conv 2 | { 3 | internal class ConvI8 4 | { 5 | public static void Emulation(ValueStack valueStack) 6 | { 7 | var value = valueStack.CallStack.Pop(); 8 | valueStack.CallStack.Push((long) value); 9 | } 10 | 11 | public static void UEmulation(ValueStack valueStack) 12 | { 13 | var value = valueStack.CallStack.Pop(); 14 | var x = unchecked((long) (ulong) value); 15 | 16 | valueStack.CallStack.Push(x); 17 | } 18 | } 19 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/Portable/ListCache.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System.Collections.Generic; 4 | using System.Threading; 5 | 6 | namespace dnlib.DotNet.Pdb.Portable { 7 | static class ListCache { 8 | static volatile List cachedList; 9 | public static List AllocList() => Interlocked.Exchange(ref cachedList, null) ?? new List(); 10 | public static void Free(ref List list) { 11 | list.Clear(); 12 | cachedList = list; 13 | } 14 | public static T[] FreeAndToArray(ref List list) { 15 | var res = list.ToArray(); 16 | Free(ref list); 17 | return res; 18 | } 19 | } 20 | } 21 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/LEave.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using dnlib.DotNet.Emit; 7 | 8 | namespace CawkEmulatorV4.Instructions.Branches 9 | { 10 | class LEave 11 | { 12 | public static int Emulate(ValueStack valueStack, Instruction instruction, IList allinstructions) 13 | { 14 | var branchTo = (Instruction)instruction.Operand; 15 | valueStack.CallStack.Clear(); 16 | return allinstructions.IndexOf(branchTo) - 1; 17 | } 18 | } 19 | } 20 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Writer/IWriterError.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Writer { 4 | /// 5 | /// Gets notified of errors. The default handler should normally throw since the written data 6 | /// will probably be invalid. Any error can be ignored. 7 | /// 8 | public interface IWriterError { 9 | /// 10 | /// Called when an error is detected (eg. a null pointer or other invalid value). The error 11 | /// can be ignored but the written data won't be valid. 12 | /// 13 | /// Error message 14 | void Error(string message); 15 | } 16 | } 17 | -------------------------------------------------------------------------------- /dnlib/src/Utils/CollectionDebugView.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | using System.Collections.Generic; 5 | using System.Diagnostics; 6 | 7 | namespace dnlib.Utils { 8 | sealed class CollectionDebugView { 9 | readonly ICollection list; 10 | public CollectionDebugView(ICollection list) => this.list = list ?? throw new ArgumentNullException(nameof(list)); 11 | 12 | [DebuggerBrowsable(DebuggerBrowsableState.RootHidden)] 13 | public TValue[] Items { 14 | get { 15 | var array = new TValue[list.Count]; 16 | list.CopyTo(array, 0); 17 | return array; 18 | } 19 | } 20 | } 21 | } 22 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Branches/LEave.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using dnlib.DotNet.Emit; 7 | 8 | namespace CawkEmulatorV4.Instructions.Branches 9 | { 10 | class LEave 11 | { 12 | public static int Emulate(ValueStack valueStack, Instruction instruction, IList allinstructions) 13 | { 14 | var branchTo = (Instruction)instruction.Operand; 15 | valueStack.CallStack.Clear(); 16 | return allinstructions.IndexOf(branchTo) - 1; 17 | } 18 | } 19 | } 20 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Conv/ConvI.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | 3 | namespace CawkEmulatorV4.Instructions.Conv 4 | { 5 | internal class ConvI 6 | { 7 | public static void Emulation(ValueStack valueStack) 8 | { 9 | return; 10 | dynamic value = (IntPtr) valueStack.CallStack.Pop(); 11 | valueStack.CallStack.Push((IntPtr) value); 12 | } 13 | 14 | public static void UEmulation(ValueStack valueStack) 15 | { 16 | return; 17 | dynamic value = (UIntPtr) valueStack.CallStack.Pop(); 18 | valueStack.CallStack.Push(value); 19 | } 20 | } 21 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Branches/Beq.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using dnlib.DotNet.Emit; 3 | 4 | namespace CawkEmulatorV4.Instructions.Branches 5 | { 6 | internal class Beq 7 | { 8 | public static int Emulate(ValueStack valueStack, Instruction ins, IList instructions) 9 | { 10 | var value2 = valueStack.CallStack.Pop(); 11 | var value1 = valueStack.CallStack.Pop(); 12 | var branchTo = (Instruction) ins.Operand; 13 | if (value2 == value1) 14 | return instructions.IndexOf(branchTo) - 1; 15 | return -1; 16 | } 17 | } 18 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Branches/Bge.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using dnlib.DotNet.Emit; 3 | 4 | namespace CawkEmulatorV4.Instructions.Branches 5 | { 6 | internal class Bge 7 | { 8 | public static int Emulate(ValueStack valueStack, Instruction ins, IList instructions) 9 | { 10 | var value2 = valueStack.CallStack.Pop(); 11 | var value1 = valueStack.CallStack.Pop(); 12 | var branchTo = (Instruction) ins.Operand; 13 | if (value1 >= value2) 14 | return instructions.IndexOf(branchTo) - 1; 15 | return -1; 16 | } 17 | } 18 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Branches/Bgt.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using dnlib.DotNet.Emit; 3 | 4 | namespace CawkEmulatorV4.Instructions.Branches 5 | { 6 | internal class Bgt 7 | { 8 | public static int Emulate(ValueStack valueStack, Instruction ins, IList instructions) 9 | { 10 | var value2 = valueStack.CallStack.Pop(); 11 | var value1 = valueStack.CallStack.Pop(); 12 | var branchTo = (Instruction) ins.Operand; 13 | if (value1 > value2) 14 | return instructions.IndexOf(branchTo) - 1; 15 | return -1; 16 | } 17 | } 18 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Branches/Ble.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using dnlib.DotNet.Emit; 3 | 4 | namespace CawkEmulatorV4.Instructions.Branches 5 | { 6 | internal class Ble 7 | { 8 | public static int Emulate(ValueStack valueStack, Instruction ins, IList instructions) 9 | { 10 | var value2 = valueStack.CallStack.Pop(); 11 | var value1 = valueStack.CallStack.Pop(); 12 | var branchTo = (Instruction) ins.Operand; 13 | if (value2 <= value1) 14 | return instructions.IndexOf(branchTo) - 1; 15 | return -1; 16 | } 17 | } 18 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Branches/Blt.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using dnlib.DotNet.Emit; 3 | 4 | namespace CawkEmulatorV4.Instructions.Branches 5 | { 6 | internal class Blt 7 | { 8 | public static int Emulate(ValueStack valueStack, Instruction ins, IList instructions) 9 | { 10 | var value2 = valueStack.CallStack.Pop(); 11 | var value1 = valueStack.CallStack.Pop(); 12 | var branchTo = (Instruction) ins.Operand; 13 | if (value1 < value2) 14 | return instructions.IndexOf(branchTo) - 1; 15 | return -1; 16 | } 17 | } 18 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Branches/Bne.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using dnlib.DotNet.Emit; 3 | 4 | namespace CawkEmulatorV4.Instructions.Branches 5 | { 6 | internal class Bne 7 | { 8 | public static int Emulate(ValueStack valueStack, Instruction ins, IList instructions) 9 | { 10 | var value2 = valueStack.CallStack.Pop(); 11 | var value1 = valueStack.CallStack.Pop(); 12 | var branchTo = (Instruction) ins.Operand; 13 | if (value2 != value1) 14 | return instructions.IndexOf(branchTo) - 1; 15 | return -1; 16 | } 17 | } 18 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Misc/Ldobj.cs: -------------------------------------------------------------------------------- 1 | using System.Runtime.InteropServices; 2 | using dnlib.DotNet; 3 | using dnlib.DotNet.Emit; 4 | 5 | namespace CawkEmulatorV4.Instructions.Misc 6 | { 7 | internal class Ldobj 8 | { 9 | public static void Emulate(ValueStack valueStack, Instruction instruction) 10 | { 11 | var type = (ITypeDefOrRef) instruction.Operand; 12 | var typeResolve = typeof(string).Module.GetType(type.ReflectionFullName); 13 | var address = valueStack.CallStack.Pop(); 14 | valueStack.CallStack.Push(Marshal.PtrToStructure(address, typeResolve)); 15 | } 16 | } 17 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Parameters/Starg.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using dnlib.DotNet; 3 | using dnlib.DotNet.Emit; 4 | using Parameter = dnlib.DotNet.Parameter; 5 | 6 | namespace CawkEmulatorV4.Instructions.Parameters 7 | { 8 | internal class Starg 9 | { 10 | public static void Emulate(ValueStack valueStack, Instruction instruction, MethodDef methods) 11 | { 12 | var val = valueStack.CallStack.Pop(); 13 | var type = ((Parameter)instruction.Operand).Type; 14 | 15 | var loc = instruction.GetParameter(methods.Parameters); 16 | valueStack.Parameters[loc] = val; 17 | } 18 | } 19 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/Managed/MsfStream.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | using dnlib.IO; 5 | 6 | namespace dnlib.DotNet.Pdb.Managed { 7 | sealed class MsfStream { 8 | public MsfStream(DataReader[] pages, uint length) { 9 | var buf = new byte[length]; 10 | int offset = 0; 11 | for (int i = 0; i < pages.Length; i++) { 12 | var page = pages[i]; 13 | page.Position = 0; 14 | int len = Math.Min((int)page.Length, (int)(length - offset)); 15 | page.ReadBytes(buf, offset, len); 16 | offset += len; 17 | } 18 | Content = ByteArrayDataReaderFactory.CreateReader(buf); 19 | } 20 | 21 | public DataReader Content; 22 | } 23 | } 24 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/Dss/SymbolNamespaceImpl.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using dnlib.DotNet.Pdb.Symbols; 4 | 5 | namespace dnlib.DotNet.Pdb.Dss { 6 | sealed class SymbolNamespaceImpl : SymbolNamespace { 7 | readonly ISymUnmanagedNamespace ns; 8 | 9 | public SymbolNamespaceImpl(ISymUnmanagedNamespace @namespace) => ns = @namespace; 10 | 11 | public override string Name { 12 | get { 13 | ns.GetName(0, out uint count, null); 14 | var chars = new char[count]; 15 | ns.GetName((uint)chars.Length, out count, chars); 16 | if (chars.Length == 0) 17 | return string.Empty; 18 | return new string(chars, 0, chars.Length - 1); 19 | } 20 | } 21 | } 22 | } 23 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Branches/BrTrue.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using dnlib.DotNet.Emit; 3 | 4 | namespace CawkEmulatorV4.Instructions.Branches 5 | { 6 | internal class BrTrue 7 | { 8 | public static int Emulate(ValueStack valueStack, Instruction ins, IList instructions) 9 | { 10 | var value1 = valueStack.CallStack.Pop(); 11 | if (value1 == null) 12 | value1 = 0; 13 | var branchTo = (Instruction) ins.Operand; 14 | if (value1 is int &&value1 != 0) 15 | return instructions.IndexOf(branchTo) - 1; 16 | 17 | return -1; 18 | } 19 | } 20 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/DataReaderFactoryUtils.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | using System.IO; 5 | using System.Security; 6 | using dnlib.IO; 7 | 8 | namespace dnlib.DotNet.Pdb { 9 | static class DataReaderFactoryUtils { 10 | public static DataReaderFactory TryCreateDataReaderFactory(string filename) { 11 | try { 12 | if (!File.Exists(filename)) 13 | return null; 14 | // Don't use memory mapped I/O 15 | return ByteArrayDataReaderFactory.Create(File.ReadAllBytes(filename), filename); 16 | } 17 | catch (IOException) { 18 | } 19 | catch (UnauthorizedAccessException) { 20 | } 21 | catch (SecurityException) { 22 | } 23 | return null; 24 | } 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Writer/RoslynContentIdProvider.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet.Writer { 6 | static class RoslynContentIdProvider { 7 | public static void GetContentId(byte[] hash, out Guid guid, out uint timestamp) { 8 | if (hash.Length < 20) 9 | throw new InvalidOperationException(); 10 | var guidBytes = new byte[16]; 11 | Array.Copy(hash, 0, guidBytes, 0, guidBytes.Length); 12 | guidBytes[7] = (byte)((guidBytes[7] & 0x0F) | 0x40); 13 | guidBytes[8] = (byte)((guidBytes[8] & 0x3F) | 0x80); 14 | guid = new Guid(guidBytes); 15 | timestamp = 0x80000000 | (uint)((hash[19] << 24) | (hash[18] << 16) | (hash[17] << 8) | hash[16]); 16 | } 17 | } 18 | } 19 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Pointer/StindI1.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace CawkEmulatorV4.Instructions.Pointer 8 | { 9 | class StindI1 10 | { 11 | public static unsafe void Emulate(ValueStack valueStack) 12 | { 13 | var value1 = valueStack.CallStack.Pop(); 14 | var address = valueStack.CallStack.Pop(); 15 | 16 | var ptr = ((IntPtr)address).ToPointer(); 17 | *(sbyte*)ptr = (sbyte)value1; 18 | // Console.WriteLine("GET "+address.ToString("X8") + " Value = " + value.ToString("X8")); 19 | } 20 | } 21 | } 22 | -------------------------------------------------------------------------------- /dnlib/src/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System.Reflection; 4 | using System.Runtime.InteropServices; 5 | 6 | #if THREAD_SAFE 7 | [assembly: AssemblyTitle("dnlib (thread safe)")] 8 | #else 9 | [assembly: AssemblyTitle("dnlib")] 10 | #endif 11 | [assembly: AssemblyDescription(".NET assembly reader/writer")] 12 | [assembly: AssemblyConfiguration("")] 13 | [assembly: AssemblyCompany("")] 14 | [assembly: AssemblyProduct("dnlib")] 15 | [assembly: AssemblyCopyright("Copyright (C) 2012-2018 de4dot@gmail.com")] 16 | [assembly: AssemblyTrademark("")] 17 | [assembly: AssemblyCulture("")] 18 | [assembly: ComVisible(false)] 19 | [assembly: AssemblyVersion("3.0.0.0")] 20 | [assembly: AssemblyFileVersion("3.0.0.0")] 21 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Branches/BrFalse.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using dnlib.DotNet.Emit; 4 | 5 | namespace CawkEmulatorV4.Instructions.Branches 6 | { 7 | internal class BrFalse 8 | { 9 | public static int Emulate(ValueStack valueStack, Instruction ins, IList instructions) 10 | { 11 | var value1 = valueStack.CallStack.Pop(); 12 | if (value1 is bool) 13 | value1 = Convert.ToInt32(value1); 14 | var branchTo = (Instruction) ins.Operand; 15 | if (value1 == 0||value1 == null) 16 | return instructions.IndexOf(branchTo) - 1; 17 | return -1; 18 | } 19 | } 20 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Locals/Ldloc.cs: -------------------------------------------------------------------------------- 1 | using dnlib.DotNet; 2 | using dnlib.DotNet.Emit; 3 | 4 | namespace CawkEmulatorV4.Instructions.Locals 5 | { 6 | internal class Ldloc 7 | { 8 | public static void Emulate(ValueStack valueStack, Instruction instruction, MethodDef method) 9 | { 10 | var loc = instruction.GetLocal(method.Body.Variables); 11 | valueStack.CallStack.Push(valueStack.Locals[loc.Index]); 12 | } 13 | 14 | public static void EmulateLdloca(ValueStack valueStack, Instruction instruction, MethodDef method) 15 | { 16 | var loc = (Local) instruction.Operand; 17 | valueStack.CallStack.Push(valueStack.Locals[loc.Index]); 18 | } 19 | } 20 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Misc/Ldtoken.cs: -------------------------------------------------------------------------------- 1 | using dnlib.DotNet; 2 | using dnlib.DotNet.Emit; 3 | 4 | namespace CawkEmulatorV4.Instructions.Misc 5 | { 6 | internal class Ldtoken 7 | { 8 | public static void Emulate(ValueStack valueStack, Instruction instruction) 9 | { 10 | var fie = instruction.Operand; 11 | 12 | 13 | if (fie is FieldDef) 14 | { 15 | var fie2 = (FieldDef) fie; 16 | valueStack.CallStack.Push(fie2.MDToken.ToInt32()); 17 | } 18 | else 19 | { 20 | var fie2 = (ITypeDefOrRef) fie; 21 | valueStack.CallStack.Push(fie2.MDToken.ToInt32()); 22 | } 23 | } 24 | } 25 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/Symbols/SymbolVariable.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Pdb.Symbols { 4 | /// 5 | /// A variable 6 | /// 7 | public abstract class SymbolVariable { 8 | /// 9 | /// Gets the name 10 | /// 11 | public abstract string Name { get; } 12 | 13 | /// 14 | /// Gets the attributes 15 | /// 16 | public abstract PdbLocalAttributes Attributes { get; } 17 | 18 | /// 19 | /// Gets the index of the variable 20 | /// 21 | public abstract int Index { get; } 22 | 23 | /// 24 | /// Gets all custom debug infos 25 | /// 26 | public abstract PdbCustomDebugInfo[] CustomDebugInfos { get; } 27 | } 28 | } 29 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Native/X86DIV.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using EasyPredicateKiller; 3 | using SharpDisasm; 4 | 5 | namespace ConfuserDeobfuscator.Engine.Routines.Ex.x86.Instructions 6 | { 7 | internal class X86DIV : X86Instruction 8 | { 9 | public X86DIV(Instruction rawInstruction) 10 | { 11 | Operands = new IX86Operand[2]; 12 | Operands[0] = rawInstruction.Operands[0].GetOperand(); 13 | Operands[1] = rawInstruction.Operands[1].GetOperand(); 14 | } 15 | 16 | public override X86OpCode OpCode => X86OpCode.DIV; 17 | 18 | public override void Execute(Dictionary registers, Stack localStack) 19 | { 20 | } 21 | } 22 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/NullResolver.