├── .github └── workflows │ └── main.yml ├── .gitignore ├── .gitmodules ├── AssemblyData ├── AssemblyData.csproj ├── AssemblyResolver.cs ├── AssemblyServer.cs ├── AssemblyService.cs ├── DelegateStringDecrypter.cs ├── EmuStringDecrypter.cs ├── GenericService.cs ├── IAssemblyService.cs ├── IGenericService.cs ├── IMethodDecrypterService.cs ├── IStringDecrypter.cs ├── IStringDecrypterService.cs ├── IUserGenericService.cs ├── MethodDecrypterService.cs ├── Properties │ └── AssemblyInfo.cs ├── SimpleData.cs ├── StringDecrypterService.cs ├── Utils.cs └── methodsrewriter │ ├── AssemblyResolver.cs │ ├── CodeGenerator.cs │ ├── IMethodsRewriter.cs │ ├── MField.cs │ ├── MMethod.cs │ ├── MModule.cs │ ├── MType.cs │ ├── MethodsRewriter.cs │ ├── Operand.cs │ ├── Resolver.cs │ ├── ResolverUtils.cs │ ├── TypeInstanceResolver.cs │ └── TypeResolver.cs ├── AssemblyServer-CLR20-x64 ├── App.config ├── AssemblyServer-CLR20-x64.csproj ├── Program.cs └── Properties │ └── AssemblyInfo.cs ├── AssemblyServer-CLR20 ├── App.config ├── AssemblyServer-CLR20.csproj ├── Program.cs └── Properties │ └── AssemblyInfo.cs ├── AssemblyServer-CLR40-x64 ├── App.config ├── AssemblyServer-CLR40-x64.csproj ├── Program.cs └── Properties │ └── AssemblyInfo.cs ├── AssemblyServer-CLR40 ├── App.config ├── AssemblyServer-CLR40.csproj ├── Program.cs └── Properties │ └── AssemblyInfo.cs ├── AssemblyServer-x64 ├── App.config ├── AssemblyServer-x64.csproj ├── Program.cs └── Properties │ └── AssemblyInfo.cs ├── AssemblyServer ├── App.config ├── AssemblyServer.csproj ├── Program.cs └── Properties │ └── AssemblyInfo.cs ├── BeaEngine.dll ├── COPYING ├── LICENSE.ICSharpCode.SharpZipLib.txt ├── LICENSE.QuickLZ.txt ├── LICENSE.de4dot.txt ├── LICENSE.dnlib.txt ├── LICENSE.lzma.txt ├── LICENSE.lzmat.txt ├── LICENSE.randomc.txt ├── LinqBridge.dll ├── README-orig.md ├── README.md ├── Test.Rename.Dll ├── Properties │ └── AssemblyInfo.cs ├── Test.Rename.Dll.csproj └── Tests.cs ├── Test.Rename ├── Program.cs ├── Properties │ └── AssemblyInfo.cs └── Test.Rename.csproj ├── de4dot-x64 ├── App.config ├── Program.cs ├── Properties │ └── AssemblyInfo.cs └── de4dot-x64.csproj ├── de4dot.blocks ├── BaseBlock.cs ├── Block.cs ├── Blocks.cs ├── BlocksSorter.cs ├── CodeGenerator.cs ├── DeadBlocksRemover.cs ├── DotNetUtils.cs ├── DumpedMethod.cs ├── DumpedMethods.cs ├── FilterHandlerBlock.cs ├── ForwardScanOrder.cs ├── GenericArgsSubstitutor.cs ├── HandlerBlock.cs ├── Instr.cs ├── InstructionListParser.cs ├── MemberDefDict.cs ├── MethodBlocks.cs ├── Properties │ └── AssemblyInfo.cs ├── ScopeBlock.cs ├── StackTracePatcher.cs ├── SwitchData.cs ├── TryBlock.cs ├── TryHandlerBlock.cs ├── Utils.cs ├── cflow │ ├── AccessChecker.cs │ ├── BlockCflowDeobfuscator.cs │ ├── BlockDeobfuscator.cs │ ├── BlocksCflowDeobfuscator.cs │ ├── BranchEmulator.cs │ ├── CachedCflowDeobfuscator.cs │ ├── CflowDeobfuscator.cs │ ├── CflowUtils.cs │ ├── ConstantsFolder.cs │ ├── DeadCodeRemover.cs │ ├── DeadStoreRemover.cs │ ├── DupBlockDeobfuscator.cs │ ├── IBlocksDeobfuscator.cs │ ├── ICflowDeobfuscator.cs │ ├── InstructionEmulator.cs │ ├── Int32Value.cs │ ├── Int64Value.cs │ ├── MethodCallInliner.cs │ ├── MethodCallInlinerBase.cs │ ├── Real8Value.cs │ ├── StLdlocFixer.cs │ ├── SwitchCflowDeobfuscator.cs │ ├── Value.cs │ └── ValueStack.cs └── de4dot.blocks.csproj ├── de4dot.code ├── 7zip │ ├── Compress │ │ ├── LZ │ │ │ └── LzOutWindow.cs │ │ ├── LZMA │ │ │ ├── LzmaBase.cs │ │ │ └── LzmaDecoder.cs │ │ └── RangeCoder │ │ │ ├── RangeCoder.cs │ │ │ ├── RangeCoderBit.cs │ │ │ └── RangeCoderBitTree.cs │ └── ICoder.cs ├── AssemblyClient │ ├── AssemblyClient.cs │ ├── AssemblyClientFactory.cs │ ├── IAssemblyClient.cs │ ├── IAssemblyServerLoader.cs │ ├── IpcAssemblyServerLoader.cs │ ├── NewAppDomainAssemblyServerLoader.cs │ ├── NewProcessAssemblyServerLoader.cs │ └── SameAppDomainAssemblyServerLoader.cs ├── AssemblyModule.cs ├── AssemblyResolver.cs ├── DeobfuscatorContext.cs ├── DumpedMethodsRestorer.cs ├── HandleProcessCorruptedStateExceptionsAttribute.cs ├── IDeobfuscatorContext.cs ├── IObfuscatedFile.cs ├── Logger.cs ├── MethodPrinter.cs ├── MethodReturnValueInliner.cs ├── NameRegexes.cs ├── ObfuscatedFile.cs ├── Option.cs ├── PrintNewTokens.cs ├── Properties │ └── AssemblyInfo.cs ├── SharpZipLib │ ├── Checksums │ │ ├── Adler32.cs │ │ └── IChecksum.cs │ ├── Main.cs │ ├── SharpZipBaseException.cs │ └── Zip │ │ └── Compression │ │ ├── Inflater.cs │ │ ├── InflaterDynHeader.cs │ │ ├── InflaterHuffmanTree.cs │ │ └── Streams │ │ ├── OutputWindow.cs │ │ └── StreamManipulator.cs ├── StringInliner.cs ├── UserException.cs ├── Utils.cs ├── Win32Path.cs ├── de4dot.code.csproj ├── deobfuscators │ ├── Agile_NET │ │ ├── CliSecureRtType.cs │ │ ├── CsBlowfish.cs │ │ ├── Deobfuscator.cs │ │ ├── MethodsDecrypter.cs │ │ ├── ProxyCallFixer.cs │ │ ├── ResourceDecrypter.cs │ │ ├── StackFrameHelper.cs │ │ ├── StringDecrypter.cs │ │ ├── StringDecrypterInfo.cs │ │ └── vm │ │ │ ├── CilOperandInstructionRestorer.cs │ │ │ ├── CsvmDataReader.cs │ │ │ ├── CsvmMethodData.cs │ │ │ ├── CsvmToCilMethodConverterBase.cs │ │ │ ├── VmOperand.cs │ │ │ ├── v1 │ │ │ ├── Csvm.cs │ │ │ ├── CsvmToCilMethodConverter.cs │ │ │ ├── FieldsInfo.cs │ │ │ ├── OpCodeHandler.cs │ │ │ ├── OpCodeHandlers.cs │ │ │ ├── UnknownHandlerInfo.cs │ │ │ └── VmOpCodeHandlerDetector.cs │ │ │ └── v2 │ │ │ ├── CSVM1.bin │ │ │ ├── CSVM2.bin │ │ │ ├── CSVM3.bin │ │ │ ├── CSVM4.bin │ │ │ ├── CSVM5.bin │ │ │ ├── CompositeHandlerDetector.cs │ │ │ ├── CompositeOpCodeHandler.cs │ │ │ ├── Csvm.cs │ │ │ ├── CsvmInfo.cs │ │ │ ├── CsvmResources.Designer.cs │ │ │ ├── CsvmResources.resx │ │ │ ├── CsvmToCilMethodConverter.cs │ │ │ ├── HandlerTypeCode.cs │ │ │ ├── OpCodeHandlerInfo.cs │ │ │ ├── OpCodeHandlerInfoReader.cs │ │ │ ├── OpCodeHandlerInfos.cs │ │ │ ├── SigCreator.cs │ │ │ ├── VmOpCode.cs │ │ │ └── VmOpCodeHandlerDetector.cs │ ├── ArrayFinder.cs │ ├── Babel_NET │ │ ├── AssemblyResolver.cs │ │ ├── BabelInflater.cs │ │ ├── BabelMethodCallInliner.cs │ │ ├── BabelUtils.cs │ │ ├── ConstantsDecrypter.cs │ │ ├── Deobfuscator.cs │ │ ├── ImageReader.cs │ │ ├── InflaterCreator.cs │ │ ├── MemberReferenceConverter.cs │ │ ├── MethodBodyReader.cs │ │ ├── MethodReferenceReader.cs │ │ ├── MethodsDecrypter.cs │ │ ├── ProxyCallFixer.cs │ │ ├── ResourceDecrypter.cs │ │ ├── ResourceResolver.cs │ │ └── StringDecrypter.cs │ ├── Blowfish.cs │ ├── CRC32.cs │ ├── CodeFort │ │ ├── AssemblyData.cs │ │ ├── AssemblyDecrypter.cs │ │ ├── CfMethodCallInliner.cs │ │ ├── Deobfuscator.cs │ │ ├── PasswordFinder.cs │ │ ├── ProxyCallFixer.cs │ │ └── StringDecrypter.cs │ ├── CodeVeil │ │ ├── AssemblyResolver.cs │ │ ├── Deobfuscator.cs │ │ ├── ErexResourceReader.cs │ │ ├── InvalidDataException.cs │ │ ├── InvalidMethodsFinder.cs │ │ ├── MainType.cs │ │ ├── MethodsDecrypter.cs │ │ ├── ObfuscatorVersion.cs │ │ ├── ProxyCallFixer.cs │ │ ├── ResourceConverter.cs │ │ ├── ResourceDecrypter.cs │ │ ├── ResourceInfo.cs │ │ ├── ResourceReader.cs │ │ ├── StringDecrypter.cs │ │ └── TamperDetection.cs │ ├── CodeWall │ │ ├── AssemblyDecrypter.cs │ │ ├── Deobfuscator.cs │ │ ├── KeyGenerator.cs │ │ ├── MethodsDecrypter.cs │ │ ├── StringDecrypter.cs │ │ └── randomc │ │ │ ├── CRandomMersenne.cs │ │ │ └── CRandomMother.cs │ ├── Confuser │ │ ├── AntiDebugger.cs │ │ ├── AntiDumping.cs │ │ ├── Arg64ConstantsReader.cs │ │ ├── ConfuserUtils.cs │ │ ├── ConstantsDecrypterBase.cs │ │ ├── ConstantsDecrypterUtils.cs │ │ ├── ConstantsDecrypterV15.cs │ │ ├── ConstantsDecrypterV17.cs │ │ ├── ConstantsDecrypterV18.cs │ │ ├── ConstantsFolder.cs │ │ ├── ConstantsInliner.cs │ │ ├── Deobfuscator.cs │ │ ├── IVersionProvider.cs │ │ ├── JitMethodsDecrypter.cs │ │ ├── MemoryMethodsDecrypter.cs │ │ ├── MethodsDecrypterBase.cs │ │ ├── ProxyCallFixer.cs │ │ ├── ResourceDecrypter.cs │ │ ├── StringDecrypter.cs │ │ ├── Unpacker.cs │ │ ├── VersionDetector.cs │ │ └── x86Emulator.cs │ ├── ConfuserEx │ │ ├── ConstantDecrypter.cs │ │ ├── ConstantInliner.cs │ │ ├── ControlFlowFixer.cs │ │ ├── Deobfuscator.cs │ │ ├── LzmaFinder.cs │ │ ├── NativeSwitchData.cs │ │ ├── NormalSwitchData.cs │ │ ├── ProxyCallFixer.cs │ │ ├── ResourceDecrypter.cs │ │ ├── Utils.cs │ │ └── x86 │ │ │ ├── Bea │ │ │ ├── Constants.cs │ │ │ ├── Engine.cs │ │ │ └── Structs.cs │ │ │ ├── Instructions │ │ │ ├── X86ADD.cs │ │ │ ├── X86DIV.cs │ │ │ ├── X86IMUL.cs │ │ │ ├── X86MOV.cs │ │ │ ├── X86NEG.cs │ │ │ ├── X86NOT.cs │ │ │ ├── X86POP.cs │ │ │ ├── X86PUSH.cs │ │ │ ├── X86SUB.cs │ │ │ └── X86XOR.cs │ │ │ ├── UnmanagedBuff.cs │ │ │ ├── X86Instruction.cs │ │ │ └── X86Method.cs │ ├── ConstantsReader.cs │ ├── CryptoObfuscator │ │ ├── AntiDebugger.cs │ │ ├── AssemblyResolver.cs │ │ ├── CoMethodCallInliner.cs │ │ ├── CoUtils.cs │ │ ├── ConstantsDecrypter.cs │ │ ├── Deobfuscator.cs │ │ ├── InlinedMethodTypes.cs │ │ ├── LdnullFixer.cs │ │ ├── MethodBodyReader.cs │ │ ├── MethodsDecrypter.cs │ │ ├── ProxyCallFixer.cs │ │ ├── ResourceDecrypter.cs │ │ ├── ResourceResolver.cs │ │ ├── StringDecrypter.cs │ │ └── TamperDetection.cs │ ├── DeepSea │ │ ├── ArrayBlockDeobfuscator.cs │ │ ├── ArrayBlockState.cs │ │ ├── AssemblyResolver.cs │ │ ├── CastDeobfuscator.cs │ │ ├── Deobfuscator.cs │ │ ├── DsConstantsReader.cs │ │ ├── DsInlinedMethodsFinder.cs │ │ ├── DsMethodCallInliner.cs │ │ ├── DsUtils.cs │ │ ├── FieldsRestorer.cs │ │ ├── ResolverBase.cs │ │ ├── ResourceResolver.cs │ │ └── StringDecrypter.cs │ ├── DeobUtils.cs │ ├── DeobfuscatorBase.cs │ ├── DeobfuscatorInfoBase.cs │ ├── Dotfuscator │ │ ├── Deobfuscator.cs │ │ └── StringDecrypter.cs │ ├── Eazfuscator_NET │ │ ├── AssemblyResolver.cs │ │ ├── CodeCompilerMethodCallRestorer.cs │ │ ├── DecrypterType.cs │ │ ├── Deobfuscator.cs │ │ ├── DynamicDynocodeIterator.cs │ │ ├── DynocodeService.cs │ │ ├── EfConstantsReader.cs │ │ ├── EfUtils.cs │ │ ├── ResourceMethodsRestorer.cs │ │ ├── ResourceResolver.cs │ │ ├── StringDecrypter.cs │ │ └── VersionDetector.cs │ ├── ExceptionLoggerRemover.cs │ ├── Goliath_NET │ │ ├── ArrayDecrypter.cs │ │ ├── ArrayValueInliner.cs │ │ ├── DecrypterBase.cs │ │ ├── Deobfuscator.cs │ │ ├── IntegerDecrypter.cs │ │ ├── LocalsRestorer.cs │ │ ├── LogicalExpressionFixer.cs │ │ ├── ProxyCallFixer.cs │ │ ├── StringDecrypter.cs │ │ └── StrongNameChecker.cs │ ├── IDeobfuscatedFile.cs │ ├── IDeobfuscator.cs │ ├── IDeobfuscatorInfo.cs │ ├── ILProtector │ │ ├── DecryptedMethodInfo.cs │ │ ├── Deobfuscator.cs │ │ ├── DynamicMethodsDecrypter.cs │ │ ├── DynamicMethodsDecrypterService.cs │ │ ├── DynamicMethodsRestorer.cs │ │ ├── MainType.cs │ │ ├── MethodReader.cs │ │ ├── MethodsDecrypterBase.cs │ │ ├── RuntimeFileInfo.cs │ │ └── StaticMethodsDecrypter.cs │ ├── ISimpleDeobfuscator.cs │ ├── InitializedDataCreator.cs │ ├── InlinedMethodsFinder.cs │ ├── Lzma.cs │ ├── MPRESS │ │ ├── Deobfuscator.cs │ │ └── Lzmat.cs │ ├── MaxtoCode │ │ ├── CryptDecrypter.cs │ │ ├── Decrypter6.cs │ │ ├── DecrypterInfo.cs │ │ ├── Deobfuscator.cs │ │ ├── EncryptionInfos.cs │ │ ├── MainType.cs │ │ ├── McKey.cs │ │ ├── MethodsDecrypter.cs │ │ ├── PeHeader.cs │ │ └── StringDecrypter.cs │ ├── MemberReferenceBuilder.cs │ ├── MethodBodyParser.cs │ ├── MethodCallRestorerBase.cs │ ├── MethodCollection.cs │ ├── MethodStack.cs │ ├── MethodsDecrypter.cs │ ├── MyPEImage.cs │ ├── NullStream.cs │ ├── Operations.cs │ ├── ProxyCallFixerBase.cs │ ├── QuickLZ.cs │ ├── RandomNameChecker.cs │ ├── Rummage │ │ ├── Deobfuscator.cs │ │ ├── RummageVersion.cs │ │ └── StringDecrypter.cs │ ├── Skater_NET │ │ ├── Deobfuscator.cs │ │ ├── EnumClassFinder.cs │ │ └── StringDecrypter.cs │ ├── SmartAssembly │ │ ├── AssemblyResolver.cs │ │ ├── AssemblyResolverInfo.cs │ │ ├── AutomatedErrorReportingFinder.cs │ │ ├── Deobfuscator.cs │ │ ├── MemoryManagerInfo.cs │ │ ├── ProxyCallFixer.cs │ │ ├── ResolverInfoBase.cs │ │ ├── ResourceDecrypter.cs │ │ ├── ResourceDecrypterInfo.cs │ │ ├── ResourceResolver.cs │ │ ├── ResourceResolverInfo.cs │ │ ├── SimpleZipInfo.cs │ │ ├── StringDecrypter.cs │ │ ├── StringDecrypterInfo.cs │ │ ├── StringEncoderClassFinder.cs │ │ └── TamperProtectionRemover.cs │ ├── Spices_Net │ │ ├── Deobfuscator.cs │ │ ├── QclzDecompressor.cs │ │ ├── ResourceNamesRestorer.cs │ │ ├── SpicesMethodCallInliner.cs │ │ └── StringDecrypter.cs │ ├── StringCounts.cs │ ├── TypesRestorer.cs │ ├── Unknown │ │ └── Deobfuscator.cs │ ├── UnpackedFile.cs │ ├── UnusedMethodsFinder.cs │ ├── ValueInlinerBase.cs │ ├── Xenocode │ │ ├── Deobfuscator.cs │ │ └── StringDecrypter.cs │ └── dotNET_Reactor │ │ ├── v3 │ │ ├── AntiStrongName.cs │ │ ├── ApplicationModeDecrypter.cs │ │ ├── ApplicationModeUnpacker.cs │ │ ├── AssemblyResolver.cs │ │ ├── DecryptMethod.cs │ │ ├── DecrypterType.cs │ │ ├── Deobfuscator.cs │ │ ├── LibAssemblyResolver.cs │ │ ├── MemoryPatcher.cs │ │ └── NativeLibSaver.cs │ │ └── v4 │ │ ├── AntiStrongName.cs │ │ ├── AssemblyResolver.cs │ │ ├── BooleanDecrypter.cs │ │ ├── Deobfuscator.cs │ │ ├── DnrMethodCallInliner.cs │ │ ├── EmptyClass.cs │ │ ├── EncryptedResource.cs │ │ ├── MetadataTokenObfuscator.cs │ │ ├── MethodsDecrypter.cs │ │ ├── NativeFileDecrypter.cs │ │ ├── NativeImageUnpacker.cs │ │ ├── ProxyCallFixer.cs │ │ ├── ResourceResolver.cs │ │ └── StringDecrypter.cs └── renamer │ ├── DerivedFrom.cs │ ├── ExistingNames.cs │ ├── INameChecker.cs │ ├── MemberInfos.cs │ ├── NameCreators.cs │ ├── Renamer.cs │ ├── ResourceKeysRenamer.cs │ ├── ResourceRenamer.cs │ ├── TypeInfo.cs │ ├── TypeNames.cs │ ├── TypeRenamerState.cs │ ├── VariableNameState.cs │ └── asmmodules │ ├── EventDef.cs │ ├── FieldDef.cs │ ├── GenericParamDef.cs │ ├── IResolver.cs │ ├── MemberRefFinder.cs │ ├── MethodDef.cs │ ├── MethodNameGroups.cs │ ├── Module.cs │ ├── Modules.cs │ ├── ParamDef.cs │ ├── PropertyDef.cs │ ├── Ref.cs │ ├── RefDict.cs │ └── TypeDef.cs ├── de4dot.cui ├── CommandLineParser.cs ├── FilesDeobfuscator.cs ├── Program.cs ├── Properties │ └── AssemblyInfo.cs └── de4dot.cui.csproj ├── de4dot.mdecrypt ├── DecryptMethodsInfo.cs ├── DynamicMethodsDecrypter.cs ├── NativeCodeGenerator.cs ├── Properties │ └── AssemblyInfo.cs └── de4dot.mdecrypt.csproj ├── de4dot.sln ├── de4dot.snk ├── de4dot ├── App.config ├── Program.cs ├── Properties │ └── AssemblyInfo.cs └── de4dot.csproj └── deobfuscator.Template ├── Properties └── AssemblyInfo.cs ├── deobfuscator.Template.csproj └── readme.txt /.github/workflows/main.yml: -------------------------------------------------------------------------------- 1 | name: CI 2 | 3 | on: [push] 4 | 5 | jobs: 6 | build: 7 | 8 | runs-on: [windows-2019] 9 | 10 | steps: 11 | - name: Setup MSBuild.exe 12 | uses: warrenbuckley/Setup-MSBuild@v1 13 | 14 | - name: Setup Nuget.exe 15 | uses: warrenbuckley/Setup-Nuget@v1 16 | 17 | - uses: actions/checkout@v1 18 | - name: Build 19 | run: | 20 | git submodule update --init --recursive 21 | nuget restore de4dot.sln 22 | msbuild de4dot.sln /p:Configuration=Release /m /verbosity:normal /p:WarningLevel=0 23 | - name: Create ZIP 24 | if: startsWith(github.ref, 'refs/tags/') 25 | run: | 26 | Compress-Archive -Path Release/* -DestinationPath de4dot-cex 27 | 28 | - name: Release 29 | uses: softprops/action-gh-release@v1 30 | if: startsWith(github.ref, 'refs/tags/') 31 | with: 32 | files: de4dot-cex.zip 33 | env: 34 | GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | *~ 2 | */obj/ 3 | *.csproj.user 4 | *.sdf 5 | *.opensdf 6 | *.suo 7 | /Debug/ 8 | /Release/ 9 | .idea/ 10 | -------------------------------------------------------------------------------- /.gitmodules: -------------------------------------------------------------------------------- 1 | [submodule "dnlib"] 2 | path = dnlib 3 | url = https://github.com/0xd4d/dnlib.git 4 | -------------------------------------------------------------------------------- /AssemblyData/AssemblyServer.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | using System.Collections; 22 | using System.Runtime.Remoting; 23 | using System.Runtime.Remoting.Channels; 24 | using System.Runtime.Remoting.Channels.Ipc; 25 | using AssemblyData; 26 | 27 | namespace AssemblyServer { 28 | public static class Start { 29 | public static int Main(string[] args) { 30 | if (args.Length != 3) 31 | Environment.Exit(1); 32 | var serviceType = (AssemblyServiceType)int.Parse(args[0]); 33 | var channelName = args[1]; 34 | var uri = args[2]; 35 | 36 | var service = (AssemblyService)AssemblyService.Create(serviceType); 37 | StartServer(service, channelName, uri); 38 | service.WaitExit(); 39 | return 0; 40 | } 41 | 42 | static void StartServer(AssemblyService service, string name, string uri) { 43 | var props = new Hashtable(); 44 | props["portName"] = name; 45 | var provider = new BinaryServerFormatterSinkProvider(); 46 | provider.TypeFilterLevel = System.Runtime.Serialization.Formatters.TypeFilterLevel.Full; 47 | var channel = new IpcServerChannel(props, provider); 48 | ChannelServices.RegisterChannel(channel, false); 49 | RemotingServices.Marshal(service, uri); 50 | } 51 | } 52 | } 53 | -------------------------------------------------------------------------------- /AssemblyData/DelegateStringDecrypter.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | using System.Reflection; 22 | using System.Reflection.Emit; 23 | using System.Collections.Generic; 24 | 25 | namespace AssemblyData { 26 | class DelegateStringDecrypter : IStringDecrypter { 27 | delegate string DecryptString(object[] args); 28 | List stringDecryptMethods = new List(); 29 | 30 | public int DefineStringDecrypter(MethodInfo method) { 31 | stringDecryptMethods.Add(BuildDynamicMethod(method)); 32 | return stringDecryptMethods.Count - 1; 33 | } 34 | 35 | public object[] DecryptStrings(int stringDecrypterMethod, object[] args, MethodBase caller) { 36 | if (stringDecrypterMethod > stringDecryptMethods.Count) 37 | throw new ApplicationException("Invalid string decrypter method"); 38 | 39 | var rv = new object[args.Length]; 40 | var stringDecrypter = stringDecryptMethods[stringDecrypterMethod]; 41 | for (int i = 0; i < args.Length; i++) 42 | rv[i] = stringDecrypter((object[])args[i]); 43 | return rv; 44 | } 45 | 46 | DecryptString BuildDynamicMethod(MethodInfo method) { 47 | var dm = new DynamicMethod("", typeof(string), new Type[] { typeof(object[]) }, typeof(DelegateStringDecrypter), true); 48 | Utils.AddCallStringDecrypterMethodInstructions(method, dm.GetILGenerator()); 49 | return (DecryptString)dm.CreateDelegate(typeof(DecryptString)); 50 | } 51 | } 52 | } 53 | -------------------------------------------------------------------------------- /AssemblyData/EmuStringDecrypter.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | using System.Collections.Generic; 22 | using System.Reflection; 23 | using AssemblyData.methodsrewriter; 24 | 25 | namespace AssemblyData { 26 | class EmuStringDecrypter : IStringDecrypter { 27 | List decryptInfos = new List(); 28 | MethodsRewriter methodsRewriter = new MethodsRewriter(); 29 | 30 | class DecryptInfo { 31 | public MethodInfo method; 32 | public RewrittenMethod decryptString; 33 | 34 | public DecryptInfo(MethodInfo method) { 35 | this.method = method; 36 | } 37 | } 38 | 39 | public int DefineStringDecrypter(MethodInfo method) { 40 | decryptInfos.Add(new DecryptInfo(method)); 41 | return decryptInfos.Count - 1; 42 | } 43 | 44 | public object[] DecryptStrings(int stringDecrypterMethod, object[] args, MethodBase caller) { 45 | var decryptInfo = decryptInfos[stringDecrypterMethod]; 46 | if (decryptInfo.decryptString == null) 47 | decryptInfo.decryptString = CreateDecryptString(decryptInfo.method); 48 | 49 | methodsRewriter.SetCaller(decryptInfo.decryptString, caller); 50 | var result = new object[args.Length]; 51 | for (int i = 0; i < args.Length; i++) 52 | result[i] = decryptInfo.decryptString((object[])args[i]); 53 | return result; 54 | } 55 | 56 | RewrittenMethod CreateDecryptString(MethodInfo method) { 57 | methodsRewriter.CreateMethod(method); 58 | return methodsRewriter.CreateDelegate(method); 59 | } 60 | } 61 | } 62 | -------------------------------------------------------------------------------- /AssemblyData/IAssemblyService.