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet { 4 | /// 5 | /// A resolver that always fails 6 | /// 7 | public sealed class NullResolver : IAssemblyResolver, IResolver { 8 | /// 9 | /// The one and only instance of this type 10 | /// 11 | public static readonly NullResolver Instance = new NullResolver(); 12 | 13 | NullResolver() { 14 | } 15 | 16 | /// 17 | public AssemblyDef Resolve(IAssembly assembly, ModuleDef sourceModule) => null; 18 | 19 | /// 20 | public TypeDef Resolve(TypeRef typeRef, ModuleDef sourceModule) => null; 21 | 22 | /// 23 | public IMemberForwarded Resolve(MemberRef memberRef) => null; 24 | } 25 | } 26 | -------------------------------------------------------------------------------- /dnlib/src/W32Resources/ResourceDirectoryEntry.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.W32Resources { 4 | /// 5 | /// Base class of and 6 | /// 7 | public abstract class ResourceDirectoryEntry { 8 | ResourceName name; 9 | 10 | /// 11 | /// Gets/sets the name 12 | /// 13 | public ResourceName Name { 14 | get => name; 15 | set => name = value; 16 | } 17 | 18 | /// 19 | /// Constructor 20 | /// 21 | /// Name 22 | protected ResourceDirectoryEntry(ResourceName name) => this.name = name; 23 | 24 | /// 25 | public override string ToString() => name.ToString(); 26 | } 27 | } 28 | -------------------------------------------------------------------------------- /dnlib/src/DefaultDllImportSearchPathsAttribute.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace System.Runtime.InteropServices { 4 | [AttributeUsage(AttributeTargets.Assembly | AttributeTargets.Method, AllowMultiple = false)] 5 | sealed class DefaultDllImportSearchPathsAttribute : Attribute { 6 | public DefaultDllImportSearchPathsAttribute(DllImportSearchPath paths) => _paths = paths; 7 | public DllImportSearchPath Paths => _paths; 8 | internal DllImportSearchPath _paths; 9 | } 10 | 11 | [Flags] 12 | enum DllImportSearchPath { 13 | LegacyBehavior = 0, 14 | AssemblyDirectory = 2, 15 | UseDllDirectoryForDependencies = 0x100, 16 | ApplicationDirectory = 0x200, 17 | UserDirectories = 0x400, 18 | System32 = 0x800, 19 | SafeDirectories = 0x1000, 20 | } 21 | } 22 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/Dss/SymbolDocumentWriter.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | using System.Diagnostics.SymbolStore; 5 | 6 | namespace dnlib.DotNet.Pdb.Dss { 7 | sealed class SymbolDocumentWriter : ISymbolDocumentWriter { 8 | readonly ISymUnmanagedDocumentWriter writer; 9 | public ISymUnmanagedDocumentWriter SymUnmanagedDocumentWriter => writer; 10 | public SymbolDocumentWriter(ISymUnmanagedDocumentWriter writer) => this.writer = writer; 11 | public void SetCheckSum(Guid algorithmId, byte[] checkSum) { 12 | if (checkSum != null && checkSum.Length != 0 && algorithmId != Guid.Empty) 13 | writer.SetCheckSum(algorithmId, (uint)checkSum.Length, checkSum); 14 | } 15 | public void SetSource(byte[] source) => writer.SetSource((uint)source.Length, source); 16 | } 17 | } 18 | -------------------------------------------------------------------------------- /dnlib/src/PE/RVA.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.PE { 4 | /// 5 | /// Represents an RVA (relative virtual address) 6 | /// 7 | public enum RVA : uint { 8 | } 9 | 10 | partial class PEExtensions { 11 | /// 12 | /// Align up 13 | /// 14 | /// this 15 | /// Alignment 16 | public static RVA AlignUp(this RVA rva, uint alignment) => (RVA)(((uint)rva + alignment - 1) & ~(alignment - 1)); 17 | 18 | /// 19 | /// Align up 20 | /// 21 | /// this 22 | /// Alignment 23 | public static RVA AlignUp(this RVA rva, int alignment) => (RVA)(((uint)rva + alignment - 1) & ~(alignment - 1)); 24 | } 25 | } 26 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Branches/Switch.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using System.Linq; 3 | using dnlib.DotNet.Emit; 4 | 5 | namespace CawkEmulatorV4.Instructions.Branches 6 | { 7 | internal class Switch 8 | { 9 | public static int Emulate(ValueStack valueStack, Instruction ins, IList instructions) 10 | { 11 | var value1 = valueStack.CallStack.Pop(); 12 | var branchTo = (Instruction[]) ins.Operand; 13 | try 14 | { 15 | var location = branchTo[value1]; 16 | return instructions.IndexOf(location) - 1; 17 | } 18 | catch 19 | { 20 | return -1; 21 | } 22 | 23 | 24 | } 25 | } 26 | } -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/Program.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using dnlib.DotNet; 7 | using dnlib.DotNet.Writer; 8 | 9 | namespace ConfuserEx_String_Decryptor 10 | { 11 | class Program 12 | { 13 | public static ModuleDefMD Module { get; private set; } 14 | 15 | static void Main(string[] args) 16 | { 17 | string path = Console.ReadLine(); 18 | Module = ModuleDefMD.Load(path); 19 | StringDecryptor.Deobfuscate(); 20 | ModuleWriterOptions modOpts = new ModuleWriterOptions(Module); 21 | modOpts.MetadataOptions.Flags = MetadataFlags.PreserveAll; 22 | Module.Write(path+"Cleaned.exe",modOpts); 23 | } 24 | } 25 | } 26 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Arithmatic/Div.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Arithmatic 2 | { 3 | internal class Div 4 | { 5 | public static void Emulate(ValueStack valueStack) 6 | { 7 | var value1 = valueStack.CallStack.Pop(); 8 | var value2 = valueStack.CallStack.Pop(); 9 | var addedValue = value2 / value1; 10 | 11 | valueStack.CallStack.Push(addedValue); 12 | } 13 | 14 | public static void Emulate_Un(ValueStack valueStack) 15 | { 16 | var value1 = valueStack.CallStack.Pop(); 17 | var value2 = valueStack.CallStack.Pop(); 18 | dynamic addedValue = (int) ((uint) value2 / value1); 19 | 20 | valueStack.CallStack.Push(addedValue); 21 | } 22 | } 23 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/ParamAttributes.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet { 6 | /// 7 | /// Parameter flags. See CorHdr.h/CorParamAttr 8 | /// 9 | [Flags] 10 | public enum ParamAttributes : ushort { 11 | /// Param is [In] 12 | In = 0x0001, 13 | /// Param is [out] 14 | Out = 0x0002, 15 | /// Param is a locale identifier 16 | Lcid = 0x0004, 17 | /// Param is a return value 18 | Retval = 0x0008, 19 | /// Param is optional 20 | Optional = 0x0010, 21 | 22 | /// Param has default value. 23 | HasDefault = 0x1000, 24 | /// Param has FieldMarshal. 25 | HasFieldMarshal = 0x2000, 26 | } 27 | } 28 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Arrays/LdelemI4.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Arrays 2 | { 3 | internal class LdelemI4 4 | { 5 | public static void Emulate(ValueStack valueStack) 6 | { 7 | var location = valueStack.CallStack.Pop(); 8 | var array = valueStack.CallStack.Pop(); 9 | valueStack.CallStack.Push(array[location]); 10 | } 11 | 12 | public static void UEmulate(ValueStack valueStack) 13 | { 14 | var location = valueStack.CallStack.Pop(); 15 | var array = valueStack.CallStack.Pop(); 16 | var abc = array[location]; 17 | var tee = (uint) abc; 18 | var tttt = (int) tee; 19 | valueStack.CallStack.Push((int)(uint) array[location]); 20 | } 21 | } 22 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/MD/CustomDotNetStream.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using dnlib.IO; 4 | 5 | namespace dnlib.DotNet.MD { 6 | /// 7 | /// A custom .NET metadata stream 8 | /// 9 | public class CustomDotNetStream : DotNetStream { 10 | /// 11 | /// Constructor 12 | /// 13 | public CustomDotNetStream() { } 14 | 15 | /// 16 | /// Constructor 17 | /// 18 | /// Data reader factory 19 | /// Offset of metadata 20 | /// The stream header 21 | public CustomDotNetStream(DataReaderFactory mdReaderFactory, uint metadataBaseOffset, StreamHeader streamHeader) 22 | : base(mdReaderFactory, metadataBaseOffset, streamHeader) { 23 | } 24 | } 25 | } 26 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/MethodSemanticsAttributes.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet { 6 | /// 7 | /// Method semantics flags, see CorHdr.h/CorMethodSemanticsAttr 8 | /// 9 | [Flags] 10 | public enum MethodSemanticsAttributes : ushort { 11 | /// No bit is set 12 | None = 0, 13 | /// Setter for property 14 | Setter = 0x0001, 15 | /// Getter for property 16 | Getter = 0x0002, 17 | /// other method for property or event 18 | Other = 0x0004, 19 | /// AddOn method for event 20 | AddOn = 0x0008, 21 | /// RemoveOn method for event 22 | RemoveOn = 0x0010, 23 | /// Fire method for event 24 | Fire = 0x0020, 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/MemberMDInitializer.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System.Collections.Generic; 4 | 5 | namespace dnlib.DotNet { 6 | /// 7 | /// Methods to load properties to make sure they're initialized 8 | /// 9 | static class MemberMDInitializer { 10 | /// 11 | /// Read every collection element 12 | /// 13 | /// Collection element type 14 | /// Collection 15 | public static void Initialize(IEnumerable coll) { 16 | if (coll == null) 17 | return; 18 | foreach (var c in coll) { 19 | } 20 | } 21 | 22 | /// 23 | /// Load the object instance 24 | /// 25 | /// The value (ignored) 26 | public static void Initialize(object o) { 27 | } 28 | } 29 | } 30 | -------------------------------------------------------------------------------- /dnlib/src/IO/FileOffset.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.IO { 4 | /// 5 | /// Represents a file offset 6 | /// 7 | public enum FileOffset : uint { 8 | } 9 | 10 | partial class IOExtensions { 11 | /// 12 | /// Align up 13 | /// 14 | /// this 15 | /// Alignment 16 | public static FileOffset AlignUp(this FileOffset offset, uint alignment) => (FileOffset)(((uint)offset + alignment - 1) & ~(alignment - 1)); 17 | 18 | /// 19 | /// Align up 20 | /// 21 | /// this 22 | /// Alignment 23 | public static FileOffset AlignUp(this FileOffset offset, int alignment) => (FileOffset)(((uint)offset + alignment - 1) & ~(alignment - 1)); 24 | } 25 | } 26 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Arrays/LdelemI1.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | 3 | namespace CawkEmulatorV4.Instructions.Arrays 4 | { 5 | internal class LdelemI1 6 | { 7 | public static void Emulate(ValueStack valueStack) 8 | { 9 | var location = valueStack.CallStack.Pop(); 10 | var array = valueStack.CallStack.Pop(); 11 | valueStack.CallStack.Push((int) (sbyte) array[location]); 12 | } 13 | 14 | public static void UEmulate(ValueStack valueStack) 15 | { 16 | 17 | var location = valueStack.CallStack.Pop(); 18 | var array = valueStack.CallStack.Pop(); 19 | var valueinByte = Convert.ToByte(array[location]); 20 | var valueinInt = Convert.ToInt32(valueinByte); 21 | valueStack.CallStack.Push(valueinInt); 22 | } 23 | } 24 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Native/X86NEG.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using EasyPredicateKiller; 3 | using SharpDisasm; 4 | 5 | namespace ConfuserDeobfuscator.Engine.Routines.Ex.x86.Instructions 6 | { 7 | internal class X86NEG : X86Instruction 8 | { 9 | public X86NEG(Instruction rawInstruction) 10 | { 11 | Operands = new IX86Operand[1]; 12 | Operands[0] = rawInstruction.Operands[0].GetOperand(); 13 | } 14 | 15 | public override X86OpCode OpCode => X86OpCode.NEG; 16 | 17 | public override void Execute(Dictionary registers, Stack localStack) 18 | { 19 | registers[((X86RegisterOperand) Operands[0]).Register.ToString()] = 20 | -registers[((X86RegisterOperand) Operands[0]).Register.ToString()]; 21 | } 22 | } 23 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Native/X86NOT.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using EasyPredicateKiller; 3 | using SharpDisasm; 4 | 5 | namespace ConfuserDeobfuscator.Engine.Routines.Ex.x86.Instructions 6 | { 7 | internal class X86NOT : X86Instruction 8 | { 9 | public X86NOT(Instruction rawInstruction) 10 | { 11 | Operands = new IX86Operand[1]; 12 | Operands[0] = rawInstruction.Operands[0].GetOperand(); 13 | } 14 | 15 | public override X86OpCode OpCode => X86OpCode.NOT; 16 | 17 | public override void Execute(Dictionary registers, Stack localStack) 18 | { 19 | registers[((X86RegisterOperand) Operands[0]).Register.ToString()] = 20 | ~registers[((X86RegisterOperand) Operands[0]).Register.ToString()]; 21 | } 22 | } 23 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/MD/MDStreamFlags.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet.MD { 6 | /// 7 | /// MDStream flags 8 | /// 9 | [Flags] 10 | public enum MDStreamFlags : byte { 11 | /// #Strings stream is big and requires 4 byte offsets 12 | BigStrings = 1, 13 | /// #GUID stream is big and requires 4 byte offsets 14 | BigGUID = 2, 15 | /// #Blob stream is big and requires 4 byte offsets 16 | BigBlob = 4, 17 | /// 18 | Padding = 8, 19 | /// 20 | DeltaOnly = 0x20, 21 | /// Extra data follows the row counts 22 | ExtraData = 0x40, 23 | /// Set if certain tables can contain deleted rows. The name column (if present) is set to "_Deleted" 24 | HasDelete = 0x80, 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Writer/PortablePdbConstants.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Writer { 4 | static class PortablePdbConstants { 5 | // See System.Reflection.Metadata.PortablePdbVersions 6 | 7 | // Portable PDB version (v1.0) 8 | // Format version is stored in DebugDirectory.MajorVersion 9 | // SRM: DefaultFormatVersion, MinFormatVersion 10 | public const ushort FormatVersion = 0x0100; 11 | 12 | // Embedded Portable PDB Blob verison (v1.0) 13 | // Embedded version is stored in DebugDirectory.MinorVersion 14 | // SRM: MinEmbeddedVersion, DefaultEmbeddedVersion, MinUnsupportedEmbeddedVersion 15 | public const ushort EmbeddedVersion = 0x0100; 16 | 17 | // Stored in DebugDirectory.MinorVersion and indicates that it's a portable PDB file 18 | // and not a Windows PDB file 19 | public const ushort PortableCodeViewVersionMagic = 0x504D; 20 | } 21 | } 22 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/Portable/SymbolVariableImpl.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using dnlib.DotNet.Pdb.Symbols; 4 | 5 | namespace dnlib.DotNet.Pdb.Portable { 6 | sealed class SymbolVariableImpl : SymbolVariable { 7 | readonly string name; 8 | readonly PdbLocalAttributes attributes; 9 | readonly int index; 10 | readonly PdbCustomDebugInfo[] customDebugInfos; 11 | 12 | public override string Name => name; 13 | public override PdbLocalAttributes Attributes => attributes; 14 | public override int Index => index; 15 | public override PdbCustomDebugInfo[] CustomDebugInfos => customDebugInfos; 16 | 17 | public SymbolVariableImpl(string name, PdbLocalAttributes attributes, int index, PdbCustomDebugInfo[] customDebugInfos) { 18 | this.name = name; 19 | this.attributes = attributes; 20 | this.index = index; 21 | this.customDebugInfos = customDebugInfos; 22 | } 23 | } 24 | } 25 | -------------------------------------------------------------------------------- /dnlib/src/PE/IPEType.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using dnlib.IO; 4 | 5 | namespace dnlib.PE { 6 | /// 7 | /// Converts a to/from an 8 | /// 9 | interface IPEType { 10 | /// 11 | /// Converts a to an 12 | /// 13 | /// The PEInfo context 14 | /// The file offset to convert 15 | /// The RVA 16 | RVA ToRVA(PEInfo peInfo, FileOffset offset); 17 | 18 | /// 19 | /// Converts an to a 20 | /// 21 | /// The PEInfo context 22 | /// The RVA to convert 23 | /// The file offset 24 | FileOffset ToFileOffset(PEInfo peInfo, RVA rva); 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Native/X86POP.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using EasyPredicateKiller; 3 | using SharpDisasm; 4 | 5 | namespace ConfuserDeobfuscator.Engine.Routines.Ex.x86.Instructions 6 | { 7 | internal class X86POP : X86Instruction 8 | { 9 | public X86POP(Instruction rawInstruction) 10 | { 11 | Operands = new IX86Operand[1]; 12 | Operands[0] = rawInstruction.Operands[0].GetOperand(); 13 | } 14 | 15 | public override X86OpCode OpCode => X86OpCode.POP; 16 | 17 | public override void Execute(Dictionary registers, Stack localStack) 18 | { 19 | // Pretend to pop stack 20 | if (localStack.Count < 1) 21 | return; 22 | 23 | registers[((X86RegisterOperand) Operands[0]).Register.ToString()] = localStack.Pop(); 24 | } 25 | } 26 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/Resources/ResourceElementSet.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | using System.Collections.Generic; 5 | 6 | namespace dnlib.DotNet.Resources { 7 | /// 8 | /// Resource element set 9 | /// 10 | public sealed class ResourceElementSet { 11 | readonly Dictionary dict = new Dictionary(StringComparer.Ordinal); 12 | 13 | /// 14 | /// Gets the number of elements in the set 15 | /// 16 | public int Count => dict.Count; 17 | 18 | /// 19 | /// Gets all resource elements 20 | /// 21 | public IEnumerable ResourceElements => dict.Values; 22 | 23 | /// 24 | /// Adds a new resource to the set, overwriting any existing resource 25 | /// 26 | /// 27 | public void Add(ResourceElement elem) => dict[elem.Name] = elem; 28 | } 29 | } 30 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/MethodOverride.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet { 4 | /// 5 | /// Describes which method some method implements 6 | /// 7 | public struct MethodOverride { 8 | /// 9 | /// The method body. Usually a but could be a 10 | /// 11 | public IMethodDefOrRef MethodBody; 12 | 13 | /// 14 | /// The method implements 15 | /// 16 | public IMethodDefOrRef MethodDeclaration; 17 | 18 | /// 19 | /// Constructor 20 | /// 21 | /// Method body 22 | /// The method implements 23 | public MethodOverride(IMethodDefOrRef methodBody, IMethodDefOrRef methodDeclaration) { 24 | MethodBody = methodBody; 25 | MethodDeclaration = methodDeclaration; 26 | } 27 | } 28 | } 29 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Resources/UserResourceType.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Resources { 4 | /// 5 | /// User resource type 6 | /// 7 | public sealed class UserResourceType { 8 | readonly string name; 9 | readonly ResourceTypeCode code; 10 | 11 | /// 12 | /// Full name including assembly of type 13 | /// 14 | public string Name => name; 15 | 16 | /// 17 | /// User type code 18 | /// 19 | public ResourceTypeCode Code => code; 20 | 21 | /// 22 | /// Constructor 23 | /// 24 | /// Full name including assembly of type 25 | /// User type code 26 | public UserResourceType(string name, ResourceTypeCode code) { 27 | this.name = name; 28 | this.code = code; 29 | } 30 | 31 | /// 32 | public override string ToString() => $"{(int)code:X2} {name}"; 33 | } 34 | } 35 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/GenericParamAttributes.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet { 6 | /// 7 | /// Generic parameter flags. See CorHdr.h/CorGenericParamAttr 8 | /// 9 | [Flags] 10 | public enum GenericParamAttributes : ushort { 11 | /// 12 | VarianceMask = 0x0003, 13 | /// 14 | NonVariant = 0x0000, 15 | /// 16 | Covariant = 0x0001, 17 | /// 18 | Contravariant = 0x0002, 19 | 20 | /// 21 | SpecialConstraintMask = 0x001C, 22 | /// 23 | NoSpecialConstraint = 0x0000, 24 | /// type argument must be a reference type 25 | ReferenceTypeConstraint = 0x0004, 26 | /// type argument must be a value type but not Nullable 27 | NotNullableValueTypeConstraint = 0x0008, 28 | /// type argument must have a public default constructor 29 | DefaultConstructorConstraint = 0x0010, 30 | } 31 | } 32 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Arithmatic/Add.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | 3 | namespace CawkEmulatorV4.Instructions.Arithmatic 4 | { 5 | internal class Add 6 | { 7 | public static void Emulate(ValueStack valueStack) 8 | { 9 | var value1 = valueStack.CallStack.Pop(); 10 | var value2 = valueStack.CallStack.Pop(); 11 | var addedValue = value2 + value1; 12 | 13 | valueStack.CallStack.Push(addedValue); 14 | } 15 | 16 | public static void Emulate_Ovf(ValueStack valueStack) 17 | { 18 | var value1 = valueStack.CallStack.Pop(); 19 | var value2 = valueStack.CallStack.Pop(); 20 | try 21 | { 22 | var addedValue = checked(value2 + value1); 23 | 24 | valueStack.CallStack.Push(addedValue); 25 | } 26 | catch (OverflowException) 27 | { 28 | valueStack.CallStack.Push(-1); 29 | } 30 | } 31 | } 32 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Arithmatic/Sub.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | 3 | namespace CawkEmulatorV4.Instructions.Arithmatic 4 | { 5 | internal class Sub 6 | { 7 | public static void Emulate(ValueStack valueStack) 8 | { 9 | var value1 = valueStack.CallStack.Pop(); 10 | var value2 = valueStack.CallStack.Pop(); 11 | var addedValue = value2 - value1; 12 | 13 | valueStack.CallStack.Push(addedValue); 14 | } 15 | 16 | public static void Emulate_Ovf(ValueStack valueStack) 17 | { 18 | var value1 = valueStack.CallStack.Pop(); 19 | var value2 = valueStack.CallStack.Pop(); 20 | try 21 | { 22 | var addedValue = checked(value2 - value1); 23 | 24 | valueStack.CallStack.Push(addedValue); 25 | } 26 | catch (OverflowException) 27 | { 28 | valueStack.CallStack.Push(-1); 29 | } 30 | } 31 | } 32 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Pointer/LdindI4.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | 3 | namespace CawkEmulatorV4.Instructions.Pointer 4 | { 5 | internal class LdindI4 6 | { 7 | public static unsafe void Emulate(ValueStack valueStack) 8 | { 9 | var address = valueStack.CallStack.Pop(); 10 | var ptr = ((IntPtr) address).ToPointer(); 11 | var value = *(int*) ptr; 12 | // Console.WriteLine("GET "+address.ToString("X8") + " Value = " + value.ToString("X8")); 13 | valueStack.CallStack.Push(value); 14 | } 15 | 16 | public static unsafe void UEmulate(ValueStack valueStack) 17 | { 18 | var address = valueStack.CallStack.Pop(); 19 | var ptr = ((IntPtr) address).ToPointer(); 20 | var value = *(uint*) ptr; 21 | // Console.WriteLine("GET "+address.ToString("X8") + " Value = " + value.ToString("X8")); 22 | valueStack.CallStack.Push((int)(uint) value); 23 | } 24 | } 25 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Pointer/LdindI2.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | 3 | namespace CawkEmulatorV4.Instructions.Pointer 4 | { 5 | internal class LdindI2 6 | { 7 | public static unsafe void Emulate(ValueStack valueStack) 8 | { 9 | var address = valueStack.CallStack.Pop(); 10 | var ptr = ((IntPtr) address).ToPointer(); 11 | var value = *(short*) ptr; 12 | // Console.WriteLine("GET "+address.ToString("X8") + " Value = " + value.ToString("X8")); 13 | valueStack.CallStack.Push((int) value); 14 | } 15 | 16 | public static unsafe void UEmulate(ValueStack valueStack) 17 | { 18 | var address = valueStack.CallStack.Pop(); 19 | var ptr = ((IntPtr) address).ToPointer(); 20 | var value = *(ushort*) ptr; 21 | // Console.WriteLine("GET "+address.ToString("X8") + " Value = " + value.ToString("X8")); 22 | valueStack.CallStack.Push((int) value); 23 | } 24 | } 25 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Misc/NewArr.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection.Emit; 2 | using dnlib.DotNet; 3 | using dnlib.DotNet.Emit; 4 | using OpCodes = System.Reflection.Emit.OpCodes; 5 | 6 | namespace CawkEmulatorV4.Instructions.Misc 7 | { 8 | internal class NewArr 9 | { 10 | public static void Emulate(ValueStack valueStack, Instruction instruction) 11 | { 12 | var size = valueStack.CallStack.Pop(); 13 | var type = (ITypeDefOrRef) instruction.Operand; 14 | var adff = typeof(string).Module.GetType(type.ReflectionFullName); 15 | var dynamicMethod = new DynamicMethod("abc", adff.MakeArrayType(), new[] {typeof(int)}, 16 | typeof(string).Module, true); 17 | var ilg = dynamicMethod.GetILGenerator(); 18 | ilg.Emit(OpCodes.Ldarg_0); 19 | ilg.Emit(OpCodes.Newarr, adff); 20 | ilg.Emit(OpCodes.Ret); 21 | valueStack.CallStack.Push(dynamicMethod.Invoke(null, new object[] {size})); 22 | } 23 | } 24 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Misc/CastClass.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection.Emit; 2 | using dnlib.DotNet; 3 | using dnlib.DotNet.Emit; 4 | using OpCodes = System.Reflection.Emit.OpCodes; 5 | 6 | namespace CawkEmulatorV4.Instructions.Misc 7 | { 8 | internal class CastClass 9 | { 10 | public static void Emulate(ValueStack valueStack, Instruction instruction) 11 | { 12 | var size = valueStack.CallStack.Pop(); 13 | var type = (ITypeDefOrRef) instruction.Operand; 14 | 15 | var adff = typeof(string).Module.GetType(type.ReflectionFullName); 16 | var dynamicMethod = 17 | new DynamicMethod("CastClass", adff, new[] {typeof(object)}, typeof(string).Module, true); 18 | var ilg = dynamicMethod.GetILGenerator(); 19 | ilg.Emit(OpCodes.Ldarg_0); 20 | ilg.Emit(OpCodes.Castclass, adff); 21 | ilg.Emit(OpCodes.Ret); 22 | valueStack.CallStack.Push(dynamicMethod.Invoke(null, new[] {(object) size})); 23 | } 24 | } 25 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/Managed/NumericLeaf.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Pdb.Managed { 4 | enum NumericLeaf : ushort { 5 | LF_NUMERIC = 0x8000, 6 | LF_CHAR = 0x8000, 7 | LF_SHORT = 0x8001, 8 | LF_USHORT = 0x8002, 9 | LF_LONG = 0x8003, 10 | LF_ULONG = 0x8004, 11 | LF_REAL32 = 0x8005, 12 | LF_REAL64 = 0x8006, 13 | LF_REAL80 = 0x8007, 14 | LF_REAL128 = 0x8008, 15 | LF_QUADWORD = 0x8009, 16 | LF_UQUADWORD = 0x800A, 17 | LF_REAL48 = 0x800B, 18 | LF_COMPLEX32 = 0x800C, 19 | LF_COMPLEX64 = 0x800D, 20 | LF_COMPLEX80 = 0x800E, 21 | LF_COMPLEX128 = 0x800F, 22 | LF_VARSTRING = 0x8010, 23 | LF_RESERVED_8011 = 0x8011, 24 | LF_RESERVED_8012 = 0x8012, 25 | LF_RESERVED_8013 = 0x8013, 26 | LF_RESERVED_8014 = 0x8014, 27 | LF_RESERVED_8015 = 0x8015, 28 | LF_RESERVED_8016 = 0x8016, 29 | LF_OCTWORD = 0x8017, 30 | LF_UOCTWORD = 0x8018, 31 | LF_VARIANT = 0x8019, 32 | LF_DATE = 0x801A, 33 | LF_UTF8STRING = 0x801B, 34 | LF_REAL16 = 0x801C, 35 | } 36 | } 37 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/Symbols/SymbolAsyncStepInfo.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Pdb.Symbols { 4 | /// 5 | /// Async step info 6 | /// 7 | public struct SymbolAsyncStepInfo { 8 | /// 9 | /// Yield offset 10 | /// 11 | public uint YieldOffset; 12 | 13 | /// 14 | /// Breakpoint offset 15 | /// 16 | public uint BreakpointOffset; 17 | 18 | /// 19 | /// Breakpoint method token 20 | /// 21 | public uint BreakpointMethod; 22 | 23 | /// 24 | /// Constructor 25 | /// 26 | /// Yield offset 27 | /// Breakpoint offset 28 | /// Breakpoint method token 29 | public SymbolAsyncStepInfo(uint yieldOffset, uint breakpointOffset, uint breakpointMethod) { 30 | YieldOffset = yieldOffset; 31 | BreakpointOffset = breakpointOffset; 32 | BreakpointMethod = breakpointMethod; 33 | } 34 | } 35 | } 36 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/Symbols/SymbolMethod.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System.Collections.Generic; 4 | using dnlib.DotNet.Emit; 5 | 6 | namespace dnlib.DotNet.Pdb.Symbols { 7 | /// 8 | /// A method 9 | /// 10 | public abstract class SymbolMethod { 11 | /// 12 | /// Gets the method token 13 | /// 14 | public abstract int Token { get; } 15 | 16 | /// 17 | /// Gets the root scope 18 | /// 19 | public abstract SymbolScope RootScope { get; } 20 | 21 | /// 22 | /// Gets all sequence points 23 | /// 24 | public abstract IList SequencePoints { get; } 25 | 26 | /// 27 | /// Reads custom debug info 28 | /// 29 | /// Method 30 | /// Method body 31 | /// Updated with custom debug info 32 | public abstract void GetCustomDebugInfos(MethodDef method, CilBody body, IList result); 33 | } 34 | } 35 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/Managed/DbiVariable.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | using dnlib.DotNet.Pdb.Symbols; 5 | using dnlib.IO; 6 | 7 | namespace dnlib.DotNet.Pdb.Managed { 8 | sealed class DbiVariable : SymbolVariable { 9 | public override string Name => name; 10 | string name; 11 | 12 | public override PdbLocalAttributes Attributes => attributes; 13 | PdbLocalAttributes attributes; 14 | 15 | public override int Index => index; 16 | int index; 17 | 18 | public override PdbCustomDebugInfo[] CustomDebugInfos => Array2.Empty(); 19 | 20 | public void Read(ref DataReader reader) { 21 | index = reader.ReadInt32(); 22 | reader.Position += 10; 23 | attributes = GetAttributes(reader.ReadUInt16()); 24 | name = PdbReader.ReadCString(ref reader); 25 | } 26 | 27 | static PdbLocalAttributes GetAttributes(uint flags) { 28 | PdbLocalAttributes res = 0; 29 | const int fCompGenx = 4; 30 | if ((flags & fCompGenx) != 0) 31 | res |= PdbLocalAttributes.DebuggerHidden; 32 | return res; 33 | } 34 | } 35 | } 36 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Resources/IResourceData.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System.IO; 4 | using System.Runtime.Serialization; 5 | using dnlib.IO; 6 | 7 | namespace dnlib.DotNet.Resources { 8 | /// 9 | /// Implemented by all resource data 10 | /// 11 | public interface IResourceData : IFileSection { 12 | /// 13 | /// Gets the type of data 14 | /// 15 | ResourceTypeCode Code { get; } 16 | 17 | /// 18 | /// Start offset of the section in the file 19 | /// 20 | new FileOffset StartOffset { get; set; } 21 | 22 | /// 23 | /// End offset of the section in the file. This is one byte after the last 24 | /// valid offset in the section. 25 | /// 26 | new FileOffset EndOffset { get; set; } 27 | 28 | /// 29 | /// Writes the data 30 | /// 31 | /// Writer 32 | /// Formatter if needed by implementer 33 | void WriteData(BinaryWriter writer, IFormatter formatter); 34 | } 35 | } 36 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Writer/IModuleWriterListener.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Writer { 4 | /// 5 | /// Gets notified of various events when writing a module 6 | /// 7 | public interface IModuleWriterListener { 8 | /// 9 | /// Called by and its sub classes. 10 | /// 11 | /// The module writer 12 | /// Type of writer event 13 | void OnWriterEvent(ModuleWriterBase writer, ModuleWriterEvent evt); 14 | } 15 | 16 | /// 17 | /// A which does nothing 18 | /// 19 | public sealed class DummyModuleWriterListener : IModuleWriterListener { 20 | /// 21 | /// An instance of this dummy listener 22 | /// 23 | public static readonly DummyModuleWriterListener Instance = new DummyModuleWriterListener(); 24 | 25 | /// 26 | public void OnWriterEvent(ModuleWriterBase writer, ModuleWriterEvent evt) { 27 | } 28 | } 29 | } 30 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/ITokenResolver.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet { 4 | /// 5 | /// Resolves tokens 6 | /// 7 | public interface ITokenResolver { 8 | /// 9 | /// Resolves a token 10 | /// 11 | /// The metadata token 12 | /// Generic parameter context 13 | /// A or null if is invalid 14 | IMDTokenProvider ResolveToken(uint token, GenericParamContext gpContext); 15 | } 16 | 17 | public static partial class Extensions { 18 | /// 19 | /// Resolves a token 20 | /// 21 | /// This 22 | /// The metadata token 23 | /// A or null if is invalid 24 | public static IMDTokenProvider ResolveToken(this ITokenResolver self, uint token) => self.ResolveToken(token, new GenericParamContext()); 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Arithmatic/Rem.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Arithmatic 2 | { 3 | internal class Rem 4 | { 5 | public static void Emulate(ValueStack valueStack) 6 | { 7 | var value1 = valueStack.CallStack.Pop(); 8 | var value2 = valueStack.CallStack.Pop(); 9 | var addedValue = value2 % value1; 10 | 11 | valueStack.CallStack.Push(addedValue); 12 | } 13 | 14 | public static void Emulate_Un(ValueStack valueStack) 15 | { 16 | var value1 = valueStack.CallStack.Pop(); 17 | var value2 = valueStack.CallStack.Pop(); 18 | 19 | var addedValue = value2 % value1; 20 | 21 | 22 | if (value1 is long && value2 is long) 23 | { 24 | var final = (long) ((ulong) value2 % (ulong) value1); 25 | valueStack.CallStack.Push(final); 26 | } 27 | else 28 | { 29 | valueStack.CallStack.Push(addedValue); 30 | } 31 | } 32 | } 33 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/PublicKeyToken.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet { 4 | /// 5 | /// Represents a public key token 6 | /// 7 | public sealed class PublicKeyToken : PublicKeyBase { 8 | /// 9 | /// Gets the 10 | /// 11 | public override PublicKeyToken Token => this; 12 | 13 | /// 14 | /// Constructor 15 | /// 16 | public PublicKeyToken() : base((byte[])null) { } 17 | 18 | /// 19 | public PublicKeyToken(byte[] data) 20 | : base(data) { 21 | } 22 | 23 | /// 24 | public PublicKeyToken(string hexString) 25 | : base(hexString) { 26 | } 27 | 28 | /// 29 | public override bool Equals(object obj) { 30 | if ((object)this == obj) 31 | return true; 32 | var other = obj as PublicKeyToken; 33 | if (other == null) 34 | return false; 35 | return Utils.Equals(Data, other.Data); 36 | } 37 | 38 | /// 39 | public override int GetHashCode() => Utils.GetHashCode(Data); 40 | } 41 | } 42 | -------------------------------------------------------------------------------- /dnlib/src/IO/DataReaderFactoryFactory.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | using System.IO; 5 | 6 | namespace dnlib.IO { 7 | static class DataReaderFactoryFactory { 8 | static readonly bool isUnix; 9 | 10 | static DataReaderFactoryFactory() { 11 | // See http://mono-project.com/FAQ:_Technical#Mono_Platforms for platform detection. 12 | int p = (int)Environment.OSVersion.Platform; 13 | if (p == 4 || p == 6 || p == 128) 14 | isUnix = true; 15 | } 16 | 17 | public static DataReaderFactory Create(string fileName, bool mapAsImage) { 18 | var creator = CreateDataReaderFactory(fileName, mapAsImage); 19 | if (creator != null) 20 | return creator; 21 | 22 | return ByteArrayDataReaderFactory.Create(File.ReadAllBytes(fileName), fileName); 23 | } 24 | 25 | static DataReaderFactory CreateDataReaderFactory(string fileName, bool mapAsImage) { 26 | if (!isUnix) 27 | return MemoryMappedDataReaderFactory.CreateWindows(fileName, mapAsImage); 28 | else 29 | return MemoryMappedDataReaderFactory.CreateUnix(fileName, mapAsImage); 30 | } 31 | } 32 | } 33 | -------------------------------------------------------------------------------- /dnlib/src/PE/ImageDosHeader.