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | namespace AssemblyData { 21 | public enum AssemblyServiceType { 22 | StringDecrypter, 23 | MethodDecrypter, 24 | Generic, 25 | } 26 | 27 | public interface IAssemblyService { 28 | void DoNothing(); 29 | void Exit(); 30 | } 31 | } 32 | -------------------------------------------------------------------------------- /AssemblyData/IGenericService.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | 22 | namespace AssemblyData { 23 | public class CreateUserGenericServiceAttribute : Attribute { 24 | } 25 | 26 | public interface IGenericService : IAssemblyService { 27 | void LoadUserService(Type createServiceType, object createMethodArgs); 28 | void LoadAssembly(string filename); 29 | object SendMessage(int msg, object[] args); 30 | } 31 | } 32 | -------------------------------------------------------------------------------- /AssemblyData/IMethodDecrypterService.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using de4dot.blocks; 21 | using de4dot.mdecrypt; 22 | 23 | namespace AssemblyData { 24 | public interface IMethodDecrypterService : IAssemblyService { 25 | void InstallCompileMethod(DecryptMethodsInfo decryptMethodsInfo); 26 | void LoadObfuscator(string filename); 27 | bool CanDecryptMethods(); 28 | DumpedMethods DecryptMethods(); 29 | } 30 | } 31 | -------------------------------------------------------------------------------- /AssemblyData/IStringDecrypter.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Reflection; 21 | 22 | namespace AssemblyData { 23 | interface IStringDecrypter { 24 | int DefineStringDecrypter(MethodInfo method); 25 | object[] DecryptStrings(int stringDecrypterMethod, object[] args, MethodBase caller); 26 | } 27 | } 28 | -------------------------------------------------------------------------------- /AssemblyData/IStringDecrypterService.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | namespace AssemblyData { 21 | public enum StringDecrypterType { 22 | Delegate, 23 | Emulate, 24 | } 25 | 26 | public interface IStringDecrypterService : IAssemblyService { 27 | void LoadAssembly(string filename); 28 | void SetStringDecrypterType(StringDecrypterType type); 29 | int DefineStringDecrypter(int methodToken); 30 | object[] DecryptStrings(int stringDecrypterMethod, object[] args, int callerToken); 31 | } 32 | } 33 | -------------------------------------------------------------------------------- /AssemblyData/IUserGenericService.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | using System.Reflection; 22 | 23 | namespace AssemblyData { 24 | public interface IUserGenericService : IDisposable { 25 | void AssemblyLoaded(Assembly assembly); 26 | object HandleMessage(int msg, object[] args); 27 | } 28 | } 29 | -------------------------------------------------------------------------------- /AssemblyData/MethodDecrypterService.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | using de4dot.blocks; 22 | using de4dot.mdecrypt; 23 | 24 | namespace AssemblyData { 25 | class MethodDecrypterService : AssemblyService, IMethodDecrypterService { 26 | bool installCompileMethodCalled = false; 27 | 28 | public void InstallCompileMethod(DecryptMethodsInfo decryptMethodsInfo) { 29 | if (installCompileMethodCalled) 30 | throw new ApplicationException("installCompileMethod() has already been called"); 31 | installCompileMethodCalled = true; 32 | DynamicMethodsDecrypter.Instance.DecryptMethodsInfo = decryptMethodsInfo; 33 | DynamicMethodsDecrypter.Instance.InstallCompileMethod(); 34 | } 35 | 36 | public void LoadObfuscator(string filename) { 37 | LoadAssemblyInternal(filename); 38 | DynamicMethodsDecrypter.Instance.Module = assembly.ManifestModule; 39 | DynamicMethodsDecrypter.Instance.LoadObfuscator(); 40 | } 41 | 42 | public bool CanDecryptMethods() { 43 | CheckAssembly(); 44 | return DynamicMethodsDecrypter.Instance.CanDecryptMethods(); 45 | } 46 | 47 | public DumpedMethods DecryptMethods() { 48 | CheckAssembly(); 49 | return DynamicMethodsDecrypter.Instance.DecryptMethods(); 50 | } 51 | } 52 | } 53 | -------------------------------------------------------------------------------- /AssemblyData/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Reflection; 21 | using System.Runtime.InteropServices; 22 | 23 | [assembly: AssemblyTitle("AssemblyData")] 24 | [assembly: AssemblyDescription(".NET Assembly data for use by client and server")] 25 | [assembly: AssemblyConfiguration("")] 26 | [assembly: AssemblyCompany("")] 27 | [assembly: AssemblyProduct("AssemblyData")] 28 | [assembly: AssemblyCopyright("Copyright (C) 2011-2015 de4dot@gmail.com")] 29 | [assembly: AssemblyTrademark("")] 30 | [assembly: AssemblyCulture("")] 31 | [assembly: ComVisible(false)] 32 | [assembly: AssemblyVersion("3.1.41592.3405")] 33 | [assembly: AssemblyFileVersion("3.1.41592.3405")] 34 | -------------------------------------------------------------------------------- /AssemblyData/SimpleData.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | using System.Text; 22 | 23 | namespace AssemblyData { 24 | // This class will make sure no data in the string is destroyed by serialization 25 | [Serializable] 26 | class MyString { 27 | short[] data; 28 | 29 | public MyString() { 30 | } 31 | 32 | public MyString(string s) { 33 | if (s == null) 34 | data = null; 35 | else { 36 | data = new short[s.Length]; 37 | for (int i = 0; i < s.Length; i++) 38 | data[i] = (short)s[i]; 39 | } 40 | } 41 | 42 | public override string ToString() { 43 | if (data == null) 44 | return null; 45 | 46 | var sb = new StringBuilder(data.Length); 47 | foreach (var c in data) 48 | sb.Append((char)c); 49 | return sb.ToString(); 50 | } 51 | } 52 | 53 | public static class SimpleData { 54 | public static object[] Pack(object[] args) { 55 | for (int i = 0; i < args.Length; i++) { 56 | var s = args[i] as string; 57 | if (s != null) 58 | args[i] = new MyString(s); 59 | } 60 | return args; 61 | } 62 | 63 | public static object[] Unpack(object[] args) { 64 | for (int i = 0; i < args.Length; i++) { 65 | var s = args[i] as MyString; 66 | if (s != null) 67 | args[i] = s.ToString(); 68 | } 69 | return args; 70 | } 71 | } 72 | } 73 | -------------------------------------------------------------------------------- /AssemblyData/methodsrewriter/IMethodsRewriter.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | using System.Reflection; 22 | 23 | namespace AssemblyData.methodsrewriter { 24 | interface IMethodsRewriter { 25 | Type GetDelegateType(MethodBase methodBase); 26 | } 27 | } 28 | -------------------------------------------------------------------------------- /AssemblyData/methodsrewriter/MField.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Reflection; 21 | using dnlib.DotNet; 22 | 23 | namespace AssemblyData.methodsrewriter { 24 | class MField { 25 | public FieldInfo fieldInfo; 26 | public FieldDef fieldDef; 27 | 28 | public MField(FieldInfo fieldInfo, FieldDef fieldDef) { 29 | this.fieldInfo = fieldInfo; 30 | this.fieldDef = fieldDef; 31 | } 32 | 33 | public override string ToString() { 34 | return fieldDef.ToString(); 35 | } 36 | } 37 | } 38 | -------------------------------------------------------------------------------- /AssemblyData/methodsrewriter/MMethod.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Reflection; 21 | using dnlib.DotNet; 22 | 23 | namespace AssemblyData.methodsrewriter { 24 | class MMethod { 25 | public MethodBase methodBase; 26 | public MethodDef methodDef; 27 | public MMethod(MethodBase methodBase, MethodDef methodDef) { 28 | this.methodBase = methodBase; 29 | this.methodDef = methodDef; 30 | } 31 | 32 | public bool HasInstructions() { 33 | return methodDef.Body != null && methodDef.Body.Instructions.Count != 0; 34 | } 35 | 36 | public override string ToString() { 37 | return methodDef.ToString(); 38 | } 39 | } 40 | } 41 | -------------------------------------------------------------------------------- /AssemblyData/methodsrewriter/Operand.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | namespace AssemblyData.methodsrewriter { 21 | class Operand { 22 | public enum Type { 23 | ThisArg, // Replace operand with the 'this' arg 24 | TempObj, // Replace operand with temp object local variable 25 | TempObjArray, // Replace operand with temp object[] local variable 26 | OurMethod, // Replace operand with a call to our method. methodName must be unique. 27 | NewMethod, // Replace operand with a call to new method. data is realMethod 28 | ReflectionType, // Replace operand with a .NET type 29 | } 30 | 31 | public Type type; 32 | public object data; 33 | 34 | public Operand(Type type) { 35 | this.type = type; 36 | this.data = null; 37 | } 38 | 39 | public Operand(Type type, object data) { 40 | this.type = type; 41 | this.data = data; 42 | } 43 | 44 | public override string ToString() { 45 | return "{" + type + " => " + data + "}"; 46 | } 47 | } 48 | } 49 | -------------------------------------------------------------------------------- /AssemblyData/methodsrewriter/TypeResolver.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | using System.Collections.Generic; 22 | using System.Reflection; 23 | using dnlib.DotNet; 24 | using de4dot.blocks; 25 | 26 | namespace AssemblyData.methodsrewriter { 27 | class TypeResolver { 28 | public Type type; 29 | Dictionary typeRefToInstance = new Dictionary(TypeEqualityComparer.Instance); 30 | 31 | public TypeResolver(Type type) { 32 | this.type = type; 33 | } 34 | 35 | TypeInstanceResolver GetTypeInstance(ITypeDefOrRef typeRef) { 36 | TypeInstanceResolver instance; 37 | if (!typeRefToInstance.TryGetValue(typeRef, out instance)) 38 | typeRefToInstance[typeRef] = instance = new TypeInstanceResolver(type, typeRef); 39 | return instance; 40 | } 41 | 42 | public FieldInfo Resolve(IField fieldRef) { 43 | return GetTypeInstance(fieldRef.DeclaringType).Resolve(fieldRef); 44 | } 45 | 46 | public MethodBase Resolve(IMethod methodRef) { 47 | return GetTypeInstance(methodRef.DeclaringType).Resolve(methodRef); 48 | } 49 | } 50 | } 51 | -------------------------------------------------------------------------------- /AssemblyServer-CLR20-x64/App.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | -------------------------------------------------------------------------------- /AssemblyServer-CLR20-x64/Program.