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | using dnlib.IO; 5 | 6 | namespace dnlib.PE { 7 | /// 8 | /// Represents the IMAGE_DOS_HEADER PE section 9 | /// 10 | public sealed class ImageDosHeader : FileSection { 11 | readonly uint ntHeadersOffset; 12 | 13 | /// 14 | /// File offset of the NT headers 15 | /// 16 | public uint NTHeadersOffset => ntHeadersOffset; 17 | 18 | /// 19 | /// Constructor 20 | /// 21 | /// PE file reader 22 | /// Verify section 23 | /// Thrown if verification fails 24 | public ImageDosHeader(ref DataReader reader, bool verify) { 25 | SetStartOffset(ref reader); 26 | ushort sig = reader.ReadUInt16(); 27 | if (verify && sig != 0x5A4D) 28 | throw new BadImageFormatException("Invalid DOS signature"); 29 | reader.Position = (uint)startOffset + 0x3C; 30 | ntHeadersOffset = reader.ReadUInt32(); 31 | SetEndoffset(ref reader); 32 | } 33 | } 34 | } 35 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/AllTypesHelper.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System.Collections.Generic; 4 | 5 | namespace dnlib.DotNet { 6 | /// 7 | /// Returns types without getting stuck in an infinite loop 8 | /// 9 | readonly struct AllTypesHelper { 10 | /// 11 | /// Gets a list of all types and nested types 12 | /// 13 | /// A list of types 14 | public static IEnumerable Types(IEnumerable types) { 15 | var visited = new Dictionary(); 16 | var stack = new Stack>(); 17 | if (types != null) 18 | stack.Push(types.GetEnumerator()); 19 | while (stack.Count > 0) { 20 | var enumerator = stack.Pop(); 21 | while (enumerator.MoveNext()) { 22 | var type = enumerator.Current; 23 | if (visited.ContainsKey(type)) 24 | continue; 25 | visited[type] = true; 26 | yield return type; 27 | if (type.NestedTypes.Count > 0) { 28 | stack.Push(enumerator); 29 | enumerator = type.NestedTypes.GetEnumerator(); 30 | } 31 | } 32 | } 33 | } 34 | } 35 | } 36 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Pointer/LdindI1.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace CawkEmulatorV4.Instructions.Pointer 8 | { 9 | class LdindI1 10 | { 11 | public static unsafe void Emulate(ValueStack valueStack) 12 | { 13 | var address = valueStack.CallStack.Pop(); 14 | var ptr = ((IntPtr)address).ToPointer(); 15 | var value = *(sbyte*)ptr; 16 | // Console.WriteLine("GET "+address.ToString("X8") + " Value = " + value.ToString("X8")); 17 | valueStack.CallStack.Push((int)value); 18 | } 19 | 20 | public static unsafe void UEmulate(ValueStack valueStack) 21 | { 22 | var address = valueStack.CallStack.Pop(); 23 | var ptr = ((IntPtr)address).ToPointer(); 24 | var value = *(byte*)ptr; 25 | // Console.WriteLine("GET "+address.ToString("X8") + " Value = " + value.ToString("X8")); 26 | valueStack.CallStack.Push((int)value); 27 | } 28 | } 29 | } 30 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Misc/Ldelema.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.InteropServices; 3 | 4 | namespace CawkEmulatorV4.Instructions.Misc 5 | { 6 | internal class AutoPinner : IDisposable 7 | { 8 | public GCHandle _pinnedArray; 9 | 10 | public AutoPinner(object obj) 11 | { 12 | _pinnedArray = GCHandle.Alloc(obj, GCHandleType.Pinned); 13 | } 14 | 15 | public void Dispose() 16 | { 17 | _pinnedArray.Free(); 18 | } 19 | 20 | public static implicit operator IntPtr(AutoPinner ap) 21 | { 22 | return ap._pinnedArray.AddrOfPinnedObject(); 23 | } 24 | } 25 | 26 | internal class Ldelema 27 | { 28 | public static void Emulate(ValueStack valueStack) 29 | { 30 | var location = valueStack.CallStack.Pop(); 31 | var array = valueStack.CallStack.Pop(); 32 | 33 | 34 | var pointer = Marshal.UnsafeAddrOfPinnedArrayElement(array, location); 35 | //Marshal.WriteInt32(pointer,5); 36 | valueStack.CallStack.Push(pointer); 37 | } 38 | } 39 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/PdbDocumentConstants.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet.Pdb { 6 | /// 7 | /// PDB document constants 8 | /// 9 | public static class PdbDocumentConstants { 10 | #pragma warning disable 1591 // Missing XML comment for publicly visible type or member 11 | public static readonly Guid LanguageCSharp = new Guid("3F5162F8-07C6-11D3-9053-00C04FA302A1"); 12 | public static readonly Guid LanguageVisualBasic = new Guid("3A12D0B8-C26C-11D0-B442-00A0244A1DD2"); 13 | public static readonly Guid LanguageFSharp = new Guid("AB4F38C9-B6E6-43BA-BE3B-58080B2CCCE3"); 14 | 15 | public static readonly Guid HashSHA1 = new Guid("FF1816EC-AA5E-4D10-87F7-6F4963833460"); 16 | public static readonly Guid HashSHA256 = new Guid("8829D00F-11B8-4213-878B-770E8597AC16"); 17 | 18 | public static readonly Guid LanguageVendorMicrosoft = new Guid("994B45C4-E6E9-11D2-903F-00C04FA302A1"); 19 | 20 | public static readonly Guid DocumentTypeText = new Guid("5A869D0B-6611-11D3-BD2A-0000F80849BD"); 21 | #pragma warning restore 1591 // Missing XML comment for publicly visible type or member 22 | } 23 | } 24 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/Symbols/SymbolDocument.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet.Pdb.Symbols { 6 | /// 7 | /// A document 8 | /// 9 | public abstract class SymbolDocument { 10 | /// 11 | /// Gets the URL 12 | /// 13 | public abstract string URL { get; } 14 | 15 | /// 16 | /// Gets the language 17 | /// 18 | public abstract Guid Language { get; } 19 | 20 | /// 21 | /// Gets the language vendor 22 | /// 23 | public abstract Guid LanguageVendor { get; } 24 | 25 | /// 26 | /// Gets the document type 27 | /// 28 | public abstract Guid DocumentType { get; } 29 | 30 | /// 31 | /// Gets the checksum algorithm id 32 | /// 33 | public abstract Guid CheckSumAlgorithmId { get; } 34 | 35 | /// 36 | /// Gets the checksum 37 | /// 38 | public abstract byte[] CheckSum { get; } 39 | 40 | /// 41 | /// Gets the custom debug infos 42 | /// 43 | public abstract PdbCustomDebugInfo[] CustomDebugInfos { get; } 44 | } 45 | } 46 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Native/X86ADD.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using EasyPredicateKiller; 3 | using SharpDisasm; 4 | 5 | namespace ConfuserDeobfuscator.Engine.Routines.Ex.x86.Instructions 6 | { 7 | internal class X86ADD : X86Instruction 8 | { 9 | public X86ADD(Instruction rawInstruction) 10 | { 11 | Operands = new IX86Operand[2]; 12 | Operands[0] = rawInstruction.Operands[0].GetOperand(); 13 | Operands[1] = rawInstruction.Operands[1].GetOperand(); 14 | } 15 | 16 | public override X86OpCode OpCode => X86OpCode.ADD; 17 | 18 | public override void Execute(Dictionary registers, Stack localStack) 19 | { 20 | if (Operands[1] is X86ImmediateOperand) 21 | registers[((X86RegisterOperand) Operands[0]).Register.ToString()] += 22 | ((X86ImmediateOperand) Operands[1]).Immediate; 23 | else 24 | registers[((X86RegisterOperand) Operands[0]).Register.ToString()] += 25 | registers[((X86RegisterOperand) Operands[1]).Register.ToString()]; 26 | } 27 | } 28 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Native/X86MOV.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using EasyPredicateKiller; 3 | using SharpDisasm; 4 | 5 | namespace ConfuserDeobfuscator.Engine.Routines.Ex.x86.Instructions 6 | { 7 | internal class X86MOV : X86Instruction 8 | { 9 | public X86MOV(Instruction rawInstruction) 10 | { 11 | Operands = new IX86Operand[2]; 12 | Operands[0] = rawInstruction.Operands[0].GetOperand(); 13 | Operands[1] = rawInstruction.Operands[1].GetOperand(); 14 | } 15 | 16 | public override X86OpCode OpCode => X86OpCode.MOV; 17 | 18 | public override void Execute(Dictionary registers, Stack localStack) 19 | { 20 | if (Operands[1] is X86ImmediateOperand) 21 | registers[((X86RegisterOperand) Operands[0]).Register.ToString()] = 22 | (Operands[1] as X86ImmediateOperand).Immediate; 23 | else 24 | registers[((X86RegisterOperand) Operands[0]).Register.ToString()] = 25 | registers[(Operands[1] as X86RegisterOperand).Register.ToString()]; 26 | } 27 | } 28 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Native/X86SUB.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using EasyPredicateKiller; 3 | using SharpDisasm; 4 | 5 | namespace ConfuserDeobfuscator.Engine.Routines.Ex.x86.Instructions 6 | { 7 | internal class X86SUB : X86Instruction 8 | { 9 | public X86SUB(Instruction rawInstruction) 10 | { 11 | Operands = new IX86Operand[2]; 12 | Operands[0] = rawInstruction.Operands[0].GetOperand(); 13 | Operands[1] = rawInstruction.Operands[1].GetOperand(); 14 | } 15 | 16 | public override X86OpCode OpCode => X86OpCode.SUB; 17 | 18 | public override void Execute(Dictionary registers, Stack localStack) 19 | { 20 | if (Operands[1] is X86ImmediateOperand) 21 | registers[((X86RegisterOperand) Operands[0]).Register.ToString()] -= 22 | ((X86ImmediateOperand) Operands[1]).Immediate; 23 | else 24 | registers[((X86RegisterOperand) Operands[0]).Register.ToString()] -= 25 | registers[((X86RegisterOperand) Operands[1]).Register.ToString()]; 26 | } 27 | } 28 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Native/X86XOR.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using EasyPredicateKiller; 3 | using SharpDisasm; 4 | 5 | namespace ConfuserDeobfuscator.Engine.Routines.Ex.x86.Instructions 6 | { 7 | internal class X86XOR : X86Instruction 8 | { 9 | public X86XOR(Instruction rawInstruction) 10 | { 11 | Operands = new IX86Operand[2]; 12 | Operands[0] = rawInstruction.Operands[0].GetOperand(); 13 | Operands[1] = rawInstruction.Operands[1].GetOperand(); 14 | } 15 | 16 | public override X86OpCode OpCode => X86OpCode.XOR; 17 | 18 | public override void Execute(Dictionary registers, Stack localStack) 19 | { 20 | if (Operands[1] is X86ImmediateOperand) 21 | registers[((X86RegisterOperand) Operands[0]).Register.ToString()] ^= 22 | ((X86ImmediateOperand) Operands[1]).Immediate; 23 | else 24 | registers[((X86RegisterOperand) Operands[0]).Register.ToString()] ^= 25 | registers[((X86RegisterOperand) Operands[1]).Register.ToString()]; 26 | } 27 | } 28 | } -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Misc/IsInst.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Reflection.Emit; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | using dnlib.DotNet; 8 | using dnlib.DotNet.Emit; 9 | using OpCodes = dnlib.DotNet.Emit.OpCodes; 10 | 11 | namespace CawkEmulatorV4.Instructions.Misc 12 | { 13 | class IsInst 14 | { 15 | public static void Emulate_Box(ValueStack valueStack, Instruction instruction) 16 | { 17 | var size = valueStack.CallStack.Pop(); 18 | var type = (ITypeDefOrRef)instruction.Operand; 19 | var adff = typeof(int); 20 | var dynamicMethod = new DynamicMethod("abc", typeof(object), new[] { typeof(object) }, typeof(string).Module, true); 21 | var ilg = dynamicMethod.GetILGenerator(); 22 | ilg.Emit(System.Reflection.Emit.OpCodes.Ldarg_0); 23 | ilg.Emit(System.Reflection.Emit.OpCodes.Isinst, adff); 24 | ilg.Emit(System.Reflection.Emit.OpCodes.Ret); 25 | valueStack.CallStack.Push(dynamicMethod.Invoke(null, new object[] { size })); 26 | } 27 | } 28 | } 29 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/MD/GuidStream.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | using dnlib.IO; 5 | 6 | namespace dnlib.DotNet.MD { 7 | /// 8 | /// Represents the #GUID stream 9 | /// 10 | public sealed class GuidStream : HeapStream { 11 | /// 12 | public GuidStream() { 13 | } 14 | 15 | /// 16 | public GuidStream(DataReaderFactory mdReaderFactory, uint metadataBaseOffset, StreamHeader streamHeader) 17 | : base(mdReaderFactory, metadataBaseOffset, streamHeader) { 18 | } 19 | 20 | /// 21 | public override bool IsValidIndex(uint index) => index == 0 || (index <= 0x10000000 && IsValidOffset((index - 1) * 16, 16)); 22 | 23 | /// 24 | /// Read a 25 | /// 26 | /// Index into this stream 27 | /// A or null if is 0 or invalid 28 | public Guid? Read(uint index) { 29 | if (index == 0 || !IsValidIndex(index)) 30 | return null; 31 | var reader = dataReader; 32 | reader.Position = (index - 1) * 16; 33 | return reader.ReadGuid(); 34 | } 35 | } 36 | } 37 | -------------------------------------------------------------------------------- /dnlib/src/PE/ImageDebugType.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.PE { 4 | /// 5 | /// Image debug type, see IMAGE_DEBUG_TYPE_* in winnt.n 6 | /// 7 | public enum ImageDebugType : uint { 8 | #pragma warning disable 1591 // Missing XML comment for publicly visible type or member 9 | Unknown = 0, 10 | Coff = 1, 11 | 12 | /// 13 | /// Contains PDB info 14 | /// 15 | CodeView = 2, 16 | 17 | FPO = 3, 18 | Misc = 4, 19 | Exception = 5, 20 | Fixup = 6, 21 | OmapToSrc = 7, 22 | OmapFromSrc = 8, 23 | Borland = 9, 24 | Reserved10 = 10, 25 | CLSID = 11, 26 | VcFeature = 12, 27 | POGO = 13, 28 | ILTCG = 14, 29 | MPX = 15, 30 | 31 | /// 32 | /// It's a deterministic (reproducible) PE file 33 | /// 34 | Reproducible = 16, 35 | 36 | /// 37 | /// Embedded portable PDB data 38 | /// 39 | EmbeddedPortablePdb = 17, 40 | 41 | /// 42 | /// Checksum of the PDB file. 0 or more entries allowed. 43 | /// 44 | PdbChecksum = 19, 45 | #pragma warning restore 1591 // Missing XML comment for publicly visible type or member 46 | } 47 | } 48 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Misc/Stobj.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.InteropServices; 3 | using dnlib.DotNet; 4 | using dnlib.DotNet.Emit; 5 | 6 | namespace CawkEmulatorV4.Instructions.Misc 7 | { 8 | internal class Stobj 9 | { 10 | public static void Emulate(ValueStack valueStack, Instruction instruction) 11 | { 12 | var obj = valueStack.CallStack.Pop(); 13 | var address = valueStack.CallStack.Pop(); 14 | var type = (ITypeDefOrRef) instruction.Operand; 15 | var typeResolve = typeof(string).Module.GetType(type.ReflectionFullName); 16 | var abc = obj; 17 | if (typeResolve == typeof(uint)) 18 | { 19 | abc = (uint) obj; 20 | } 21 | else if (typeResolve == typeof(int)) 22 | { 23 | abc = (int) obj; 24 | } 25 | else 26 | { 27 | abc = Convert.ChangeType(obj, typeResolve); 28 | } 29 | 30 | Marshal.StructureToPtr(abc, address, true); 31 | 32 | 33 | // var abc = Marshal.PtrToStructure(address, obj); 34 | } 35 | } 36 | } -------------------------------------------------------------------------------- /dnlib/src/PE/Subsystem.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.PE { 4 | /// 5 | /// IMAGE_OPTIONAL_HEADER.Subsystem 6 | /// 7 | public enum Subsystem : ushort { 8 | /// Unknown subsystem. 9 | Unknown = 0, 10 | /// Image doesn't require a subsystem. 11 | Native = 1, 12 | /// Image runs in the Windows GUI subsystem. 13 | WindowsGui = 2, 14 | /// Image runs in the Windows character subsystem. 15 | WindowsCui = 3, 16 | /// image runs in the OS/2 character subsystem. 17 | Os2Cui = 5, 18 | /// image runs in the Posix character subsystem. 19 | PosixCui = 7, 20 | /// image is a native Win9x driver. 21 | NativeWindows = 8, 22 | /// Image runs in the Windows CE subsystem. 23 | WindowsCeGui = 9, 24 | /// 25 | EfiApplication = 10, 26 | /// 27 | EfiBootServiceDriver = 11, 28 | /// 29 | EfiRuntimeDriver = 12, 30 | /// 31 | EfiRom = 13, 32 | /// 33 | Xbox = 14, 34 | /// 35 | WindowsBootApplication = 16, 36 | } 37 | } 38 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Writer/StrongNameSignature.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using dnlib.IO; 4 | using dnlib.PE; 5 | 6 | namespace dnlib.DotNet.Writer { 7 | /// 8 | /// Strong name signature chunk 9 | /// 10 | public sealed class StrongNameSignature : IReuseChunk { 11 | FileOffset offset; 12 | RVA rva; 13 | int size; 14 | 15 | /// 16 | public FileOffset FileOffset => offset; 17 | 18 | /// 19 | public RVA RVA => rva; 20 | 21 | /// 22 | /// Constructor 23 | /// 24 | /// Size of strong name signature 25 | public StrongNameSignature(int size) => this.size = size; 26 | 27 | bool IReuseChunk.CanReuse(RVA origRva, uint origSize) => (uint)size <= origSize; 28 | 29 | /// 30 | public void SetOffset(FileOffset offset, RVA rva) { 31 | this.offset = offset; 32 | this.rva = rva; 33 | } 34 | 35 | /// 36 | public uint GetFileLength() => (uint)size; 37 | 38 | /// 39 | public uint GetVirtualSize() => GetFileLength(); 40 | 41 | /// 42 | public void WriteTo(DataWriter writer) => writer.WriteZeroes(size); 43 | } 44 | } 45 | -------------------------------------------------------------------------------- /dnlib/dnlib.netstandard.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 15 4 | VisualStudioVersion = 15.0.26228.4 5 | MinimumVisualStudioVersion = 15.0.26206.0 6 | Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "dnlib.netstandard", "src\dnlib.netstandard.csproj", "{80695BC3-65CA-403E-B161-57D4F6EC5CC3}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|Any CPU = Debug|Any CPU 11 | Release|Any CPU = Release|Any CPU 12 | EndGlobalSection 13 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 14 | {80695BC3-65CA-403E-B161-57D4F6EC5CC3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 15 | {80695BC3-65CA-403E-B161-57D4F6EC5CC3}.Debug|Any CPU.Build.0 = Debug|Any CPU 16 | {80695BC3-65CA-403E-B161-57D4F6EC5CC3}.Release|Any CPU.ActiveCfg = Release|Any CPU 17 | {80695BC3-65CA-403E-B161-57D4F6EC5CC3}.Release|Any CPU.Build.0 = Release|Any CPU 18 | EndGlobalSection 19 | GlobalSection(SolutionProperties) = preSolution 20 | HideSolutionNode = FALSE 21 | EndGlobalSection 22 | GlobalSection(ExtensibilityGlobals) = postSolution 23 | SolutionGuid = {DA3B4267-5AB5-4A1D-A0D5-CF49A2882567} 24 | EndGlobalSection 25 | EndGlobal 26 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/MD/IRowReaders.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.MD { 4 | /// 5 | /// Reads metadata table columns 6 | /// 7 | public interface IColumnReader { 8 | /// 9 | /// Reads a column 10 | /// 11 | /// The table to read from 12 | /// Table row id 13 | /// The column to read 14 | /// Result 15 | /// true if was updated, false if 16 | /// the column should be read from the original table. 17 | bool ReadColumn(MDTable table, uint rid, ColumnInfo column, out uint value); 18 | } 19 | 20 | /// 21 | /// Reads table rows 22 | /// 23 | /// Raw row 24 | public interface IRowReader where TRow : struct { 25 | /// 26 | /// Reads a table row or returns false if the row should be read from the original table 27 | /// 28 | /// Row id 29 | /// The row 30 | /// 31 | bool TryReadRow(uint rid, out TRow row); 32 | } 33 | } 34 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/Portable/SymbolMethodImpl.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System.Collections.Generic; 4 | using dnlib.DotNet.Emit; 5 | using dnlib.DotNet.Pdb.Symbols; 6 | 7 | namespace dnlib.DotNet.Pdb.Portable { 8 | sealed class SymbolMethodImpl : SymbolMethod { 9 | readonly PortablePdbReader reader; 10 | readonly int token; 11 | readonly SymbolScope rootScope; 12 | readonly SymbolSequencePoint[] sequencePoints; 13 | readonly int kickoffMethod; 14 | 15 | public override int Token => token; 16 | public override SymbolScope RootScope => rootScope; 17 | public override IList SequencePoints => sequencePoints; 18 | public int KickoffMethod => kickoffMethod; 19 | 20 | public SymbolMethodImpl(PortablePdbReader reader, int token, SymbolScope rootScope, SymbolSequencePoint[] sequencePoints, int kickoffMethod) { 21 | this.reader = reader; 22 | this.token = token; 23 | this.rootScope = rootScope; 24 | this.sequencePoints = sequencePoints; 25 | this.kickoffMethod = kickoffMethod; 26 | } 27 | 28 | public override void GetCustomDebugInfos(MethodDef method, CilBody body, IList result) => 29 | reader.GetCustomDebugInfos(this, method, body, result); 30 | } 31 | } 32 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/Managed/PdbException.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | using System.Runtime.Serialization; 5 | 6 | namespace dnlib.DotNet.Pdb.Managed { 7 | /// 8 | /// Exception that is thrown when encounters an error. 9 | /// 10 | [Serializable] 11 | sealed class PdbException : Exception { 12 | /// 13 | /// Constructor 14 | /// 15 | public PdbException() { 16 | } 17 | 18 | /// 19 | /// Constructor 20 | /// 21 | /// Exception message 22 | public PdbException(string message) 23 | : base("Failed to read PDB: " + message) { 24 | } 25 | 26 | /// 27 | /// Constructor 28 | /// 29 | /// Inner exception 30 | public PdbException(Exception innerException) 31 | : base("Failed to read PDB: " + innerException.Message, innerException) { 32 | } 33 | 34 | /// 35 | /// Constructor 36 | /// 37 | /// 38 | /// 39 | public PdbException(SerializationInfo info, StreamingContext context) 40 | : base(info, context) { 41 | } 42 | } 43 | } 44 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/ICustomAttribute.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System.Collections.Generic; 4 | 5 | namespace dnlib.DotNet { 6 | /// 7 | /// Custom attribute interface. Implemented by and 8 | /// 9 | /// 10 | public interface ICustomAttribute { 11 | /// 12 | /// Gets the attribute type 13 | /// 14 | ITypeDefOrRef AttributeType { get; } 15 | 16 | /// 17 | /// Gets the full name of the attribute type 18 | /// 19 | string TypeFullName { get; } 20 | 21 | /// 22 | /// Gets all named arguments (field and property values) 23 | /// 24 | IList NamedArguments { get; } 25 | 26 | /// 27 | /// true if is not empty 28 | /// 29 | bool HasNamedArguments { get; } 30 | 31 | /// 32 | /// Gets all s that are field arguments 33 | /// 34 | IEnumerable Fields { get; } 35 | 36 | /// 37 | /// Gets all s that are property arguments 38 | /// 39 | IEnumerable Properties { get; } 40 | } 41 | } 42 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Writer/WriterUtils.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Writer { 4 | static class WriterUtils { 5 | public static uint WriteCompressedUInt32(this DataWriter writer, IWriterError helper, uint value) { 6 | if (value > 0x1FFFFFFF) { 7 | helper.Error("UInt32 value is too big and can't be compressed"); 8 | value = 0x1FFFFFFF; 9 | } 10 | writer.WriteCompressedUInt32(value); 11 | return value; 12 | } 13 | 14 | public static int WriteCompressedInt32(this DataWriter writer, IWriterError helper, int value) { 15 | if (value < -0x10000000) { 16 | helper.Error("Int32 value is too small and can't be compressed."); 17 | value = -0x10000000; 18 | } 19 | else if (value > 0x0FFFFFFF) { 20 | helper.Error("Int32 value is too big and can't be compressed."); 21 | value = 0x0FFFFFFF; 22 | } 23 | writer.WriteCompressedInt32(value); 24 | return value; 25 | } 26 | 27 | public static void Write(this DataWriter writer, IWriterError helper, UTF8String s) { 28 | if (UTF8String.IsNull(s)) { 29 | helper.Error("UTF8String is null"); 30 | s = UTF8String.Empty; 31 | } 32 | 33 | writer.WriteCompressedUInt32(helper, (uint)s.DataLength); 34 | writer.WriteBytes(s.Data); 35 | } 36 | } 37 | } 38 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/SequencePoint.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System.Diagnostics; 4 | 5 | namespace dnlib.DotNet.Pdb { 6 | /// 7 | /// PDB sequence point 8 | /// 9 | [DebuggerDisplay("({StartLine}, {StartColumn}) - ({EndLine}, {EndColumn}) {Document.Url}")] 10 | public sealed class SequencePoint { 11 | /// 12 | /// PDB document 13 | /// 14 | public PdbDocument Document { get; set; } 15 | 16 | /// 17 | /// Start line 18 | /// 19 | public int StartLine { get; set; } 20 | 21 | /// 22 | /// Start column 23 | /// 24 | public int StartColumn { get; set; } 25 | 26 | /// 27 | /// End line 28 | /// 29 | public int EndLine { get; set; } 30 | 31 | /// 32 | /// End column 33 | /// 34 | public int EndColumn { get; set; } 35 | 36 | /// 37 | /// Clones this instance 38 | /// 39 | /// A new cloned instance 40 | public SequencePoint Clone() { 41 | return new SequencePoint() { 42 | Document = Document, 43 | StartLine = StartLine, 44 | StartColumn = StartColumn, 45 | EndLine = EndLine, 46 | EndColumn = EndColumn, 47 | }; 48 | } 49 | } 50 | } 51 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Writer/ModuleWriterException.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | using System.Runtime.Serialization; 5 | 6 | namespace dnlib.DotNet.Writer { 7 | /// 8 | /// Thrown when the module writer encounters an unrecoverable error 9 | /// 10 | [Serializable] 11 | public class ModuleWriterException : Exception { 12 | /// 13 | /// Default constructor 14 | /// 15 | public ModuleWriterException() { 16 | } 17 | 18 | /// 19 | /// Constructor 20 | /// 21 | /// Error message 22 | public ModuleWriterException(string message) 23 | : base(message) { 24 | } 25 | 26 | /// 27 | /// Constructor 28 | /// 29 | /// Error message 30 | /// Other exception 31 | public ModuleWriterException(string message, Exception innerException) 32 | : base(message, innerException) { 33 | } 34 | 35 | /// 36 | /// Constructor 37 | /// 38 | /// 39 | /// 40 | protected ModuleWriterException(SerializationInfo info, StreamingContext context) 41 | : base(info, context) { 42 | } 43 | } 44 | } 45 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Emit/InvalidMethodException.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | using System.Runtime.Serialization; 5 | 6 | namespace dnlib.DotNet.Emit { 7 | /// 8 | /// Thrown when invalid data is detected while parsing a .NET method 9 | /// 10 | [Serializable] 11 | public class InvalidMethodException : Exception { 12 | /// 13 | /// Default constructor 14 | /// 15 | public InvalidMethodException() { 16 | } 17 | 18 | /// 19 | /// Constructor 20 | /// 21 | /// Error message 22 | public InvalidMethodException(string msg) 23 | : base(msg) { 24 | } 25 | 26 | /// 27 | /// Constructor 28 | /// 29 | /// Error message 30 | /// The inner exception or null if none 31 | public InvalidMethodException(string msg, Exception innerException) 32 | : base(msg, innerException) { 33 | } 34 | 35 | /// 36 | /// Constructor 37 | /// 38 | /// 39 | /// 40 | protected InvalidMethodException(SerializationInfo info, StreamingContext context) 41 | : base(info, context) { 42 | } 43 | } 44 | } 45 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/Dss/SymbolVariableImpl.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | using dnlib.DotNet.Pdb.Symbols; 5 | using dnlib.DotNet.Pdb.WindowsPdb; 6 | 7 | namespace dnlib.DotNet.Pdb.Dss { 8 | sealed class SymbolVariableImpl : SymbolVariable { 9 | readonly ISymUnmanagedVariable variable; 10 | 11 | public SymbolVariableImpl(ISymUnmanagedVariable variable) => this.variable = variable; 12 | 13 | public override int Index { 14 | get { 15 | variable.GetAddressField1(out uint result); 16 | return (int)result; 17 | } 18 | } 19 | 20 | public override PdbLocalAttributes Attributes { 21 | get { 22 | variable.GetAttributes(out uint result); 23 | if ((result & (uint)CorSymVarFlag.VAR_IS_COMP_GEN) != 0) 24 | return PdbLocalAttributes.DebuggerHidden; 25 | return PdbLocalAttributes.None; 26 | } 27 | } 28 | 29 | public override string Name { 30 | get { 31 | variable.GetName(0, out uint count, null); 32 | var chars = new char[count]; 33 | variable.GetName((uint)chars.Length, out count, chars); 34 | if (chars.Length == 0) 35 | return string.Empty; 36 | return new string(chars, 0, chars.Length - 1); 37 | } 38 | } 39 | 40 | public override PdbCustomDebugInfo[] CustomDebugInfos => Array2.Empty(); 41 | } 42 | } 43 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Arithmatic/Shr.cs: -------------------------------------------------------------------------------- 1 | namespace CawkEmulatorV4.Instructions.Arithmatic 2 | { 3 | internal class Shr 4 | { 5 | public static void Emulate(ValueStack valueStack) 6 | { 7 | var value1 = valueStack.CallStack.Pop(); 8 | var value2 = valueStack.CallStack.Pop(); 9 | var addedValue = value2 >> value1; 10 | 11 | valueStack.CallStack.Push(addedValue); 12 | } 13 | 14 | 15 | public static void Emulate_Un(ValueStack valueStack) 16 | { 17 | var value1 = valueStack.CallStack.Pop(); 18 | var value2 = valueStack.CallStack.Pop(); 19 | var shifted = (int) ((uint) value2 >> value1); 20 | // DynamicMethod dynamicMethod = new DynamicMethod("abc", value2.GetType(), new Type[] { value2.GetType(),value1.GetType() }, typeof(String).Module, true); 21 | // ILGenerator ilg = dynamicMethod.GetILGenerator(); 22 | // ilg.Emit(OpCodes.Ldarg_0); 23 | // ilg.Emit(OpCodes.Ldarg_1); 24 | // ilg.Emit(OpCodes.Shr_Un); 25 | // ilg.Emit(OpCodes.Ret); 26 | // var tester = dynamicMethod.Invoke(null, new object[] {value2, value1}); 27 | valueStack.CallStack.Push(shifted); 28 | } 29 | } 30 | } -------------------------------------------------------------------------------- /dnlib/Examples/Example5.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.IO; 3 | using dnlib.DotNet; 4 | using dnlib.PE; 5 | using dnlib.IO; 6 | 7 | namespace dnlib.Examples { 8 | /// 9 | /// Dumps all PE sections to disk 10 | /// 11 | public class Example5 { 12 | public static void Run() { 13 | string sectionFileName = @"c:\section{0}.bin"; 14 | 15 | // Open the current mscorlib 16 | var mod = ModuleDefMD.Load(typeof(int).Module); 17 | 18 | // Get PE image interface 19 | var peImage = mod.Metadata.PEImage; 20 | 21 | // Print some info 22 | Console.WriteLine("Machine: {0}", peImage.ImageNTHeaders.FileHeader.Machine); 23 | Console.WriteLine("Characteristics: {0}", peImage.ImageNTHeaders.FileHeader.Characteristics); 24 | 25 | Console.WriteLine("Dumping all sections"); 26 | for (int i = 0; i < peImage.ImageSectionHeaders.Count; i++) { 27 | var section = peImage.ImageSectionHeaders[i]; 28 | 29 | // Create a reader for the whole section 30 | var reader = peImage.CreateReader(section.VirtualAddress, section.SizeOfRawData); 31 | 32 | // Write the data to disk 33 | var fileName = string.Format(sectionFileName, i); 34 | Console.WriteLine("Dumping section {0} to file {1}", section.DisplayName, fileName); 35 | File.WriteAllBytes(fileName, reader.ToArray()); 36 | } 37 | } 38 | } 39 | } 40 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Native/X86IMUL.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using EasyPredicateKiller; 3 | using SharpDisasm; 4 | 5 | namespace ConfuserDeobfuscator.Engine.Routines.Ex.x86.Instructions 6 | { 7 | internal class X86IMUL : X86Instruction 8 | { 9 | public X86IMUL(Instruction rawInstruction) 10 | { 11 | Operands = new IX86Operand[3]; 12 | Operands[0] = rawInstruction.Operands[0].GetOperand(); 13 | Operands[1] = rawInstruction.Operands[1].GetOperand(); 14 | Operands[2] = rawInstruction.Operands[2].GetOperand(); 15 | } 16 | 17 | public override X86OpCode OpCode => X86OpCode.IMUL; 18 | 19 | public override void Execute(Dictionary registers, Stack localStack) 20 | { 21 | var source = ((X86RegisterOperand) Operands[0]).Register.ToString(); 22 | var target1 = ((X86RegisterOperand) Operands[1]).Register.ToString(); 23 | 24 | if (Operands[2] is X86ImmediateOperand) 25 | registers[source] = registers[target1] * ((X86ImmediateOperand) Operands[2]).Immediate; 26 | else 27 | registers[source] = 28 | registers[target1] * registers[((X86RegisterOperand) Operands[2]).Register.ToString()]; 29 | } 30 | } 31 | } -------------------------------------------------------------------------------- /dnlib/src/IO/FileSection.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System.Diagnostics; 4 | 5 | namespace dnlib.IO { 6 | /// 7 | /// Base class for classes needing to implement IFileSection 8 | /// 9 | [DebuggerDisplay("O:{startOffset} L:{size} {GetType().Name}")] 10 | public class FileSection : IFileSection { 11 | /// 12 | /// The start file offset of this section 13 | /// 14 | protected FileOffset startOffset; 15 | 16 | /// 17 | /// Size of the section 18 | /// 19 | protected uint size; 20 | 21 | /// 22 | public FileOffset StartOffset => startOffset; 23 | 24 | /// 25 | public FileOffset EndOffset => startOffset + size; 26 | 27 | /// 28 | /// Set to 's current position 29 | /// 30 | /// The reader 31 | protected void SetStartOffset(ref DataReader reader) => 32 | startOffset = (FileOffset)reader.CurrentOffset; 33 | 34 | /// 35 | /// Set according to 's current position 36 | /// 37 | /// The reader 38 | protected void SetEndoffset(ref DataReader reader) => 39 | size = reader.CurrentOffset - (uint)startOffset; 40 | } 41 | } 42 | -------------------------------------------------------------------------------- /dnlib/src/IO/EmptyDataStream.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System.Text; 4 | 5 | namespace dnlib.IO { 6 | sealed unsafe class EmptyDataStream : DataStream { 7 | public static readonly DataStream Instance = new EmptyDataStream(); 8 | 9 | EmptyDataStream() { } 10 | 11 | public override void ReadBytes(uint offset, void* destination, int length) { 12 | var p = (byte*)destination; 13 | for (int i = 0; i < length; i++) 14 | *p = 0; 15 | } 16 | public override void ReadBytes(uint offset, byte[] destination, int destinationIndex, int length) { 17 | for (int i = 0; i < length; i++) 18 | destination[destinationIndex + i] = 0; 19 | } 20 | public override byte ReadByte(uint offset) => 0; 21 | public override ushort ReadUInt16(uint offset) => 0; 22 | public override uint ReadUInt32(uint offset) => 0; 23 | public override ulong ReadUInt64(uint offset) => 0; 24 | public override float ReadSingle(uint offset) => 0; 25 | public override double ReadDouble(uint offset) => 0; 26 | public override string ReadUtf16String(uint offset, int chars) => string.Empty; 27 | public override string ReadString(uint offset, int length, Encoding encoding) => string.Empty; 28 | public override bool TryGetOffsetOf(uint offset, uint endOffset, byte value, out uint valueOffset) { 29 | valueOffset = 0; 30 | return false; 31 | } 32 | } 33 | } 34 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/CallingConvention.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet { 6 | /// 7 | /// See CorHdr.h/CorCallingConvention 8 | /// 9 | [Flags] 10 | public enum CallingConvention : byte { 11 | /// The managed calling convention 12 | Default = 0x0, 13 | /// 14 | C = 0x1, 15 | /// 16 | StdCall = 0x2, 17 | /// 18 | ThisCall = 0x3, 19 | /// 20 | FastCall = 0x4, 21 | /// 22 | VarArg = 0x5, 23 | /// 24 | Field = 0x6, 25 | /// 26 | LocalSig = 0x7, 27 | /// 28 | Property = 0x8, 29 | /// 30 | Unmanaged = 0x9, 31 | /// generic method instantiation 32 | GenericInst = 0xA, 33 | /// used ONLY for 64bit vararg PInvoke calls 34 | NativeVarArg = 0xB, 35 | 36 | /// Calling convention is bottom 4 bits 37 | Mask = 0x0F, 38 | 39 | /// Generic method 40 | Generic = 0x10, 41 | /// Method needs a 'this' parameter 42 | HasThis = 0x20, 43 | /// 'this' parameter is the first arg if set (else it's hidden) 44 | ExplicitThis = 0x40, 45 | /// Used internally by the CLR 46 | ReservedByCLR = 0x80, 47 | } 48 | } 49 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Writer/IOffsetHeap.