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | namespace AssemblyServer_CLR20_x64 { 21 | class Program { 22 | static int Main(string[] args) { 23 | return AssemblyServer.Start.Main(args); 24 | } 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /AssemblyServer-CLR20-x64/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Reflection; 21 | using System.Runtime.InteropServices; 22 | 23 | [assembly: AssemblyTitle("AssemblyServer-CLR20-x64")] 24 | [assembly: AssemblyDescription("Assembly Server - CLR v2.0 - x64")] 25 | [assembly: AssemblyConfiguration("")] 26 | [assembly: AssemblyCompany("")] 27 | [assembly: AssemblyProduct("AssemblyServer-CLR20-x64")] 28 | [assembly: AssemblyCopyright("Copyright (C) 2011-2015 de4dot@gmail.com")] 29 | [assembly: AssemblyTrademark("")] 30 | [assembly: AssemblyCulture("")] 31 | [assembly: ComVisible(false)] 32 | [assembly: AssemblyVersion("3.1.41592.3405")] 33 | [assembly: AssemblyFileVersion("3.1.41592.3405")] 34 | -------------------------------------------------------------------------------- /AssemblyServer-CLR20/App.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | -------------------------------------------------------------------------------- /AssemblyServer-CLR20/Program.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | namespace AssemblyServer_CLR20 { 21 | class Program { 22 | static int Main(string[] args) { 23 | return AssemblyServer.Start.Main(args); 24 | } 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /AssemblyServer-CLR20/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Reflection; 21 | using System.Runtime.InteropServices; 22 | 23 | [assembly: AssemblyTitle("AssemblyServer-CLR20")] 24 | [assembly: AssemblyDescription("Assembly Server - CLR v2.0 - x86")] 25 | [assembly: AssemblyConfiguration("")] 26 | [assembly: AssemblyCompany("")] 27 | [assembly: AssemblyProduct("AssemblyServer-CLR20")] 28 | [assembly: AssemblyCopyright("Copyright (C) 2011-2015 de4dot@gmail.com")] 29 | [assembly: AssemblyTrademark("")] 30 | [assembly: AssemblyCulture("")] 31 | [assembly: ComVisible(false)] 32 | [assembly: AssemblyVersion("3.1.41592.3405")] 33 | [assembly: AssemblyFileVersion("3.1.41592.3405")] 34 | -------------------------------------------------------------------------------- /AssemblyServer-CLR40-x64/App.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | -------------------------------------------------------------------------------- /AssemblyServer-CLR40-x64/Program.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | namespace AssemblyServer_CLR40_x64 { 21 | class Program { 22 | static int Main(string[] args) { 23 | return AssemblyServer.Start.Main(args); 24 | } 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /AssemblyServer-CLR40-x64/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Reflection; 21 | using System.Runtime.InteropServices; 22 | 23 | [assembly: AssemblyTitle("AssemblyServer-CLR40-x64")] 24 | [assembly: AssemblyDescription("Assembly Server - CLR v4.0 - x64")] 25 | [assembly: AssemblyConfiguration("")] 26 | [assembly: AssemblyCompany("")] 27 | [assembly: AssemblyProduct("AssemblyServer-CLR40-x64")] 28 | [assembly: AssemblyCopyright("Copyright (C) 2011-2015 de4dot@gmail.com")] 29 | [assembly: AssemblyTrademark("")] 30 | [assembly: AssemblyCulture("")] 31 | [assembly: ComVisible(false)] 32 | [assembly: AssemblyVersion("3.1.41592.3405")] 33 | [assembly: AssemblyFileVersion("3.1.41592.3405")] 34 | -------------------------------------------------------------------------------- /AssemblyServer-CLR40/App.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | -------------------------------------------------------------------------------- /AssemblyServer-CLR40/Program.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | namespace AssemblyServer_CLR40 { 21 | class Program { 22 | static int Main(string[] args) { 23 | return AssemblyServer.Start.Main(args); 24 | } 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /AssemblyServer-CLR40/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Reflection; 21 | using System.Runtime.InteropServices; 22 | 23 | [assembly: AssemblyTitle("AssemblyServer-CLR40")] 24 | [assembly: AssemblyDescription("Assembly Server - CLR v4.0 - x86")] 25 | [assembly: AssemblyConfiguration("")] 26 | [assembly: AssemblyCompany("")] 27 | [assembly: AssemblyProduct("AssemblyServer-CLR40")] 28 | [assembly: AssemblyCopyright("Copyright (C) 2011-2015 de4dot@gmail.com")] 29 | [assembly: AssemblyTrademark("")] 30 | [assembly: AssemblyCulture("")] 31 | [assembly: ComVisible(false)] 32 | [assembly: AssemblyVersion("3.1.41592.3405")] 33 | [assembly: AssemblyFileVersion("3.1.41592.3405")] 34 | -------------------------------------------------------------------------------- /AssemblyServer-x64/App.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | -------------------------------------------------------------------------------- /AssemblyServer-x64/Program.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | namespace AssemblyServer_x64 { 21 | class Program { 22 | static int Main(string[] args) { 23 | return AssemblyServer.Start.Main(args); 24 | } 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /AssemblyServer-x64/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Reflection; 21 | using System.Runtime.InteropServices; 22 | 23 | [assembly: AssemblyTitle("AssemblyServer-x64")] 24 | [assembly: AssemblyDescription("Assembly Server - CLR any version - x64")] 25 | [assembly: AssemblyConfiguration("")] 26 | [assembly: AssemblyCompany("")] 27 | [assembly: AssemblyProduct("AssemblyServer-x64")] 28 | [assembly: AssemblyCopyright("Copyright (C) 2011-2015 de4dot@gmail.com")] 29 | [assembly: AssemblyTrademark("")] 30 | [assembly: AssemblyCulture("")] 31 | [assembly: ComVisible(false)] 32 | [assembly: AssemblyVersion("3.1.41592.3405")] 33 | [assembly: AssemblyFileVersion("3.1.41592.3405")] 34 | -------------------------------------------------------------------------------- /AssemblyServer/App.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | -------------------------------------------------------------------------------- /AssemblyServer/Program.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | namespace AssemblyServer_x86 { 21 | class Program { 22 | static int Main(string[] args) { 23 | return AssemblyServer.Start.Main(args); 24 | } 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /AssemblyServer/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Reflection; 21 | using System.Runtime.InteropServices; 22 | 23 | [assembly: AssemblyTitle("AssemblyServer")] 24 | [assembly: AssemblyDescription("Assembly Server - CLR any version - x86")] 25 | [assembly: AssemblyConfiguration("")] 26 | [assembly: AssemblyCompany("")] 27 | [assembly: AssemblyProduct("AssemblyServer")] 28 | [assembly: AssemblyCopyright("Copyright (C) 2011-2015 de4dot@gmail.com")] 29 | [assembly: AssemblyTrademark("")] 30 | [assembly: AssemblyCulture("")] 31 | [assembly: ComVisible(false)] 32 | [assembly: AssemblyVersion("3.1.41592.3405")] 33 | [assembly: AssemblyFileVersion("3.1.41592.3405")] 34 | -------------------------------------------------------------------------------- /BeaEngine.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ViRb3/de4dot-cex/389221374bb5f2ac9f6b8d2c7c311851f5654cc0/BeaEngine.dll -------------------------------------------------------------------------------- /LICENSE.ICSharpCode.SharpZipLib.txt: -------------------------------------------------------------------------------- 1 | 2 | // This program is free software; you can redistribute it and/or 3 | // modify it under the terms of the GNU General Public License 4 | // as published by the Free Software Foundation; either version 2 5 | // of the License, or (at your option) any later version. 6 | // 7 | // This program is distributed in the hope that it will be useful, 8 | // but WITHOUT ANY WARRANTY; without even the implied warranty of 9 | // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 10 | // GNU General Public License for more details. 11 | // 12 | // You should have received a copy of the GNU General Public License 13 | // along with this program; if not, write to the Free Software 14 | // Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. 15 | // 16 | // Linking this library statically or dynamically with other modules is 17 | // making a combined work based on this library. Thus, the terms and 18 | // conditions of the GNU General Public License cover the whole 19 | // combination. 20 | // 21 | // As a special exception, the copyright holders of this library give you 22 | // permission to link this library with independent modules to produce an 23 | // executable, regardless of the license terms of these independent 24 | // modules, and to copy and distribute the resulting executable under 25 | // terms of your choice, provided that you also meet, for each linked 26 | // independent module, the terms and conditions of the license of that 27 | // module. An independent module is a module which is not derived from 28 | // or based on this library. If you modify this library, you may extend 29 | // this exception to your version of the library, but you are not 30 | // obligated to do so. If you do not wish to do so, delete this 31 | // exception statement from your version. 32 | 33 | 34 | Official site: http://www.icsharpcode.net/opensource/sharpziplib/ 35 | -------------------------------------------------------------------------------- /LICENSE.QuickLZ.txt: -------------------------------------------------------------------------------- 1 | 2 | // QuickLZ data compression library 3 | // Copyright (C) 2006-2011 Lasse Mikkel Reinhold 4 | // lar@quicklz.com 5 | // 6 | // QuickLZ can be used for free under the GPL 1, 2 or 3 license (where anything 7 | // released into public must be open source) or under a commercial license if such 8 | // has been acquired (see http://www.quicklz.com/order.html). The commercial license 9 | // does not cover derived or ported versions created by third parties under GPL. 10 | 11 | -------------------------------------------------------------------------------- /LICENSE.de4dot.txt: -------------------------------------------------------------------------------- 1 | 2 | Copyright (C) 2011-2014 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | 19 | 20 | Official site: https://github.com/0xd4d/de4dot 21 | 22 | See the file COPYING for more details. 