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System.Collections.Generic; 4 | 5 | namespace dnlib.DotNet.Writer { 6 | /// 7 | /// Interface to get and set raw heap data. Implemented by the offset heaps: #Strings, 8 | /// #GUID, #Blob, and #US. 9 | /// 10 | /// Type of cooked data 11 | public interface IOffsetHeap { 12 | /// 13 | /// Gets the size of the data as raw data when written to the heap 14 | /// 15 | /// The data 16 | /// Size of the data as raw data when written to the heap 17 | int GetRawDataSize(TValue data); 18 | 19 | /// 20 | /// Overrides what value should be written to the heap. 21 | /// 22 | /// Offset of value. Must match an offset returned by 23 | /// 24 | /// The new raw data. The size must match the raw size exactly. 25 | void SetRawData(uint offset, byte[] rawData); 26 | 27 | /// 28 | /// Gets all inserted raw data and their offsets. The returned array 29 | /// is owned by the caller. 30 | /// 31 | /// An enumerable of all raw data and their offsets 32 | IEnumerable> GetAllRawData(); 33 | } 34 | } 35 | -------------------------------------------------------------------------------- /dnlib/src/PE/ImageDataDirectory.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | using System.Diagnostics; 5 | using dnlib.IO; 6 | 7 | namespace dnlib.PE { 8 | /// 9 | /// Represents the IMAGE_DATA_DIRECTORY PE section 10 | /// 11 | [DebuggerDisplay("{virtualAddress} {dataSize}")] 12 | public sealed class ImageDataDirectory : FileSection { 13 | readonly RVA virtualAddress; 14 | readonly uint dataSize; 15 | 16 | /// 17 | /// Returns the IMAGE_DATA_DIRECTORY.VirtualAddress field 18 | /// 19 | public RVA VirtualAddress => virtualAddress; 20 | 21 | /// 22 | /// Returns the IMAGE_DATA_DIRECTORY.Size field 23 | /// 24 | public uint Size => dataSize; 25 | 26 | /// 27 | /// Default constructor 28 | /// 29 | public ImageDataDirectory() { 30 | } 31 | 32 | /// 33 | /// Constructor 34 | /// 35 | /// PE file reader pointing to the start of this section 36 | /// Verify section 37 | /// Thrown if verification fails 38 | public ImageDataDirectory(ref DataReader reader, bool verify) { 39 | SetStartOffset(ref reader); 40 | virtualAddress = (RVA)reader.ReadUInt32(); 41 | dataSize = reader.ReadUInt32(); 42 | SetEndoffset(ref reader); 43 | } 44 | } 45 | } 46 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Emit/StackBehaviour.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Emit { 4 | /// 5 | /// CIL opcode stack behavior 6 | /// 7 | public enum StackBehaviour : byte { 8 | /// 9 | Pop0, 10 | /// 11 | Pop1, 12 | /// 13 | Pop1_pop1, 14 | /// 15 | Popi, 16 | /// 17 | Popi_pop1, 18 | /// 19 | Popi_popi, 20 | /// 21 | Popi_popi8, 22 | /// 23 | Popi_popi_popi, 24 | /// 25 | Popi_popr4, 26 | /// 27 | Popi_popr8, 28 | /// 29 | Popref, 30 | /// 31 | Popref_pop1, 32 | /// 33 | Popref_popi, 34 | /// 35 | Popref_popi_popi, 36 | /// 37 | Popref_popi_popi8, 38 | /// 39 | Popref_popi_popr4, 40 | /// 41 | Popref_popi_popr8, 42 | /// 43 | Popref_popi_popref, 44 | /// 45 | Push0, 46 | /// 47 | Push1, 48 | /// 49 | Push1_push1, 50 | /// 51 | Pushi, 52 | /// 53 | Pushi8, 54 | /// 55 | Pushr4, 56 | /// 57 | Pushr8, 58 | /// 59 | Pushref, 60 | /// 61 | Varpop, 62 | /// 63 | Varpush, 64 | /// 65 | Popref_popi_pop1, 66 | /// 67 | PopAll = 0xFF, 68 | } 69 | } 70 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/Managed/SymbolReaderFactory.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System.IO; 4 | using dnlib.DotNet.Pdb.Symbols; 5 | using dnlib.IO; 6 | 7 | namespace dnlib.DotNet.Pdb.Managed { 8 | /// 9 | /// Creates a instance 10 | /// 11 | static class SymbolReaderFactory { 12 | /// 13 | /// Creates a new instance 14 | /// 15 | /// PDB context 16 | /// PDB file stream which is now owned by this method 17 | /// A new instance or null. 18 | public static SymbolReader Create(PdbReaderContext pdbContext, DataReaderFactory pdbStream) { 19 | if (pdbStream == null) 20 | return null; 21 | try { 22 | var debugDir = pdbContext.CodeViewDebugDirectory; 23 | if (debugDir == null) 24 | return null; 25 | if (!pdbContext.TryGetCodeViewData(out var pdbGuid, out uint age)) 26 | return null; 27 | 28 | var pdbReader = new PdbReader(pdbGuid, age); 29 | pdbReader.Read(pdbStream.CreateReader()); 30 | if (pdbReader.MatchesModule) 31 | return pdbReader; 32 | return null; 33 | } 34 | catch (PdbException) { 35 | } 36 | catch (IOException) { 37 | } 38 | finally { 39 | pdbStream?.Dispose(); 40 | } 41 | return null; 42 | } 43 | } 44 | } 45 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/Symbols/SymbolSequencePoint.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System.Diagnostics; 4 | using System.Text; 5 | 6 | namespace dnlib.DotNet.Pdb.Symbols { 7 | /// 8 | /// Sequence point 9 | /// 10 | [DebuggerDisplay("{GetDebuggerString(),nq}")] 11 | public struct SymbolSequencePoint { 12 | /// 13 | /// IL offset 14 | /// 15 | public int Offset; 16 | 17 | /// 18 | /// Document 19 | /// 20 | public SymbolDocument Document; 21 | 22 | /// 23 | /// Start line 24 | /// 25 | public int Line; 26 | 27 | /// 28 | /// Start column 29 | /// 30 | public int Column; 31 | 32 | /// 33 | /// End line 34 | /// 35 | public int EndLine; 36 | 37 | /// 38 | /// End column 39 | /// 40 | public int EndColumn; 41 | 42 | string GetDebuggerString() { 43 | var sb = new StringBuilder(); 44 | if (Line == 0xFEEFEE && EndLine == 0xFEEFEE) 45 | sb.Append(""); 46 | else { 47 | sb.Append("("); 48 | sb.Append(Line); 49 | sb.Append(","); 50 | sb.Append(Column); 51 | sb.Append(")-("); 52 | sb.Append(EndLine); 53 | sb.Append(","); 54 | sb.Append(EndColumn); 55 | sb.Append(")"); 56 | } 57 | sb.Append(": "); 58 | sb.Append(Document.URL); 59 | return sb.ToString(); 60 | } 61 | } 62 | } 63 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/CustomDebugInfoGuids.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet.Pdb { 6 | /// 7 | /// Custom debug info guids 8 | /// 9 | public static class CustomDebugInfoGuids { 10 | #pragma warning disable 1591 // Missing XML comment for publicly visible type or member 11 | // Roslyn: PortableCustomDebugInfoKinds.cs 12 | public static readonly Guid AsyncMethodSteppingInformationBlob = new Guid("54FD2AC5-E925-401A-9C2A-F94F171072F8"); 13 | public static readonly Guid DefaultNamespace = new Guid("58B2EAB6-209F-4E4E-A22C-B2D0F910C782"); 14 | public static readonly Guid DynamicLocalVariables = new Guid("83C563C4-B4F3-47D5-B824-BA5441477EA8"); 15 | public static readonly Guid EmbeddedSource = new Guid("0E8A571B-6926-466E-B4AD-8AB04611F5FE"); 16 | public static readonly Guid EncLambdaAndClosureMap = new Guid("A643004C-0240-496F-A783-30D64F4979DE"); 17 | public static readonly Guid EncLocalSlotMap = new Guid("755F52A8-91C5-45BE-B4B8-209571E552BD"); 18 | public static readonly Guid SourceLink = new Guid("CC110556-A091-4D38-9FEC-25AB9A351A6A"); 19 | public static readonly Guid StateMachineHoistedLocalScopes = new Guid("6DA9A61E-F8C7-4874-BE62-68BC5630DF71"); 20 | public static readonly Guid TupleElementNames = new Guid("ED9FDF71-8879-4747-8ED3-FE5EDE3CE710"); 21 | #pragma warning restore 1591 // Missing XML comment for publicly visible type or member 22 | } 23 | } 24 | -------------------------------------------------------------------------------- /dnlib/LICENSE.txt: -------------------------------------------------------------------------------- 1 | dnlib: .NET assembly library 2 | https://github.com/0xd4d/dnlib 3 | 4 | Copyright (C) 2012-2018 de4dot@gmail.com 5 | 6 | Contributors 7 | ------------ 8 | 9 | Ki, "yck1509 ", https://github.com/yck1509 10 | kiootic, "kiootic ", https://github.com/kiootic 11 | SlowLogicBoy, https://github.com/SlowLogicBoy 12 | 13 | MIT LICENSE 14 | ----------- 15 | 16 | Permission is hereby granted, free of charge, to any person obtaining 17 | a copy of this software and associated documentation files (the 18 | "Software"), to deal in the Software without restriction, including 19 | without limitation the rights to use, copy, modify, merge, publish, 20 | distribute, sublicense, and/or sell copies of the Software, and to 21 | permit persons to whom the Software is furnished to do so, subject to 22 | the following conditions: 23 | 24 | The above copyright notice and this permission notice shall be 25 | included in all copies or substantial portions of the Software. 26 | 27 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 28 | EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 29 | MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. 30 | IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY 31 | CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, 32 | TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE 33 | SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 34 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Native/X86Instruction.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | 3 | namespace ConfuserDeobfuscator.Engine.Routines.Ex.x86 4 | { 5 | public enum X86OpCode 6 | { 7 | MOV, 8 | ADD, 9 | SUB, 10 | IMUL, 11 | DIV, 12 | NEG, 13 | NOT, 14 | XOR, 15 | POP 16 | } 17 | 18 | public enum X86Register 19 | { 20 | EAX = 0x25, 21 | ECX = 0x26, 22 | EDX = 0x27, 23 | EBX = 0x28, 24 | ESP = 0x29, 25 | EBP = 0x2a, 26 | ESI = 0x2b, 27 | EDI = 0x2c 28 | } 29 | 30 | 31 | public interface IX86Operand 32 | { 33 | } 34 | 35 | public class X86RegisterOperand : IX86Operand 36 | { 37 | public X86RegisterOperand(X86Register reg) 38 | { 39 | Register = reg; 40 | } 41 | 42 | public X86Register Register { get; set; } 43 | } 44 | 45 | public class X86ImmediateOperand : IX86Operand 46 | { 47 | public X86ImmediateOperand(int imm) 48 | { 49 | Immediate = imm; 50 | } 51 | 52 | public int Immediate { get; set; } 53 | } 54 | 55 | public abstract class X86Instruction 56 | { 57 | public abstract X86OpCode OpCode { get; } 58 | public IX86Operand[] Operands { get; set; } 59 | public abstract void Execute(Dictionary registers, Stack localStack); 60 | } 61 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/MD/StringsStream.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using dnlib.IO; 4 | 5 | namespace dnlib.DotNet.MD { 6 | /// 7 | /// Represents the #Strings stream 8 | /// 9 | public sealed class StringsStream : HeapStream { 10 | /// 11 | public StringsStream() { 12 | } 13 | 14 | /// 15 | public StringsStream(DataReaderFactory mdReaderFactory, uint metadataBaseOffset, StreamHeader streamHeader) 16 | : base(mdReaderFactory, metadataBaseOffset, streamHeader) { 17 | } 18 | 19 | /// 20 | /// Reads a 21 | /// 22 | /// Offset of string 23 | /// A instance or null if invalid offset 24 | public UTF8String Read(uint offset) { 25 | if (offset >= StreamLength) 26 | return null; 27 | byte[] data; 28 | var reader = dataReader; 29 | reader.Position = offset; 30 | data = reader.TryReadBytesUntil(0); 31 | if (data == null) 32 | return null; 33 | return new UTF8String(data); 34 | } 35 | 36 | /// 37 | /// Reads a . The empty string is returned if 38 | /// is invalid. 39 | /// 40 | /// Offset of string 41 | /// A instance 42 | public UTF8String ReadNoNull(uint offset) => Read(offset) ?? UTF8String.Empty; 43 | } 44 | } 45 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/MD/PdbStream.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using dnlib.IO; 4 | 5 | namespace dnlib.DotNet.MD { 6 | /// 7 | /// #Pdb stream 8 | /// 9 | public sealed class PdbStream : HeapStream { 10 | /// 11 | /// Gets the PDB id 12 | /// 13 | public byte[] Id { get; private set; } 14 | 15 | /// 16 | /// Gets the entry point token or 0 17 | /// 18 | public MDToken EntryPoint { get; private set; } 19 | 20 | /// 21 | /// Gets the referenced type system tables in the PE metadata file 22 | /// 23 | public ulong ReferencedTypeSystemTables { get; private set; } 24 | 25 | /// 26 | /// Gets all type system table rows. This array has exactly 64 elements. 27 | /// 28 | public uint[] TypeSystemTableRows { get; private set; } 29 | 30 | /// 31 | public PdbStream(DataReaderFactory mdReaderFactory, uint metadataBaseOffset, StreamHeader streamHeader) 32 | : base(mdReaderFactory, metadataBaseOffset, streamHeader) { 33 | var reader = CreateReader(); 34 | Id = reader.ReadBytes(20); 35 | EntryPoint = new MDToken(reader.ReadUInt32()); 36 | var tables = reader.ReadUInt64(); 37 | ReferencedTypeSystemTables = tables; 38 | var rows = new uint[64]; 39 | for (int i = 0; i < rows.Length; i++, tables >>= 1) { 40 | if (((uint)tables & 1) != 0) 41 | rows[i] = reader.ReadUInt32(); 42 | } 43 | TypeSystemTableRows = rows; 44 | } 45 | } 46 | } 47 | -------------------------------------------------------------------------------- /dnlib/src/PE/DllCharacteristics.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.PE { 6 | /// 7 | /// IMAGE_OPTIONAL_HEADER.DllCharacteristics 8 | /// 9 | [Flags] 10 | public enum DllCharacteristics : ushort { 11 | /// 12 | Reserved1 = 0x0001, 13 | /// 14 | Reserved2 = 0x0002, 15 | /// 16 | Reserved3 = 0x0004, 17 | /// 18 | Reserved4 = 0x0008, 19 | /// 20 | Reserved5 = 0x0010, 21 | /// Image can handle a high entropy 64-bit virtual address space. 22 | HighEntropyVA = 0x0020, 23 | /// DLL can move. 24 | DynamicBase = 0x0040, 25 | /// Code Integrity Image 26 | ForceIntegrity = 0x0080, 27 | /// Image is NX compatible 28 | NxCompat = 0x0100, 29 | /// Image understands isolation and doesn't want it 30 | NoIsolation = 0x0200, 31 | /// Image does not use SEH. No SE handler may reside in this image 32 | NoSeh = 0x0400, 33 | /// Do not bind this image. 34 | NoBind = 0x0800, 35 | /// Image should execute in an AppContainer 36 | AppContainer = 0x1000, 37 | /// Driver uses WDM model 38 | WdmDriver = 0x2000, 39 | /// Image supports Control Flow Guard. 40 | GuardCf = 0x4000, 41 | /// 42 | TerminalServerAware = 0x8000, 43 | } 44 | } 45 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/IDecrypters.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System.Collections.Generic; 4 | using dnlib.PE; 5 | using dnlib.DotNet.Emit; 6 | 7 | namespace dnlib.DotNet { 8 | /// 9 | /// Interface to decrypt methods 10 | /// 11 | public interface IMethodDecrypter { 12 | /// 13 | /// Gets the method's body 14 | /// 15 | /// Method rid 16 | /// The found in the method's Method row 17 | /// The method's parameters 18 | /// Generic parameter context 19 | /// Updated with the method's if this 20 | /// method returns true 21 | /// true if the method body was decrypted, false if the method isn't 22 | /// encrypted and the default body reader code should be used. 23 | bool GetMethodBody(uint rid, RVA rva, IList parameters, GenericParamContext gpContext, out MethodBody methodBody); 24 | } 25 | 26 | /// 27 | /// Interface to decrypt strings 28 | /// 29 | public interface IStringDecrypter { 30 | /// 31 | /// Reads a string 32 | /// 33 | /// String token 34 | /// A string or null if we should read it from the #US heap 35 | string ReadUserString(uint token); 36 | } 37 | } 38 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection; 2 | using System.Runtime.InteropServices; 3 | 4 | // General Information about an assembly is controlled through the following 5 | // set of attributes. Change these attribute values to modify the information 6 | // associated with an assembly. 7 | [assembly: AssemblyTitle("CawkEmulatorV4")] 8 | [assembly: AssemblyDescription("")] 9 | [assembly: AssemblyConfiguration("")] 10 | [assembly: AssemblyCompany("")] 11 | [assembly: AssemblyProduct("CawkEmulatorV4")] 12 | [assembly: AssemblyCopyright("Copyright © 2018")] 13 | [assembly: AssemblyTrademark("")] 14 | [assembly: AssemblyCulture("")] 15 | 16 | // Setting ComVisible to false makes the types in this assembly not visible 17 | // to COM components. If you need to access a type in this assembly from 18 | // COM, set the ComVisible attribute to true on that type. 19 | [assembly: ComVisible(false)] 20 | 21 | // The following GUID is for the ID of the typelib if this project is exposed to COM 22 | [assembly: Guid("377d5e82-8619-4db9-aeb8-d3b608484644")] 23 | 24 | // Version information for an assembly consists of the following four values: 25 | // 26 | // Major Version 27 | // Minor Version 28 | // Build Number 29 | // Revision 30 | // 31 | // You can specify all the values or you can default the Build and Revision Numbers 32 | // by using the '*' as shown below: 33 | // [assembly: AssemblyVersion("1.0.*")] 34 | [assembly: AssemblyVersion("1.0.0.0")] 35 | [assembly: AssemblyFileVersion("1.0.0.0")] -------------------------------------------------------------------------------- /dnlib/src/DotNet/Writer/DataReaderHeap.