23 | -------------------------------------------------------------------------------- /LICENSE.dnlib.txt: -------------------------------------------------------------------------------- 1 | 2 | Copyright (C) 2012-2014 de4dot@gmail.com 3 | 4 | Permission is hereby granted, free of charge, to any person obtaining 5 | a copy of this software and associated documentation files (the 6 | "Software"), to deal in the Software without restriction, including 7 | without limitation the rights to use, copy, modify, merge, publish, 8 | distribute, sublicense, and/or sell copies of the Software, and to 9 | permit persons to whom the Software is furnished to do so, subject to 10 | the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be 13 | included in all copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 16 | EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 17 | MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. 18 | IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY 19 | CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, 20 | TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE 21 | SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 22 | 23 | 24 | Official site: https://github.com/0xd4d/dnlib 25 | -------------------------------------------------------------------------------- /LICENSE.lzma.txt: -------------------------------------------------------------------------------- 1 | 2 | LICENSE 3 | ------- 4 | 5 | LZMA SDK is written and placed in the public domain by Igor Pavlov. 6 | 7 | Some code in LZMA SDK is based on public domain code from another developers: 8 | 1) PPMd var.H (2001): Dmitry Shkarin 9 | 2) SHA-256: Wei Dai (Crypto++ library) 10 | 11 | You can copy, modify, distribute and perform LZMA SDK code, even for commercial purposes, 12 | all without asking permission. 13 | 14 | LZMA SDK code is compatible with open source licenses, for example, you can 15 | include it to GNU GPL or GNU LGPL code. 16 | 17 | 18 | http://www.7-zip.org/sdk.html 19 | http://downloads.sourceforge.net/sevenzip/lzma922.tar.bz2 20 | -------------------------------------------------------------------------------- /LICENSE.lzmat.txt: -------------------------------------------------------------------------------- 1 | 2 | *************************************************************************** 3 | ** LZMAT ANSI-C decoder 1.01 4 | ** Copyright (C) 2007,2008 Vitaly Evseenko. All Rights Reserved. 5 | ** lzmat_dec.c 6 | ** 7 | ** This file is part of the LZMAT real-time data compression library. 8 | ** 9 | ** The LZMAT library is free software; you can redistribute it and/or 10 | ** modify it under the terms of the GNU General Public License as 11 | ** published by the Free Software Foundation; either version 2 of 12 | ** the License, or (at your option) any later version. 13 | ** 14 | ** The LZMAT library is distributed WITHOUT ANY WARRANTY; 15 | ** without even the implied warranty of MERCHANTABILITY or 16 | ** FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public 17 | ** License for more details. 18 | ** 19 | ** You should have received a copy of the GNU General Public License 20 | ** along with the LZMAT library; see the file GPL.TXT. 21 | ** If not, write to the Free Software Foundation, Inc., 22 | ** 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. 23 | ** 24 | ** Vitaly Evseenko 25 | ** 26 | ** http://www.matcode.com/lzmat.htm 27 | *************************************************************************** 28 | 29 | -------------------------------------------------------------------------------- /LICENSE.randomc.txt: -------------------------------------------------------------------------------- 1 | 2 | * Copyright 2001-2008 by Agner Fog. 3 | * GNU General Public License http://www.gnu.org/licenses/gpl.html 4 | 5 | 6 | 7 | See these links for the original C++ code: 8 | http://www.agner.org/random/ 9 | http://www.agner.org/random/randomc.zip 10 | -------------------------------------------------------------------------------- /LinqBridge.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ViRb3/de4dot-cex/389221374bb5f2ac9f6b8d2c7c311851f5654cc0/LinqBridge.dll -------------------------------------------------------------------------------- /Test.Rename.Dll/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Reflection; 21 | using System.Runtime.InteropServices; 22 | 23 | [assembly: AssemblyTitle("Test.Rename.Dll")] 24 | [assembly: AssemblyDescription("Renamer tests")] 25 | [assembly: AssemblyConfiguration("")] 26 | [assembly: AssemblyCompany("")] 27 | [assembly: AssemblyProduct("Test.Rename.Dll")] 28 | [assembly: AssemblyCopyright("Copyright (C) 2011-2015 de4dot@gmail.com")] 29 | [assembly: AssemblyTrademark("")] 30 | [assembly: AssemblyCulture("")] 31 | [assembly: ComVisible(false)] 32 | [assembly: AssemblyVersion("3.1.41592.3405")] 33 | [assembly: AssemblyFileVersion("3.1.41592.3405")] 34 | -------------------------------------------------------------------------------- /Test.Rename/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Reflection; 21 | using System.Runtime.InteropServices; 22 | 23 | [assembly: AssemblyTitle("Test.Rename")] 24 | [assembly: AssemblyDescription("Other renamer tests")] 25 | [assembly: AssemblyConfiguration("")] 26 | [assembly: AssemblyCompany("")] 27 | [assembly: AssemblyProduct("Test.Rename")] 28 | [assembly: AssemblyCopyright("Copyright (C) 2011-2015 de4dot@gmail.com")] 29 | [assembly: AssemblyTrademark("")] 30 | [assembly: AssemblyCulture("")] 31 | [assembly: ComVisible(false)] 32 | [assembly: AssemblyVersion("3.1.41592.3405")] 33 | [assembly: AssemblyFileVersion("3.1.41592.3405")] 34 | -------------------------------------------------------------------------------- /de4dot-x64/App.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /de4dot-x64/Program.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | namespace de4dot_x64 { 21 | class Program { 22 | static int Main(string[] args) { 23 | return de4dot.cui.Program.Main(args); 24 | } 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /de4dot-x64/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Reflection; 21 | using System.Runtime.InteropServices; 22 | 23 | [assembly: AssemblyTitle("de4dot-x64")] 24 | [assembly: AssemblyDescription("Deobfuscates obfuscated .NET applications - x64")] 25 | [assembly: AssemblyConfiguration("")] 26 | [assembly: AssemblyCompany("")] 27 | [assembly: AssemblyProduct("de4dot-x64")] 28 | [assembly: AssemblyCopyright("Copyright (C) 2011-2015 de4dot@gmail.com")] 29 | [assembly: AssemblyTrademark("")] 30 | [assembly: AssemblyCulture("")] 31 | [assembly: ComVisible(false)] 32 | [assembly: AssemblyVersion("3.1.41592.3405")] 33 | [assembly: AssemblyFileVersion("3.1.41592.3405")] 34 | -------------------------------------------------------------------------------- /de4dot.blocks/BaseBlock.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | namespace de4dot.blocks { 21 | public abstract class BaseBlock { 22 | ScopeBlock parent = null; 23 | 24 | public ScopeBlock Parent { 25 | get { return parent; } 26 | set { parent = value; } 27 | } 28 | } 29 | } 30 | -------------------------------------------------------------------------------- /de4dot.blocks/DumpedMethod.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | 22 | namespace de4dot.blocks { 23 | [Serializable] 24 | public class DumpedMethod { 25 | public ushort mhFlags; // method header Flags 26 | public ushort mhMaxStack; // method header MaxStack 27 | public uint mhCodeSize; // method header CodeSize 28 | public uint mhLocalVarSigTok; // method header LocalVarSigTok 29 | 30 | public uint mdRVA; // methodDef RVA 31 | public ushort mdImplFlags; // methodDef ImplFlags 32 | public ushort mdFlags; // methodDef Flags 33 | public uint mdName; // methodDef Name (index into #String) 34 | public uint mdSignature; // methodDef Signature (index into #Blob) 35 | public uint mdParamList; // methodDef ParamList (index into Param table) 36 | 37 | public uint token; // metadata token 38 | 39 | public byte[] code; 40 | public byte[] extraSections; 41 | } 42 | } 43 | -------------------------------------------------------------------------------- /de4dot.blocks/DumpedMethods.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | using System.Collections.Generic; 22 | using dnlib.DotNet.MD; 23 | using dnlib.DotNet; 24 | 25 | namespace de4dot.blocks { 26 | [Serializable] 27 | public class DumpedMethods { 28 | Dictionary methods = new Dictionary(); 29 | 30 | public int Count { 31 | get { return methods.Count; } 32 | } 33 | 34 | public void Add(uint token, DumpedMethod info) { 35 | methods[token] = info; 36 | } 37 | 38 | public DumpedMethod Get(MethodDef method) { 39 | return Get(method.MDToken.ToUInt32()); 40 | } 41 | 42 | public DumpedMethod Get(uint token) { 43 | DumpedMethod dm; 44 | methods.TryGetValue(token, out dm); 45 | return dm; 46 | } 47 | 48 | public void Add(DumpedMethod dm) { 49 | if (MDToken.ToTable(dm.token) != Table.Method || MDToken.ToRID(dm.token) == 0) 50 | throw new ArgumentException("Invalid token"); 51 | methods[dm.token] = dm; 52 | } 53 | } 54 | } 55 | -------------------------------------------------------------------------------- /de4dot.blocks/FilterHandlerBlock.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Collections.Generic; 21 | 22 | namespace de4dot.blocks { 23 | public class FilterHandlerBlock : ScopeBlock { 24 | } 25 | } 26 | -------------------------------------------------------------------------------- /de4dot.blocks/HandlerBlock.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Collections.Generic; 21 | 22 | namespace de4dot.blocks { 23 | // This is the block inside catch(xxx) { }. 