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | using dnlib.DotNet.MD; 5 | using dnlib.IO; 6 | 7 | namespace dnlib.DotNet.Writer { 8 | /// 9 | /// Copies existing data to a new metadata heap 10 | /// 11 | public sealed class DataReaderHeap : HeapBase { 12 | /// 13 | /// Gets the name of the heap 14 | /// 15 | public override string Name { get; } 16 | 17 | internal DotNetStream OptionalOriginalStream { get; } 18 | 19 | readonly DataReader heapReader; 20 | 21 | /// 22 | /// Constructor 23 | /// 24 | /// The stream whose data will be copied to the new metadata file 25 | public DataReaderHeap(DotNetStream stream) { 26 | OptionalOriginalStream = stream ?? throw new ArgumentNullException(nameof(stream)); 27 | heapReader = stream.CreateReader(); 28 | Name = stream.Name; 29 | } 30 | 31 | /// 32 | /// Constructor 33 | /// 34 | /// Heap name 35 | /// Heap content 36 | public DataReaderHeap(string name, DataReader heapReader) { 37 | this.heapReader = heapReader; 38 | this.heapReader.Position = 0; 39 | Name = name ?? throw new ArgumentNullException(nameof(name)); 40 | } 41 | 42 | /// 43 | public override uint GetRawLength() => heapReader.Length; 44 | 45 | /// 46 | protected override void WriteToImpl(DataWriter writer) => heapReader.CopyTo(writer); 47 | } 48 | } 49 | -------------------------------------------------------------------------------- /dnlib/Examples/Example1.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using dnlib.DotNet; 3 | 4 | namespace dnlib.Examples { 5 | // This example will open mscorlib.dll and then print out all types 6 | // in the assembly, including the number of methods, fields, properties 7 | // and events each type has. 8 | public class Example1 { 9 | public static void Run() { 10 | // Load mscorlib.dll 11 | var filename = typeof(void).Module.FullyQualifiedName; 12 | var mod = ModuleDefMD.Load(filename); 13 | 14 | int totalNumTypes = 0; 15 | // mod.Types only returns non-nested types. 16 | // mod.GetTypes() returns all types, including nested types. 17 | foreach (var type in mod.GetTypes()) { 18 | totalNumTypes++; 19 | Console.WriteLine(); 20 | Console.WriteLine("Type: {0}", type.FullName); 21 | if (type.BaseType != null) 22 | Console.WriteLine(" Base type: {0}", type.BaseType.FullName); 23 | 24 | Console.WriteLine(" Methods: {0}", type.Methods.Count); 25 | Console.WriteLine(" Fields: {0}", type.Fields.Count); 26 | Console.WriteLine(" Properties: {0}", type.Properties.Count); 27 | Console.WriteLine(" Events: {0}", type.Events.Count); 28 | Console.WriteLine(" Nested types: {0}", type.NestedTypes.Count); 29 | 30 | if (type.Interfaces.Count > 0) { 31 | Console.WriteLine(" Interfaces:"); 32 | foreach (var iface in type.Interfaces) 33 | Console.WriteLine(" {0}", iface.Interface.FullName); 34 | } 35 | } 36 | Console.WriteLine(); 37 | Console.WriteLine("Total number of types: {0}", totalNumTypes); 38 | } 39 | } 40 | } 41 | -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection; 2 | using System.Runtime.CompilerServices; 3 | using System.Runtime.InteropServices; 4 | 5 | // General Information about an assembly is controlled through the following 6 | // set of attributes. Change these attribute values to modify the information 7 | // associated with an assembly. 8 | [assembly: AssemblyTitle("ConfuserEx String Decryptor")] 9 | [assembly: AssemblyDescription("")] 10 | [assembly: AssemblyConfiguration("")] 11 | [assembly: AssemblyCompany("")] 12 | [assembly: AssemblyProduct("ConfuserEx String Decryptor")] 13 | [assembly: AssemblyCopyright("Copyright © 2018")] 14 | [assembly: AssemblyTrademark("")] 15 | [assembly: AssemblyCulture("")] 16 | 17 | // Setting ComVisible to false makes the types in this assembly not visible 18 | // to COM components. If you need to access a type in this assembly from 19 | // COM, set the ComVisible attribute to true on that type. 20 | [assembly: ComVisible(false)] 21 | 22 | // The following GUID is for the ID of the typelib if this project is exposed to COM 23 | [assembly: Guid("15389d87-1fdd-4ed6-93b4-5a020cf3ecca")] 24 | 25 | // Version information for an assembly consists of the following four values: 26 | // 27 | // Major Version 28 | // Minor Version 29 | // Build Number 30 | // Revision 31 | // 32 | // You can specify all the values or you can default the Build and Revision Numbers 33 | // by using the '*' as shown below: 34 | // [assembly: AssemblyVersion("1.0.*")] 35 | [assembly: AssemblyVersion("1.0.0.0")] 36 | [assembly: AssemblyFileVersion("1.0.0.0")] 37 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/RecursionCounter.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet { 6 | /// 7 | /// Recursion counter 8 | /// 9 | struct RecursionCounter { 10 | /// 11 | /// Max recursion count. If this is reached, we won't continue, and will use a default value. 12 | /// 13 | public const int MAX_RECURSION_COUNT = 100; 14 | int counter; 15 | 16 | /// 17 | /// Gets the recursion counter 18 | /// 19 | public int Counter => counter; 20 | 21 | /// 22 | /// Increments if it's not too high. ALL instance methods 23 | /// that can be called recursively must call this method and 24 | /// (if this method returns true) 25 | /// 26 | /// true if it was incremented and caller can continue, false if 27 | /// it was not incremented and the caller must return to its caller. 28 | public bool Increment() { 29 | if (counter >= MAX_RECURSION_COUNT) 30 | return false; 31 | counter++; 32 | return true; 33 | } 34 | 35 | /// 36 | /// Must be called before returning to caller if 37 | /// returned true. 38 | /// 39 | public void Decrement() { 40 | #if DEBUG 41 | if (counter <= 0) 42 | throw new InvalidOperationException("recursionCounter <= 0"); 43 | #endif 44 | counter--; 45 | } 46 | 47 | /// 48 | public override string ToString() => counter.ToString(); 49 | } 50 | } 51 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Fields/Ldsfld.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.IO; 3 | using dnlib.DotNet; 4 | using dnlib.DotNet.Emit; 5 | 6 | namespace CawkEmulatorV4.Instructions.Fields 7 | { 8 | internal class Ldsfld 9 | { 10 | public static void Emulate(ValueStack valueStack, Instruction instruction) 11 | { 12 | if (instruction.Operand.ToString().Contains("EmptyTypes")) 13 | { 14 | valueStack.CallStack.Push(new Type[0]); 15 | } 16 | else 17 | { 18 | if (instruction.Operand is FieldDef) 19 | { 20 | var abc = instruction.Operand as FieldDef; 21 | if (valueStack.Fields.ContainsKey(abc)) 22 | { 23 | if (valueStack.Fields[abc] is byte[]) 24 | { 25 | 26 | } 27 | 28 | valueStack.CallStack.Push(valueStack.Fields[abc]); 29 | } 30 | else 31 | { 32 | var fied = (FieldDef) instruction.Operand; 33 | if (fied.FieldType.IsValueType) 34 | valueStack.CallStack.Push(0); 35 | else 36 | valueStack.CallStack.Push(null); 37 | } 38 | } 39 | 40 | else 41 | { 42 | valueStack.CallStack.Push(null); 43 | } 44 | } 45 | } 46 | } 47 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/SecurityAction.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet { 4 | /// 5 | /// Security action. See CorHdr.h/CorDeclSecurity 6 | /// 7 | public enum SecurityAction : short { 8 | /// Mask allows growth of enum. 9 | ActionMask = 0x001F, 10 | /// 11 | ActionNil = 0x0000, 12 | /// 13 | Request = 0x0001, 14 | /// 15 | Demand = 0x0002, 16 | /// 17 | Assert = 0x0003, 18 | /// 19 | Deny = 0x0004, 20 | /// 21 | PermitOnly = 0x0005, 22 | /// 23 | LinktimeCheck = 0x0006, 24 | /// 25 | LinkDemand = LinktimeCheck, 26 | /// 27 | InheritanceCheck = 0x0007, 28 | /// 29 | InheritDemand = InheritanceCheck, 30 | /// 31 | RequestMinimum = 0x0008, 32 | /// 33 | RequestOptional = 0x0009, 34 | /// 35 | RequestRefuse = 0x000A, 36 | /// Persisted grant set at prejit time 37 | PrejitGrant = 0x000B, 38 | /// Persisted grant set at prejit time 39 | PreJitGrant = PrejitGrant, 40 | /// Persisted denied set at prejit time 41 | PrejitDenied = 0x000C, 42 | /// Persisted denied set at prejit time 43 | PreJitDeny = PrejitDenied, 44 | /// 45 | NonCasDemand = 0x000D, 46 | /// 47 | NonCasLinkDemand = 0x000E, 48 | /// 49 | NonCasInheritance = 0x000F, 50 | /// Maximum legal value 51 | MaximumValue = 0x000F, 52 | } 53 | } 54 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/SerializationType.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet { 4 | /// 5 | /// See CorSerializationType/CorHdr.h 6 | /// 7 | enum SerializationType : byte { 8 | /// 9 | Undefined = 0, 10 | /// System.Boolean 11 | Boolean = ElementType.Boolean, 12 | /// System.Char 13 | Char = ElementType.Char, 14 | /// System.SByte 15 | I1 = ElementType.I1, 16 | /// System.Byte 17 | U1 = ElementType.U1, 18 | /// System.Int16 19 | I2 = ElementType.I2, 20 | /// System.UInt16 21 | U2 = ElementType.U2, 22 | /// System.Int32 23 | I4 = ElementType.I4, 24 | /// System.UInt32 25 | U4 = ElementType.U4, 26 | /// System.Int64 27 | I8 = ElementType.I8, 28 | /// System.UInt64 29 | U8 = ElementType.U8, 30 | /// System.Single 31 | R4 = ElementType.R4, 32 | /// System.Double 33 | R8 = ElementType.R8, 34 | /// System.String 35 | String = ElementType.String, 36 | /// Single-dimension, zero lower bound array ([]) 37 | SZArray = ElementType.SZArray, 38 | /// System.Type 39 | Type = 0x50, 40 | /// Boxed value type 41 | TaggedObject= 0x51, 42 | /// A field 43 | Field = 0x53, 44 | /// A property 45 | Property = 0x54, 46 | /// An enum 47 | Enum = 0x55, 48 | } 49 | } 50 | -------------------------------------------------------------------------------- /dnlib/src/dnlib.netstandard.csproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | netstandard2.0;net35 5 | dnlib 6 | dnlib 7 | true 8 | true 9 | ..\dnlib.snk 10 | true 11 | ..\$(Configuration)\bin 12 | $(OutputPath)\$(TargetFramework)\$(AssemblyName).xml 13 | false 14 | 512 15 | strict 16 | latest 17 | true 18 | portable 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Writer/ChunkList.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | using System.Collections.Generic; 5 | 6 | namespace dnlib.DotNet.Writer { 7 | /// 8 | /// Contains a list of s 9 | /// 10 | public class ChunkList : ChunkListBase where T : class, IChunk { 11 | /// 12 | /// Default constructor 13 | /// 14 | public ChunkList() => chunks = new List(); 15 | 16 | /// 17 | /// Add a 18 | /// 19 | /// The chunk to add or null if none 20 | /// Chunk alignment 21 | public void Add(T chunk, uint alignment) { 22 | if (setOffsetCalled) 23 | throw new InvalidOperationException("SetOffset() has already been called"); 24 | if (chunk != null) 25 | chunks.Add(new Elem(chunk, alignment)); 26 | } 27 | 28 | /// 29 | /// Remove a 30 | /// 31 | /// The chunk to remove or null if none 32 | /// Alignment of the chunk, or null if the chunk cannot be removed. 33 | public uint? Remove(T chunk) { 34 | if (setOffsetCalled) 35 | throw new InvalidOperationException("SetOffset() has already been called"); 36 | if (chunk != null) { 37 | var chunks = this.chunks; 38 | for (int i = 0; i < chunks.Count; i++) { 39 | if (chunks[i].chunk == chunk) { 40 | uint alignment = chunks[i].alignment; 41 | chunks.RemoveAt(i); 42 | return alignment; 43 | } 44 | } 45 | } 46 | return null; 47 | } 48 | } 49 | } 50 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/MD/ComImageFlags.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet.MD { 6 | /// 7 | /// See COMIMAGE_FLAGS_XXX in CorHdr.h in the Windows SDK 8 | /// 9 | [Flags] 10 | public enum ComImageFlags : uint { 11 | /// 12 | /// See COMIMAGE_FLAGS_ILONLY in the Windows SDK 13 | /// 14 | ILOnly = 1, 15 | 16 | /// 17 | /// See COMIMAGE_FLAGS_32BITREQUIRED in the Windows SDK 18 | /// 19 | [Obsolete("Use " + nameof(Bit32Required), error: false)] 20 | _32BitRequired = Bit32Required, 21 | 22 | /// 23 | /// See COMIMAGE_FLAGS_32BITREQUIRED in the Windows SDK 24 | /// 25 | Bit32Required = 2, 26 | 27 | /// 28 | /// Set if a native header exists (COMIMAGE_FLAGS_IL_LIBRARY) 29 | /// 30 | ILLibrary = 4, 31 | 32 | /// 33 | /// See COMIMAGE_FLAGS_STRONGNAMESIGNED in the Windows SDK 34 | /// 35 | StrongNameSigned = 8, 36 | 37 | /// 38 | /// See COMIMAGE_FLAGS_NATIVE_ENTRYPOINT in the Windows SDK 39 | /// 40 | NativeEntryPoint = 0x10, 41 | 42 | /// 43 | /// See COMIMAGE_FLAGS_TRACKDEBUGDATA in the Windows SDK 44 | /// 45 | TrackDebugData = 0x10000, 46 | 47 | /// 48 | /// See COMIMAGE_FLAGS_32BITPREFERRED in the Windows SDK 49 | /// 50 | [Obsolete("Use " + nameof(Bit32Preferred), error: false)] 51 | _32BitPreferred = Bit32Preferred, 52 | 53 | /// 54 | /// See COMIMAGE_FLAGS_32BITPREFERRED in the Windows SDK 55 | /// 56 | Bit32Preferred = 0x20000, 57 | } 58 | } 59 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Pdb/PdbReaderOptions.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet.Pdb { 6 | /// 7 | /// PDB reader options 8 | /// 9 | [Flags] 10 | public enum PdbReaderOptions { 11 | /// 12 | /// No bit is set 13 | /// 14 | None = 0, 15 | 16 | /// 17 | /// Use the COM Windows PDB reader instead of the managed Windows PDB reader. 18 | /// 19 | /// This is NOT recommended since the COM reader can only be called on the same 20 | /// thread it was created on. It also requires a Windows OS. 21 | /// 22 | /// If this is not set, the managed PDB reader will be used. 23 | /// 24 | /// This option is only used if it's a Windows PDB file, not if it's a Portable PDB file. 25 | /// 26 | MicrosoftComReader = 0x00000001, 27 | 28 | /// 29 | /// Don't use Microsoft.DiaSymReader.Native. This is a NuGet package with an updated Windows PDB reader/writer implementation, 30 | /// and if it's available at runtime, dnlib will try to use it. If this option is set, dnlib won't use it. 31 | /// You have to add a reference to the NuGet package if you want to use it, dnlib has no reference to the NuGet package. 32 | /// 33 | /// Only used if is set and if it's a Windows PDB file 34 | /// 35 | NoDiaSymReader = 0x00000002, 36 | 37 | /// 38 | /// Don't use diasymreader.dll's PDB reader that is shipped with .NET Framework. 39 | /// 40 | /// Only used if is set and if it's a Windows PDB file 41 | /// 42 | NoOldDiaSymReader = 0x00000004, 43 | } 44 | } 45 | -------------------------------------------------------------------------------- /.NET-Instruction-Emulator-master/CawkEmulatorV4/Instructions/Misc/Box.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Reflection.Emit; 3 | using dnlib.DotNet; 4 | using dnlib.DotNet.Emit; 5 | using OpCodes = System.Reflection.Emit.OpCodes; 6 | 7 | namespace CawkEmulatorV4.Instructions.Misc 8 | { 9 | internal class Box 10 | { 11 | public static void Emulate_Box(ValueStack valueStack, Instruction instruction) 12 | { 13 | var size = valueStack.CallStack.Pop(); 14 | var type = (ITypeDefOrRef) instruction.Operand; 15 | var adff = typeof(string).Module.GetType(type.ReflectionFullName); 16 | var dynamicMethod = new DynamicMethod("abc", adff, new[] {typeof(int)}, typeof(string).Module, true); 17 | var ilg = dynamicMethod.GetILGenerator(); 18 | ilg.Emit(OpCodes.Ldarg_0); 19 | ilg.Emit(OpCodes.Box, adff); 20 | ilg.Emit(OpCodes.Ret); 21 | valueStack.CallStack.Push(dynamicMethod.Invoke(null, new object[] {size})); 22 | } 23 | 24 | public static void Emulate_UnBox(ValueStack valueStack) 25 | { 26 | } 27 | 28 | public static void Emulate_UnBox_Any(ValueStack valueStack, Instruction instruction) 29 | { 30 | var size = valueStack.CallStack.Pop(); 31 | var type = (ITypeDefOrRef) instruction.Operand; 32 | var adff = typeof(string).Module.GetType(type.ReflectionFullName); 33 | if (adff == null) 34 | { 35 | valueStack.CallStack.Push(size); 36 | } 37 | else 38 | { 39 | valueStack.CallStack.Push(Convert.ChangeType(size,adff)); 40 | } 41 | } 42 | } 43 | } -------------------------------------------------------------------------------- /dnlib/src/DotNet/Writer/ImportAddressTable.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using dnlib.IO; 4 | using dnlib.PE; 5 | 6 | namespace dnlib.DotNet.Writer { 7 | /// 8 | /// Import address table chunk 9 | /// 10 | public sealed class ImportAddressTable : IChunk { 11 | readonly bool is64bit; 12 | FileOffset offset; 13 | RVA rva; 14 | 15 | /// 16 | /// Gets/sets the 17 | /// 18 | public ImportDirectory ImportDirectory { get; set; } 19 | 20 | /// 21 | public FileOffset FileOffset => offset; 22 | 23 | /// 24 | public RVA RVA => rva; 25 | 26 | internal bool Enable { get; set; } 27 | 28 | /// 29 | /// Constructor 30 | /// 31 | /// true if it's a 64-bit PE file, false if it's a 32-bit PE file 32 | public ImportAddressTable(bool is64bit) => this.is64bit = is64bit; 33 | 34 | /// 35 | public void SetOffset(FileOffset offset, RVA rva) { 36 | this.offset = offset; 37 | this.rva = rva; 38 | } 39 | 40 | /// 41 | public uint GetFileLength() { 42 | if (!Enable) 43 | return 0; 44 | return is64bit ? 16U : 8; 45 | } 46 | 47 | /// 48 | public uint GetVirtualSize() => GetFileLength(); 49 | 50 | /// 51 | public void WriteTo(DataWriter writer) { 52 | if (!Enable) 53 | return; 54 | if (is64bit) { 55 | writer.WriteUInt64((ulong)(uint)ImportDirectory.CorXxxMainRVA); 56 | writer.WriteUInt64(0); 57 | } 58 | else { 59 | writer.WriteUInt32((uint)ImportDirectory.CorXxxMainRVA); 60 | writer.WriteInt32(0); 61 | } 62 | } 63 | } 64 | } 65 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/MethodImplAttributes.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet { 6 | /// 7 | /// Method impl attributes, see CorHdr.h/CorMethodImpl 8 | /// 9 | [Flags] 10 | public enum MethodImplAttributes : ushort { 11 | /// Flags about code type. 12 | CodeTypeMask = 0x0003, 13 | /// Method impl is IL. 14 | IL = 0x0000, 15 | /// Method impl is native. 16 | Native = 0x0001, 17 | /// Method impl is OPTIL 18 | OPTIL = 0x0002, 19 | /// Method impl is provided by the runtime. 