24 | public class HandlerBlock : ScopeBlock { 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /de4dot.blocks/MethodBlocks.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Collections.Generic; 21 | 22 | namespace de4dot.blocks { 23 | // Start of a method 24 | public class MethodBlocks : ScopeBlock { 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /de4dot.blocks/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Reflection; 21 | using System.Runtime.InteropServices; 22 | 23 | [assembly: AssemblyTitle("de4dot.blocks")] 24 | [assembly: AssemblyDescription("Modifies dnlib MethodDef bodies")] 25 | [assembly: AssemblyConfiguration("")] 26 | [assembly: AssemblyCompany("")] 27 | [assembly: AssemblyProduct("de4dot.blocks")] 28 | [assembly: AssemblyCopyright("Copyright (C) 2011-2015 de4dot@gmail.com")] 29 | [assembly: AssemblyTrademark("")] 30 | [assembly: AssemblyCulture("")] 31 | [assembly: ComVisible(false)] 32 | [assembly: AssemblyVersion("3.1.41592.3405")] 33 | [assembly: AssemblyFileVersion("3.1.41592.3405")] 34 | -------------------------------------------------------------------------------- /de4dot.blocks/SwitchData.cs: -------------------------------------------------------------------------------- 1 | namespace de4dot.blocks 2 | { 3 | public class SwitchData 4 | { 5 | protected readonly Block _block; 6 | 7 | public int? Key; 8 | public bool IsKeyHardCoded; 9 | 10 | public SwitchData(Block block) 11 | { 12 | _block = block; 13 | } 14 | 15 | public virtual bool Initialize() 16 | { 17 | return false; 18 | } 19 | } 20 | } 21 | -------------------------------------------------------------------------------- /de4dot.blocks/TryBlock.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Collections.Generic; 21 | 22 | namespace de4dot.blocks { 23 | // This is the block inside try { }. 24 | public class TryBlock : ScopeBlock { 25 | // The first one is the most nested one and the last one is the 26 | // outer most handler. I.e., the exceptions are written to the 27 | // image in the same order they're saved here. 28 | List handlerBlocks = new List(); 29 | 30 | public List TryHandlerBlocks { 31 | get { return handlerBlocks; } 32 | } 33 | 34 | public void AddTryHandler(TryHandlerBlock tryHandlerBlock) { 35 | handlerBlocks.Add(tryHandlerBlock); 36 | } 37 | } 38 | } 39 | -------------------------------------------------------------------------------- /de4dot.blocks/TryHandlerBlock.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using dnlib.DotNet; 21 | using dnlib.DotNet.Emit; 22 | 23 | namespace de4dot.blocks { 24 | // Contains the filter handler block and the catch handler block. 25 | public class TryHandlerBlock : ScopeBlock { 26 | FilterHandlerBlock filterHandlerBlock = new FilterHandlerBlock(); 27 | HandlerBlock handlerBlock = new HandlerBlock(); 28 | 29 | // State for an ExceptionHandler instance 30 | ITypeDefOrRef catchType; 31 | ExceptionHandlerType handlerType; 32 | 33 | public ITypeDefOrRef CatchType { 34 | get { return catchType; } 35 | } 36 | 37 | public ExceptionHandlerType HandlerType { 38 | get { return handlerType; } 39 | } 40 | 41 | public FilterHandlerBlock FilterHandlerBlock { 42 | get { return filterHandlerBlock; } 43 | } 44 | 45 | public HandlerBlock HandlerBlock { 46 | get { return handlerBlock; } 47 | } 48 | 49 | public TryHandlerBlock(ExceptionHandler handler) { 50 | this.catchType = handler.CatchType; 51 | this.handlerType = handler.HandlerType; 52 | } 53 | } 54 | } 55 | -------------------------------------------------------------------------------- /de4dot.blocks/cflow/BlockDeobfuscator.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | using System.Collections.Generic; 22 | 23 | namespace de4dot.blocks.cflow { 24 | public abstract class BlockDeobfuscator : IBlocksDeobfuscator { 25 | protected List allBlocks; 26 | protected Blocks blocks; 27 | 28 | public bool ExecuteIfNotModified { get; set; } 29 | 30 | public virtual void DeobfuscateBegin(Blocks blocks) { 31 | this.blocks = blocks; 32 | } 33 | 34 | public bool Deobfuscate(List allBlocks) { 35 | Initialize(allBlocks); 36 | 37 | bool modified = false; 38 | foreach (var block in allBlocks) { 39 | try { 40 | modified |= Deobfuscate(block); 41 | } 42 | catch (NullReferenceException) { 43 | // Here if eg. invalid metadata token in a call instruction (operand is null) 44 | } 45 | } 46 | return modified; 47 | } 48 | 49 | protected virtual void Initialize(List allBlocks) { 50 | this.allBlocks = allBlocks; 51 | } 52 | 53 | protected abstract bool Deobfuscate(Block block); 54 | } 55 | } 56 | -------------------------------------------------------------------------------- /de4dot.blocks/cflow/CflowDeobfuscator.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Collections.Generic; 21 | using dnlib.DotNet; 22 | using dnlib.DotNet.Emit; 23 | 24 | namespace de4dot.blocks.cflow { 25 | public class CflowDeobfuscator : ICflowDeobfuscator { 26 | BlocksCflowDeobfuscator cflowDeobfuscator = new BlocksCflowDeobfuscator(); 27 | 28 | public CflowDeobfuscator() { 29 | } 30 | 31 | public CflowDeobfuscator(IBlocksDeobfuscator blocksDeobfuscator) { 32 | cflowDeobfuscator.Add(blocksDeobfuscator); 33 | } 34 | 35 | public void Deobfuscate(MethodDef method) { 36 | Deobfuscate(method, (blocks) => { 37 | cflowDeobfuscator.Initialize(blocks); 38 | cflowDeobfuscator.Deobfuscate(); 39 | }); 40 | } 41 | 42 | static bool HasNonEmptyBody(MethodDef method) { 43 | return method.Body != null && method.Body.Instructions.Count > 0; 44 | } 45 | 46 | void Deobfuscate(MethodDef method, Action handler) { 47 | if (HasNonEmptyBody(method)) { 48 | var blocks = new Blocks(method); 49 | 50 | handler(blocks); 51 | 52 | IList allInstructions; 53 | IList allExceptionHandlers; 54 | blocks.GetCode(out allInstructions, out allExceptionHandlers); 55 | DotNetUtils.RestoreBody(method, allInstructions, allExceptionHandlers); 56 | } 57 | } 58 | } 59 | } 60 | -------------------------------------------------------------------------------- /de4dot.blocks/cflow/CflowUtils.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Collections.Generic; 21 | 22 | namespace de4dot.blocks.cflow { 23 | static class CflowUtils { 24 | public static Block GetSwitchTarget(IList targets, Block fallThrough, Int32Value intValue) { 25 | if (!intValue.AllBitsValid()) 26 | return null; 27 | 28 | int index = intValue.Value; 29 | if (targets == null || index < 0 || index >= targets.Count) 30 | return fallThrough; 31 | else 32 | return targets[index]; 33 | } 34 | } 35 | } 36 | -------------------------------------------------------------------------------- /de4dot.blocks/cflow/DupBlockDeobfuscator.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | using System.Collections.Generic; 22 | using dnlib.DotNet.Emit; 23 | 24 | namespace de4dot.blocks.cflow { 25 | // If a block is just a dup followed by a bcc, try to append the block 26 | // to all its sources. Will fix some SA assemblies. 27 | class DupBlockCflowDeobfuscator : BlockDeobfuscator { 28 | protected override bool Deobfuscate(Block block) { 29 | if (block.Instructions.Count != 2) 30 | return false; 31 | if (block.Instructions[0].OpCode.Code != Code.Dup) 32 | return false; 33 | if (!block.LastInstr.IsConditionalBranch() && block.LastInstr.OpCode.Code != Code.Switch) 34 | return false; 35 | 36 | bool modified = false; 37 | foreach (var source in new List(block.Sources)) { 38 | if (source.GetOnlyTarget() != block) 39 | continue; 40 | if (!source.CanAppend(block)) 41 | continue; 42 | 43 | source.Append(block); 44 | modified = true; 45 | } 46 | return modified; 47 | } 48 | } 49 | } 50 | -------------------------------------------------------------------------------- /de4dot.blocks/cflow/IBlocksDeobfuscator.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Collections.Generic; 21 | 22 | namespace de4dot.blocks.cflow { 23 | public interface IBlocksDeobfuscator { 24 | bool ExecuteIfNotModified { get; } 25 | 26 | void DeobfuscateBegin(Blocks blocks); 27 | 28 | // Returns true if something was updated 29 | bool Deobfuscate(List allBlocks); 30 | } 31 | } 32 | -------------------------------------------------------------------------------- /de4dot.blocks/cflow/ICflowDeobfuscator.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using dnlib.DotNet; 21 | 22 | namespace de4dot.blocks.cflow { 23 | public interface ICflowDeobfuscator { 24 | void Deobfuscate(MethodDef method); 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /de4dot.code/7zip/Compress/RangeCoder/RangeCoderBit.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | 3 | namespace SevenZip.Compression.RangeCoder 4 | { 5 | struct BitDecoder 6 | { 7 | public const int kNumBitModelTotalBits = 11; 8 | public const uint kBitModelTotal = (1 << kNumBitModelTotalBits); 9 | const int kNumMoveBits = 5; 10 | 11 | uint Prob; 12 | 13 | public void UpdateModel(int numMoveBits, uint symbol) 14 | { 15 | if (symbol == 0) 16 | Prob += (kBitModelTotal - Prob) >> numMoveBits; 17 | else 18 | Prob -= (Prob) >> numMoveBits; 19 | } 20 | 21 | public void Init() { Prob = kBitModelTotal >> 1; } 22 | 23 | public uint Decode(RangeCoder.Decoder rangeDecoder) 24 | { 25 | uint newBound = (uint)(rangeDecoder.Range >> kNumBitModelTotalBits) * (uint)Prob; 26 | if (rangeDecoder.Code < newBound) 27 | { 28 | rangeDecoder.Range = newBound; 29 | Prob += (kBitModelTotal - Prob) >> kNumMoveBits; 30 | if (rangeDecoder.Range < Decoder.kTopValue) 31 | { 32 | rangeDecoder.Code = (rangeDecoder.Code << 8) | (byte)rangeDecoder.Stream.ReadByte(); 33 | rangeDecoder.Range <<= 8; 34 | } 35 | return 0; 36 | } 37 | else 38 | { 39 | rangeDecoder.Range -= newBound; 40 | rangeDecoder.Code -= newBound; 41 | Prob -= (Prob) >> kNumMoveBits; 42 | if (rangeDecoder.Range < Decoder.kTopValue) 43 | { 44 | rangeDecoder.Code = (rangeDecoder.Code << 8) | (byte)rangeDecoder.Stream.ReadByte(); 45 | rangeDecoder.Range <<= 8; 46 | } 47 | return 1; 48 | } 49 | } 50 | } 51 | } 52 | -------------------------------------------------------------------------------- /de4dot.code/7zip/Compress/RangeCoder/RangeCoderBitTree.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | 3 | namespace SevenZip.Compression.RangeCoder 4 | { 5 | struct BitTreeDecoder 6 | { 7 | BitDecoder[] Models; 8 | int NumBitLevels; 9 | 10 | public BitTreeDecoder(int numBitLevels) 11 | { 12 | NumBitLevels = numBitLevels; 13 | Models = new BitDecoder[1 << numBitLevels]; 14 | } 15 | 16 | public void Init() 17 | { 18 | for (uint i = 1; i < (1 << NumBitLevels); i++) 19 | Models[i].Init(); 20 | } 21 | 22 | public uint Decode(RangeCoder.Decoder rangeDecoder) 23 | { 24 | uint m = 1; 25 | for (int bitIndex = NumBitLevels; bitIndex > 0; bitIndex--) 26 | m = (m << 1) + Models[m].Decode(rangeDecoder); 27 | return m - ((uint)1 << NumBitLevels); 28 | } 29 | 30 | public uint ReverseDecode(RangeCoder.Decoder rangeDecoder) 31 | { 32 | uint m = 1; 33 | uint symbol = 0; 34 | for (int bitIndex = 0; bitIndex < NumBitLevels; bitIndex++) 35 | { 36 | uint bit = Models[m].Decode(rangeDecoder); 37 | m <<= 1; 38 | m += bit; 39 | symbol |= (bit << bitIndex); 40 | } 41 | return symbol; 42 | } 43 | 44 | public static uint ReverseDecode(BitDecoder[] Models, UInt32 startIndex, 45 | RangeCoder.Decoder rangeDecoder, int NumBitLevels) 46 | { 47 | uint m = 1; 48 | uint symbol = 0; 49 | for (int bitIndex = 0; bitIndex < NumBitLevels; bitIndex++) 50 | { 51 | uint bit = Models[startIndex + m].Decode(rangeDecoder); 52 | m <<= 1; 53 | m += bit; 54 | symbol |= (bit << bitIndex); 55 | } 56 | return symbol; 57 | } 58 | } 59 | } 60 | -------------------------------------------------------------------------------- /de4dot.code/7zip/ICoder.cs: -------------------------------------------------------------------------------- 1 | // ICoder.h 2 | 3 | using System; 4 | 5 | namespace SevenZip 6 | { 7 | /// 8 | /// The exception that is thrown when an error in input stream occurs during decoding. 9 | /// 10 | class DataErrorException : ApplicationException 11 | { 12 | public DataErrorException(): base("Data Error") { } 13 | } 14 | 15 | /// 16 | /// The exception that is thrown when the value of an argument is outside the allowable range. 17 | /// 18 | class InvalidParamException : ApplicationException 19 | { 20 | public InvalidParamException(): base("Invalid Parameter") { } 21 | } 22 | 23 | public interface ICodeProgress 24 | { 25 | /// 26 | /// Callback progress. 27 | /// 28 | /// 29 | /// input size. -1 if unknown. 30 | /// 31 | /// 32 | /// output size. -1 if unknown. 33 | /// 34 | void SetProgress(Int64 inSize, Int64 outSize); 35 | }; 36 | 37 | public interface ICoder 38 | { 39 | /// 40 | /// Codes streams. 41 | /// 42 | /// 43 | /// input Stream. 44 | /// 45 | /// 46 | /// output Stream. 47 | /// 48 | /// 49 | /// input Size. -1 if unknown. 50 | /// 51 | /// 52 | /// output Size. -1 if unknown. 53 | /// 54 | /// 55 | /// callback progress reference. 56 | /// 57 | /// 58 | /// if input stream is not valid 59 | /// 60 | void Code(System.IO.Stream inStream, System.IO.Stream outStream, 61 | Int64 inSize, Int64 outSize, ICodeProgress progress); 62 | }; 63 | 64 | public interface ISetDecoderProperties 65 | { 66 | void SetDecoderProperties(byte[] properties); 67 | } 68 | } 69 | -------------------------------------------------------------------------------- /de4dot.code/AssemblyClient/IAssemblyClient.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | using AssemblyData; 22 | 23 | namespace de4dot.code.AssemblyClient { 24 | public interface IAssemblyClient : IDisposable { 25 | IAssemblyService Service { get; } 26 | IStringDecrypterService StringDecrypterService { get; } 27 | IMethodDecrypterService MethodDecrypterService { get; } 28 | IGenericService GenericService { get; } 29 | void Connect(); 30 | void WaitConnected(); 31 | } 32 | } 33 | -------------------------------------------------------------------------------- /de4dot.code/AssemblyClient/IAssemblyServerLoader.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | using AssemblyData; 22 | 23 | namespace de4dot.code.AssemblyClient { 24 | public interface IAssemblyServerLoader : IDisposable { 25 | void LoadServer(); 26 | IAssemblyService CreateService(); 27 | } 28 | } 29 | -------------------------------------------------------------------------------- /de4dot.code/AssemblyClient/SameAppDomainAssemblyServerLoader.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | using AssemblyData; 22 | 23 | namespace de4dot.code.AssemblyClient { 24 | // Starts the server in the current app domain. 25 | public class SameAppDomainAssemblyServerLoader : IAssemblyServerLoader { 26 | IAssemblyService service; 27 | AssemblyServiceType serviceType; 28 | 29 | public SameAppDomainAssemblyServerLoader(AssemblyServiceType serviceType) { 30 | this.serviceType = serviceType; 31 | } 32 | 33 | public void LoadServer() { 34 | if (service != null) 35 | throw new ApplicationException("Server already loaded"); 36 | service = AssemblyService.Create(serviceType); 37 | } 38 | 39 | public IAssemblyService CreateService() { 40 | return service; 41 | } 42 | 43 | public void Dispose() { 44 | } 45 | } 46 | } 47 | -------------------------------------------------------------------------------- /de4dot.code/AssemblyResolver.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using dnlib.DotNet; 21 | 22 | namespace de4dot.code { 23 | public class TheAssemblyResolver : AssemblyResolver { 24 | public static readonly TheAssemblyResolver Instance = new TheAssemblyResolver(); 25 | 26 | public TheAssemblyResolver() { 27 | EnableTypeDefCache = true; 28 | } 29 | 30 | public void AddSearchDirectory(string dir) { 31 | if (!PostSearchPaths.Contains(dir)) 32 | PostSearchPaths.Add(dir); 33 | } 34 | 35 | public void AddModule(ModuleDef module) { 36 | AddToCache(module.Assembly); 37 | } 38 | 39 | public void RemoveModule(ModuleDef module) { 40 | var assembly = module.Assembly; 41 | if (assembly == null) 42 | return; 43 | 44 | Remove(module.Assembly); 45 | } 46 | 47 | public void ClearAll() { 48 | //TODO: cache.Clear(); 49 | //TODO: resetSearchPaths(); 50 | } 51 | } 52 | } 53 | -------------------------------------------------------------------------------- /de4dot.code/HandleProcessCorruptedStateExceptionsAttribute.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | namespace System.Runtime.ExceptionServices { 21 | [AttributeUsage(AttributeTargets.Method, AllowMultiple = false, Inherited = false)] 22 | public class HandleProcessCorruptedStateExceptionsAttribute : Attribute { 23 | } 24 | } 25 | -------------------------------------------------------------------------------- /de4dot.code/IDeobfuscatorContext.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using dnlib.DotNet; 21 | 22 | namespace de4dot.code { 23 | public interface IDeobfuscatorContext { 24 | void Clear(); 25 | void SetData(string name, object data); 26 | object GetData(string name); 27 | void ClearData(string name); 28 | TypeDef ResolveType(ITypeDefOrRef type); 29 | MethodDef ResolveMethod(IMethod method); 30 | FieldDef ResolveField(IField field); 31 | } 32 | } 33 | -------------------------------------------------------------------------------- /de4dot.code/IObfuscatedFile.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | using System.Collections.Generic; 22 | using de4dot.code.deobfuscators; 23 | using dnlib.DotNet; 24 | using de4dot.code.renamer; 25 | 26 | namespace de4dot.code { 27 | public interface IObfuscatedFile : IDisposable { 28 | ModuleDefMD ModuleDefMD { get; } 29 | IDeobfuscator Deobfuscator { get; } 30 | IDeobfuscatorContext DeobfuscatorContext { get; set; } 31 | string Filename { get; } 32 | string NewFilename { get; } 33 | INameChecker NameChecker { get; } 34 | bool RenameResourcesInCode { get; } 35 | bool RemoveNamespaceWithOneType { get; } 36 | bool RenameResourceKeys { get; } 37 | 38 | void DeobfuscateBegin(); 39 | void Deobfuscate(); 40 | void DeobfuscateEnd(); 41 | void DeobfuscateCleanUp(); 42 | 43 | void Load(IList deobfuscators); 44 | void Save(); 45 | } 46 | } 47 | -------------------------------------------------------------------------------- /de4dot.code/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Reflection; 21 | using System.Runtime.InteropServices; 22 | 23 | [assembly: AssemblyTitle("de4dot.code")] 24 | [assembly: AssemblyDescription("Deobfuscates obfuscated .NET applications")] 25 | [assembly: AssemblyConfiguration("")] 26 | [assembly: AssemblyCompany("")] 27 | [assembly: AssemblyProduct("de4dot.code")] 28 | [assembly: AssemblyCopyright("Copyright (C) 2011-2015 de4dot@gmail.com")] 29 | [assembly: AssemblyTrademark("")] 30 | [assembly: AssemblyCulture("")] 31 | [assembly: ComVisible(false)] 32 | [assembly: AssemblyVersion("3.1.41592.3405")] 33 | [assembly: AssemblyFileVersion("3.1.41592.3405")] 34 | -------------------------------------------------------------------------------- /de4dot.code/SharpZipLib/Main.cs: -------------------------------------------------------------------------------- 1 | // Main.cs 2 | // 3 | // Copyright (C) 2001 Mike Krueger 4 | // 5 | // This program is free software; you can redistribute it and/or 6 | // modify it under the terms of the GNU General Public License 7 | // as published by the Free Software Foundation; either version 2 8 | // of the License, or (at your option) any later version. 9 | // 10 | // This program is distributed in the hope that it will be useful, 11 | // but WITHOUT ANY WARRANTY; without even the implied warranty of 12 | // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 | // GNU General Public License for more details. 14 | // 15 | // You should have received a copy of the GNU General Public License 16 | // along with this program; if not, write to the Free Software 17 | // Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. 18 | // 19 | // Linking this library statically or dynamically with other modules is 20 | // making a combined work based on this library. Thus, the terms and 21 | // conditions of the GNU General Public License cover the whole 22 | // combination. 