20 | Runtime = 0x0003, 21 | 22 | /// Flags specifying whether the code is managed or unmanaged. 23 | ManagedMask = 0x0004, 24 | /// Method impl is unmanaged, otherwise managed. 25 | Unmanaged = 0x0004, 26 | /// Method impl is managed. 27 | Managed = 0x0000, 28 | 29 | /// Indicates method is defined; used primarily in merge scenarios. 30 | ForwardRef = 0x0010, 31 | /// Indicates method sig is not to be mangled to do HRESULT conversion. 32 | PreserveSig = 0x0080, 33 | 34 | /// Reserved for internal use. 35 | InternalCall = 0x1000, 36 | 37 | /// Method is single threaded through the body. 38 | Synchronized = 0x0020, 39 | /// Method may not be inlined. 40 | NoInlining = 0x0008, 41 | /// Method should be inlined if possible. 42 | AggressiveInlining = 0x0100, 43 | /// Method may not be optimized. 44 | NoOptimization = 0x0040, 45 | } 46 | } 47 | -------------------------------------------------------------------------------- /ConfuserEx String Decryptor/obj/Debug/ConfuserEx String Decryptor.csproj.FileListAbsolute.txt: -------------------------------------------------------------------------------- 1 | D:\Users\owner\source\ConfuserEx String Decryptor\ConfuserEx String Decryptor\bin\Debug\ConfuserEx String Decryptor.exe.config 2 | D:\Users\owner\source\ConfuserEx String Decryptor\ConfuserEx String Decryptor\bin\Debug\ConfuserEx String Decryptor.exe 3 | D:\Users\owner\source\ConfuserEx String Decryptor\ConfuserEx String Decryptor\bin\Debug\ConfuserEx String Decryptor.pdb 4 | D:\Users\owner\source\ConfuserEx String Decryptor\ConfuserEx String Decryptor\bin\Debug\CawkEmulatorV4.dll 5 | D:\Users\owner\source\ConfuserEx String Decryptor\ConfuserEx String Decryptor\bin\Debug\dnlib.dll 6 | D:\Users\owner\source\ConfuserEx String Decryptor\ConfuserEx String Decryptor\bin\Debug\SharpDisasm.dll 7 | D:\Users\owner\source\ConfuserEx String Decryptor\ConfuserEx String Decryptor\bin\Debug\CawkEmulatorV4.pdb 8 | D:\Users\owner\source\ConfuserEx String Decryptor\ConfuserEx String Decryptor\bin\Debug\dnlib.pdb 9 | D:\Users\owner\source\ConfuserEx String Decryptor\ConfuserEx String Decryptor\bin\Debug\dnlib.xml 10 | D:\Users\owner\source\ConfuserEx String Decryptor\ConfuserEx String Decryptor\obj\Debug\ConfuserEx String Decryptor.csprojAssemblyReference.cache 11 | D:\Users\owner\source\ConfuserEx String Decryptor\ConfuserEx String Decryptor\obj\Debug\ConfuserEx String Decryptor.csproj.CoreCompileInputs.cache 12 | D:\Users\owner\source\ConfuserEx String Decryptor\ConfuserEx String Decryptor\obj\Debug\ConfuserEx String Decryptor.csproj.CopyComplete 13 | D:\Users\owner\source\ConfuserEx String Decryptor\ConfuserEx String Decryptor\obj\Debug\ConfuserEx String Decryptor.exe 14 | D:\Users\owner\source\ConfuserEx String Decryptor\ConfuserEx String Decryptor\obj\Debug\ConfuserEx String Decryptor.pdb 15 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Emit/ExceptionHandler.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet.Emit { 4 | /// 5 | /// A CIL method exception handler 6 | /// 7 | public sealed class ExceptionHandler { 8 | /// 9 | /// First instruction of try block 10 | /// 11 | public Instruction TryStart; 12 | 13 | /// 14 | /// One instruction past the end of try block or null if it ends at the end 15 | /// of the method. 16 | /// 17 | public Instruction TryEnd; 18 | 19 | /// 20 | /// Start of filter handler or null if none. The end of filter handler is 21 | /// always . 22 | /// 23 | public Instruction FilterStart; 24 | 25 | /// 26 | /// First instruction of try handler block 27 | /// 28 | public Instruction HandlerStart; 29 | 30 | /// 31 | /// One instruction past the end of try handler block or null if it ends at the end 32 | /// of the method. 33 | /// 34 | public Instruction HandlerEnd; 35 | 36 | /// 37 | /// The catch type if is 38 | /// 39 | public ITypeDefOrRef CatchType; 40 | 41 | /// 42 | /// Type of exception handler clause 43 | /// 44 | public ExceptionHandlerType HandlerType; 45 | 46 | /// 47 | /// Default constructor 48 | /// 49 | public ExceptionHandler() { 50 | } 51 | 52 | /// 53 | /// Constructor 54 | /// 55 | /// Exception clause type 56 | public ExceptionHandler(ExceptionHandlerType handlerType) => HandlerType = handlerType; 57 | } 58 | } 59 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/PublicKey.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System.Threading; 4 | 5 | namespace dnlib.DotNet { 6 | /// 7 | /// Represents a public key 8 | /// 9 | public sealed class PublicKey : PublicKeyBase { 10 | const AssemblyHashAlgorithm DEFAULT_ALGORITHM = AssemblyHashAlgorithm.SHA1; 11 | PublicKeyToken publicKeyToken; 12 | 13 | /// 14 | /// Gets the 15 | /// 16 | public override PublicKeyToken Token { 17 | get { 18 | if (publicKeyToken == null && !IsNullOrEmpty) 19 | Interlocked.CompareExchange(ref publicKeyToken, AssemblyHash.CreatePublicKeyToken(data), null); 20 | return publicKeyToken; 21 | } 22 | } 23 | 24 | /// 25 | public override byte[] Data => data; 26 | 27 | /// 28 | /// Constructor 29 | /// 30 | public PublicKey() : base((byte[])null) { } 31 | 32 | /// 33 | /// Constructor 34 | /// 35 | /// Public key data 36 | public PublicKey(byte[] data) 37 | : base(data) { 38 | } 39 | 40 | /// 41 | /// Constructor 42 | /// 43 | /// Public key data as a hex string or the string "null" 44 | /// to set public key data to null 45 | public PublicKey(string hexString) 46 | : base(hexString) { 47 | } 48 | 49 | /// 50 | public override bool Equals(object obj) { 51 | if ((object)this == obj) 52 | return true; 53 | var other = obj as PublicKey; 54 | if (other == null) 55 | return false; 56 | return Utils.Equals(Data, other.Data); 57 | } 58 | 59 | /// 60 | public override int GetHashCode() => Utils.GetHashCode(Data); 61 | } 62 | } 63 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/MD/USStream.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | using dnlib.IO; 5 | 6 | namespace dnlib.DotNet.MD { 7 | /// 8 | /// Represents the #US stream 9 | /// 10 | public sealed class USStream : HeapStream { 11 | /// 12 | public USStream() { 13 | } 14 | 15 | /// 16 | public USStream(DataReaderFactory mdReaderFactory, uint metadataBaseOffset, StreamHeader streamHeader) 17 | : base(mdReaderFactory, metadataBaseOffset, streamHeader) { 18 | } 19 | 20 | /// 21 | /// Reads a unicode string 22 | /// 23 | /// Offset of unicode string 24 | /// A string or null if is invalid 25 | public string Read(uint offset) { 26 | if (offset == 0) 27 | return string.Empty; 28 | if (!IsValidOffset(offset)) 29 | return null; 30 | var reader = dataReader; 31 | reader.Position = offset; 32 | if (!reader.TryReadCompressedUInt32(out uint length)) 33 | return null; 34 | if (!reader.CanRead(length)) 35 | return null; 36 | try { 37 | return reader.ReadUtf16String((int)(length / 2)); 38 | } 39 | catch (OutOfMemoryException) { 40 | throw; 41 | } 42 | catch { 43 | // It's possible that an exception is thrown when converting a char* to 44 | // a string. If so, return an empty string. 45 | return string.Empty; 46 | } 47 | } 48 | 49 | /// 50 | /// Reads data just like , but returns an empty string if 51 | /// offset is invalid 52 | /// 53 | /// Offset of unicode string 54 | /// The string 55 | public string ReadNoNull(uint offset) => Read(offset) ?? string.Empty; 56 | } 57 | } 58 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/MD/TableInfo.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System.Diagnostics; 4 | 5 | namespace dnlib.DotNet.MD { 6 | /// 7 | /// Info about one MD table 8 | /// 9 | [DebuggerDisplay("{rowSize} {name}")] 10 | public sealed class TableInfo { 11 | readonly Table table; 12 | int rowSize; 13 | readonly ColumnInfo[] columns; 14 | readonly string name; 15 | 16 | /// 17 | /// Returns the table type 18 | /// 19 | public Table Table => table; 20 | 21 | /// 22 | /// Returns the total size of a row in bytes 23 | /// 24 | public int RowSize { 25 | get => rowSize; 26 | internal set => rowSize = value; 27 | } 28 | 29 | /// 30 | /// Returns all the columns 31 | /// 32 | public ColumnInfo[] Columns => columns; 33 | 34 | /// 35 | /// Returns the name of the table 36 | /// 37 | public string Name => name; 38 | 39 | /// 40 | /// Constructor 41 | /// 42 | /// Table type 43 | /// Table name 44 | /// All columns 45 | public TableInfo(Table table, string name, ColumnInfo[] columns) { 46 | this.table = table; 47 | this.name = name; 48 | this.columns = columns; 49 | } 50 | 51 | /// 52 | /// Constructor 53 | /// 54 | /// Table type 55 | /// Table name 56 | /// All columns 57 | /// Row size 58 | public TableInfo(Table table, string name, ColumnInfo[] columns, int rowSize) { 59 | this.table = table; 60 | this.name = name; 61 | this.columns = columns; 62 | this.rowSize = rowSize; 63 | } 64 | } 65 | } 66 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/PInvokeAttributes.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | 5 | namespace dnlib.DotNet { 6 | /// 7 | /// P/Invoke attributes, see CorHdr.h/CorPinvokeMap 8 | /// 9 | [Flags] 10 | public enum PInvokeAttributes : ushort { 11 | /// Pinvoke is to use the member name as specified. 12 | NoMangle = 0x0001, 13 | 14 | /// Use this mask to retrieve the CharSet information. 15 | CharSetMask = 0x0006, 16 | /// 17 | CharSetNotSpec = 0x0000, 18 | /// 19 | CharSetAnsi = 0x0002, 20 | /// 21 | CharSetUnicode = 0x0004, 22 | /// 23 | CharSetAuto = 0x0006, 24 | 25 | /// 26 | BestFitUseAssem = 0x0000, 27 | /// 28 | BestFitEnabled = 0x0010, 29 | /// 30 | BestFitDisabled = 0x0020, 31 | /// 32 | BestFitMask = 0x0030, 33 | 34 | /// 35 | ThrowOnUnmappableCharUseAssem = 0x0000, 36 | /// 37 | ThrowOnUnmappableCharEnabled = 0x1000, 38 | /// 39 | ThrowOnUnmappableCharDisabled = 0x2000, 40 | /// 41 | ThrowOnUnmappableCharMask = 0x3000, 42 | 43 | /// Information about target function. Not relevant for fields. 44 | SupportsLastError = 0x0040, 45 | 46 | /// 47 | CallConvMask = 0x0700, 48 | /// Pinvoke will use native callconv appropriate to target windows platform. 49 | CallConvWinapi = 0x0100, 50 | /// 51 | CallConvCdecl = 0x0200, 52 | /// 53 | CallConvStdcall = 0x0300, 54 | /// 55 | CallConvStdCall = CallConvStdcall, 56 | /// In M9, pinvoke will raise exception. 57 | CallConvThiscall = 0x0400, 58 | /// 59 | CallConvFastcall = 0x0500, 60 | } 61 | } 62 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Writer/SerializerMethodContext.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System.Collections.Generic; 4 | using System.Diagnostics; 5 | using dnlib.DotNet.Emit; 6 | 7 | namespace dnlib.DotNet.Writer { 8 | sealed class SerializerMethodContext { 9 | readonly Dictionary toOffset; 10 | readonly IWriterError helper; 11 | MethodDef method; 12 | CilBody body; 13 | uint bodySize; 14 | bool dictInitd; 15 | 16 | public bool HasBody => body != null; 17 | 18 | public SerializerMethodContext(IWriterError helper) { 19 | toOffset = new Dictionary(); 20 | this.helper = helper; 21 | } 22 | 23 | internal void SetBody(MethodDef method) { 24 | if (this.method != method) { 25 | toOffset.Clear(); 26 | this.method = method; 27 | body = method?.Body; 28 | dictInitd = false; 29 | } 30 | } 31 | 32 | public uint GetOffset(Instruction instr) { 33 | if (!dictInitd) { 34 | Debug.Assert(body != null); 35 | if (body == null) 36 | return 0; 37 | InitializeDict(); 38 | } 39 | if (instr == null) 40 | return bodySize; 41 | if (toOffset.TryGetValue(instr, out uint offset)) 42 | return offset; 43 | helper.Error("Couldn't find an instruction, maybe it was removed. It's still being referenced by some code or by the PDB"); 44 | return bodySize; 45 | } 46 | 47 | public bool IsSameMethod(MethodDef method) => this.method == method; 48 | 49 | void InitializeDict() { 50 | Debug.Assert(body != null); 51 | Debug.Assert(toOffset.Count == 0); 52 | uint offset = 0; 53 | var instrs = body.Instructions; 54 | for(int i = 0; i < instrs.Count; i++) { 55 | var instr = instrs[i]; 56 | toOffset[instr] = offset; 57 | offset += (uint)instr.GetSize(); 58 | } 59 | bodySize = offset; 60 | dictInitd = true; 61 | } 62 | } 63 | } 64 | -------------------------------------------------------------------------------- /dnlib/src/IO/DataStreamFactory.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | using System.Diagnostics; 5 | using dnlib.PE; 6 | 7 | namespace dnlib.IO { 8 | /// 9 | /// Creates s 10 | /// 11 | public static unsafe class DataStreamFactory { 12 | //TODO: There are other places that use pointers that also need to be updated 13 | static bool supportsUnalignedAccesses = CalculateSupportsUnalignedAccesses(); 14 | 15 | static bool CalculateSupportsUnalignedAccesses() { 16 | var machine = ProcessorArchUtils.GetProcessCpuArchitecture(); 17 | switch (machine) { 18 | case Machine.I386: 19 | case Machine.AMD64: 20 | return true; 21 | case Machine.ARMNT: 22 | case Machine.ARM64: 23 | return false; 24 | default: 25 | Debug.Fail($"Unknown CPU arch: {machine}"); 26 | return true; 27 | } 28 | } 29 | 30 | /// 31 | /// Creates a that reads from native memory 32 | /// 33 | /// Pointer to data 34 | /// 35 | public static DataStream Create(byte* data) { 36 | if (data == null) 37 | throw new ArgumentNullException(nameof(data)); 38 | if (supportsUnalignedAccesses) 39 | return new UnalignedNativeMemoryDataStream(data); 40 | return new AlignedNativeMemoryDataStream(data); 41 | } 42 | 43 | /// 44 | /// Creates a that reads from a byte array 45 | /// 46 | /// Data 47 | /// 48 | public static DataStream Create(byte[] data) { 49 | if (data == null) 50 | throw new ArgumentNullException(nameof(data)); 51 | if (supportsUnalignedAccesses) 52 | return new UnalignedByteArrayDataStream(data); 53 | return new AlignedByteArrayDataStream(data); 54 | } 55 | } 56 | } 57 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/AssemblyHashAlgorithm.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | namespace dnlib.DotNet { 4 | /// 5 | /// Any ALG_CLASS_HASH type in WinCrypt.h can be used by Microsoft's CLI implementation 6 | /// 7 | public enum AssemblyHashAlgorithm : uint { 8 | /// 9 | None = 0, 10 | /// 11 | MD2 = 0x8001, 12 | /// 13 | MD4 = 0x8002, 14 | /// This is a reserved value in the CLI 15 | MD5 = 0x8003, 16 | /// The only algorithm supported by the CLI 17 | SHA1 = 0x8004, 18 | /// 19 | MAC = 0x8005, 20 | /// 21 | SSL3_SHAMD5 = 0x8008, 22 | /// 23 | HMAC = 0x8009, 24 | /// 25 | TLS1PRF = 0x800A, 26 | /// 27 | HASH_REPLACE_OWF = 0x800B, 28 | /// 29 | SHA_256 = 0x800C, 30 | /// 31 | SHA_384 = 0x800D, 32 | /// 33 | SHA_512 = 0x800E, 34 | } 35 | 36 | public static partial class Extensions { 37 | internal static string GetName(this AssemblyHashAlgorithm hashAlg) { 38 | switch (hashAlg) { 39 | case AssemblyHashAlgorithm.MD2: return null; 40 | case AssemblyHashAlgorithm.MD4: return null; 41 | case AssemblyHashAlgorithm.MD5: return "MD5"; 42 | case AssemblyHashAlgorithm.SHA1: return "SHA1"; 43 | case AssemblyHashAlgorithm.MAC: return null; 44 | case AssemblyHashAlgorithm.SSL3_SHAMD5: return null; 45 | case AssemblyHashAlgorithm.HMAC: return null; 46 | case AssemblyHashAlgorithm.TLS1PRF: return null; 47 | case AssemblyHashAlgorithm.HASH_REPLACE_OWF: return null; 48 | case AssemblyHashAlgorithm.SHA_256: return "SHA256"; 49 | case AssemblyHashAlgorithm.SHA_384: return "SHA384"; 50 | case AssemblyHashAlgorithm.SHA_512: return "SHA512"; 51 | default: return null; 52 | } 53 | } 54 | } 55 | } 56 | -------------------------------------------------------------------------------- /dnlib/src/DotNet/Writer/UniqueChunkList.cs: -------------------------------------------------------------------------------- 1 | // dnlib: See LICENSE.txt for more info 2 | 3 | using System; 4 | using System.Collections.Generic; 5 | using dnlib.IO; 6 | using dnlib.PE; 7 | 8 | namespace dnlib.DotNet.Writer { 9 | /// 10 | /// Re-uses existing chunks to save space 11 | /// 12 | /// Chunk type 13 | public sealed class UniqueChunkList : ChunkListBase where T : class, IChunk { 14 | Dictionary dict; 15 | 16 | /// 17 | /// Default constructor 18 | /// 19 | public UniqueChunkList() 20 | : this(EqualityComparer.Default) { 21 | } 22 | 23 | /// 24 | /// Constructor 25 | /// 26 | /// Compares the chunk type 27 | public UniqueChunkList(IEqualityComparer chunkComparer) { 28 | chunks = new List(); 29 | dict = new Dictionary(new ElemEqualityComparer(chunkComparer)); 30 | } 31 | 32 | /// 33 | public override void SetOffset(FileOffset offset, RVA rva) { 34 | dict = null; 35 | base.SetOffset(offset, rva); 36 | } 37 | 38 | /// 39 | /// Adds a if not already present 40 | /// 41 | /// The chunk to add or null if none 42 | /// Chunk alignment 43 | /// The original input if it wasn't present, or the cached one 44 | public T Add(T chunk, uint alignment) { 45 | if (setOffsetCalled) 46 | throw new InvalidOperationException("SetOffset() has already been called"); 47 | if (chunk == null) 48 | return null; 49 | var elem = new Elem(chunk, alignment); 50 | if (dict.TryGetValue(elem, out var other)) 51 | return other.chunk; 52 | dict[elem] = elem; 53 | chunks.Add(elem); 54 | return elem.chunk; 55 | } 56 | } 57 | } 58 | --------------------------------------------------------------------------------