23 | // 24 | // As a special exception, the copyright holders of this library give you 25 | // permission to link this library with independent modules to produce an 26 | // executable, regardless of the license terms of these independent 27 | // modules, and to copy and distribute the resulting executable under 28 | // terms of your choice, provided that you also meet, for each linked 29 | // independent module, the terms and conditions of the license of that 30 | // module. An independent module is a module which is not derived from 31 | // or based on this library. If you modify this library, you may extend 32 | // this exception to your version of the library, but you are not 33 | // obligated to do so. If you do not wish to do so, delete this 34 | // exception statement from your version. 35 | // 36 | 37 | -------------------------------------------------------------------------------- /de4dot.code/UserException.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | 22 | namespace de4dot.code { 23 | public class UserException : Exception { 24 | public UserException(string message) 25 | : base(message) { 26 | } 27 | 28 | public UserException(string message, Exception innerException) 29 | : base(message, innerException) { 30 | } 31 | } 32 | } 33 | -------------------------------------------------------------------------------- /de4dot.code/Win32Path.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | namespace de4dot.code { 21 | public static class Win32Path { 22 | public static string GetFileName(string path) { 23 | if (path == null) 24 | return null; 25 | if (path.Length == 0) 26 | return string.Empty; 27 | var c = path[path.Length - 1]; 28 | if (c == '\\' || c == ':') 29 | return string.Empty; 30 | int index = path.LastIndexOf('\\'); 31 | if (index < 0) 32 | return path; 33 | return path.Substring(index + 1); 34 | } 35 | 36 | public static string GetFileNameWithoutExtension(string path) { 37 | if (path == null) 38 | return null; 39 | var s = GetFileName(path); 40 | int i = s.LastIndexOf('.'); 41 | if (i < 0) 42 | return s; 43 | return s.Substring(0, i); 44 | } 45 | 46 | public static string GetExtension(string path) { 47 | if (path == null) 48 | return null; 49 | var s = GetFileName(path); 50 | int i = s.LastIndexOf('.'); 51 | if (i < 0) 52 | return string.Empty; 53 | return s.Substring(i); 54 | } 55 | } 56 | } 57 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/Agile_NET/CsBlowfish.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | namespace de4dot.code.deobfuscators.Agile_NET { 21 | class CsBlowfish : Blowfish { 22 | public CsBlowfish() { 23 | } 24 | 25 | public CsBlowfish(byte[] key) 26 | : base(key) { 27 | } 28 | 29 | protected override void Encrypt(ref uint rxl, ref uint rxr) { 30 | uint xl = rxl, xr = rxr; 31 | for (int i = 0; i < 16; i++) { 32 | xl ^= P[i]; 33 | uint t = xl; 34 | xl = (xl >> 24) ^ xr; 35 | xr = t; 36 | } 37 | rxr = xl ^ P[16]; 38 | rxl = xr ^ P[17]; 39 | } 40 | 41 | protected override void Decrypt(ref uint rxl, ref uint rxr) { 42 | uint xl = rxl, xr = rxr; 43 | for (int i = 17; i >= 2; i--) { 44 | xl ^= P[i]; 45 | uint t = xl; 46 | xl = (xl >> 24) ^ xr; 47 | xr = t; 48 | } 49 | rxr = xl ^ P[1]; 50 | rxl = xr ^ P[0]; 51 | } 52 | } 53 | } 54 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/Agile_NET/StringDecrypterInfo.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using dnlib.DotNet; 21 | 22 | namespace de4dot.code.deobfuscators.Agile_NET { 23 | class StringDecrypterInfo { 24 | public readonly MethodDef Method; 25 | public readonly FieldDef Field; 26 | 27 | public StringDecrypterInfo(MethodDef method) 28 | : this(method, null) { 29 | } 30 | 31 | public StringDecrypterInfo(MethodDef method, FieldDef field) { 32 | this.Method = method; 33 | this.Field = field; 34 | } 35 | 36 | public override int GetHashCode() { 37 | int hash = 0; 38 | if (Method != null) 39 | hash ^= Method.GetHashCode(); 40 | if (Field != null) 41 | hash ^= Field.GetHashCode(); 42 | return hash; 43 | } 44 | 45 | public override bool Equals(object obj) { 46 | var other = obj as StringDecrypterInfo; 47 | return other != null && 48 | Method == other.Method && 49 | Field == other.Field; 50 | } 51 | } 52 | } 53 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/Agile_NET/vm/CsvmDataReader.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | using System.Collections.Generic; 22 | using System.IO; 23 | using dnlib.IO; 24 | using dnlib.DotNet; 25 | using de4dot.blocks; 26 | 27 | namespace de4dot.code.deobfuscators.Agile_NET.vm { 28 | class CsvmDataReader { 29 | IBinaryReader reader; 30 | 31 | public CsvmDataReader(IBinaryReader reader) { 32 | reader.Position = 0; 33 | this.reader = reader; 34 | } 35 | 36 | public List Read() { 37 | int numMethods = reader.ReadInt32(); 38 | if (numMethods < 0) 39 | throw new ApplicationException("Invalid number of methods"); 40 | var methods = new List(numMethods); 41 | 42 | for (int i = 0; i < numMethods; i++) { 43 | var csvmMethod = new CsvmMethodData(); 44 | csvmMethod.Guid = new Guid(reader.ReadBytes(16)); 45 | csvmMethod.Token = reader.ReadInt32(); 46 | csvmMethod.Locals = reader.ReadBytes(reader.ReadInt32()); 47 | csvmMethod.Instructions = reader.ReadBytes(reader.ReadInt32()); 48 | csvmMethod.Exceptions = reader.ReadBytes(reader.ReadInt32()); 49 | methods.Add(csvmMethod); 50 | } 51 | 52 | return methods; 53 | } 54 | } 55 | } 56 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/Agile_NET/vm/CsvmMethodData.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | 22 | namespace de4dot.code.deobfuscators.Agile_NET.vm { 23 | class CsvmMethodData { 24 | public Guid Guid { get; set; } 25 | public int Token { get; set; } 26 | public byte[] Locals { get; set; } 27 | public byte[] Instructions { get; set; } 28 | public byte[] Exceptions { get; set; } 29 | 30 | public override string ToString() { 31 | return string.Format("{0:X8} - {1}", Token, Guid); 32 | } 33 | } 34 | } 35 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/Agile_NET/vm/v1/CsvmToCilMethodConverter.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | using System.Collections.Generic; 22 | using System.IO; 23 | using dnlib.DotNet; 24 | using dnlib.DotNet.Emit; 25 | using de4dot.blocks; 26 | 27 | namespace de4dot.code.deobfuscators.Agile_NET.vm.v1 { 28 | class CsvmToCilMethodConverter : CsvmToCilMethodConverterBase { 29 | VmOpCodeHandlerDetector opCodeDetector; 30 | 31 | public CsvmToCilMethodConverter(IDeobfuscatorContext deobfuscatorContext, ModuleDefMD module, VmOpCodeHandlerDetector opCodeDetector) 32 | : base(deobfuscatorContext, module) { 33 | this.opCodeDetector = opCodeDetector; 34 | } 35 | 36 | protected override List ReadInstructions(MethodDef cilMethod, CsvmMethodData csvmMethod) { 37 | var gpContext = GenericParamContext.Create(cilMethod); 38 | var reader = new BinaryReader(new MemoryStream(csvmMethod.Instructions)); 39 | var instrs = new List(); 40 | uint offset = 0; 41 | while (reader.BaseStream.Position < reader.BaseStream.Length) { 42 | int vmOpCode = reader.ReadUInt16(); 43 | var instr = opCodeDetector.Handlers[vmOpCode].Read(reader, module, gpContext); 44 | instr.Offset = offset; 45 | offset += (uint)GetInstructionSize(instr); 46 | SetCilToVmIndex(instr, instrs.Count); 47 | SetVmIndexToCil(instr, instrs.Count); 48 | instrs.Add(instr); 49 | } 50 | return instrs; 51 | } 52 | } 53 | } 54 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/Agile_NET/vm/v2/CSVM1.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ViRb3/de4dot-cex/389221374bb5f2ac9f6b8d2c7c311851f5654cc0/de4dot.code/deobfuscators/Agile_NET/vm/v2/CSVM1.bin -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/Agile_NET/vm/v2/CSVM2.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ViRb3/de4dot-cex/389221374bb5f2ac9f6b8d2c7c311851f5654cc0/de4dot.code/deobfuscators/Agile_NET/vm/v2/CSVM2.bin -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/Agile_NET/vm/v2/CSVM3.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ViRb3/de4dot-cex/389221374bb5f2ac9f6b8d2c7c311851f5654cc0/de4dot.code/deobfuscators/Agile_NET/vm/v2/CSVM3.bin -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/Agile_NET/vm/v2/CSVM4.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ViRb3/de4dot-cex/389221374bb5f2ac9f6b8d2c7c311851f5654cc0/de4dot.code/deobfuscators/Agile_NET/vm/v2/CSVM4.bin -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/Agile_NET/vm/v2/CSVM5.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ViRb3/de4dot-cex/389221374bb5f2ac9f6b8d2c7c311851f5654cc0/de4dot.code/deobfuscators/Agile_NET/vm/v2/CSVM5.bin -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/Agile_NET/vm/v2/CompositeOpCodeHandler.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Collections.Generic; 21 | using System.Text; 22 | using dnlib.DotNet; 23 | using de4dot.blocks; 24 | 25 | namespace de4dot.code.deobfuscators.Agile_NET.vm.v2 { 26 | class CompositeOpCodeHandler { 27 | public List BlockSigInfos { get; private set; } 28 | public List TypeCodes { get; private set; } 29 | 30 | public CompositeOpCodeHandler(List blockSigInfos) { 31 | this.BlockSigInfos = blockSigInfos; 32 | this.TypeCodes = new List(); 33 | } 34 | 35 | public override string ToString() { 36 | return OpCodeHandlerInfo.GetCompositeName(TypeCodes); 37 | } 38 | } 39 | } 40 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/Agile_NET/vm/v2/HandlerTypeCode.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | namespace de4dot.code.deobfuscators.Agile_NET.vm.v2 { 21 | // These constants are hard coded. Don't change the values (i.e., only append if more are needed) 22 | enum HandlerTypeCode { 23 | Add, 24 | Add_Ovf, 25 | Add_Ovf_Un, 26 | And, 27 | Beq, 28 | Bge, 29 | Bge_Un, 30 | Bgt, 31 | Bgt_Un, 32 | Ble, 33 | Ble_Un, 34 | Blt, 35 | Blt_Un, 36 | Bne_Un, 37 | Box, 38 | Br, 39 | Brfalse, 40 | Brtrue, 41 | Call, 42 | Callvirt, 43 | Castclass, 44 | Ceq, 45 | Cgt, 46 | Cgt_Un, 47 | Clt, 48 | Clt_Un, 49 | Conv, 50 | Div, 51 | Div_Un, 52 | Dup, 53 | Endfinally, 54 | Initobj, 55 | Isinst, 56 | Ldarg, 57 | Ldarga, 58 | Ldc, 59 | Ldelem, 60 | Ldelema, 61 | Ldfld_Ldsfld, 62 | Ldflda_Ldsflda, 63 | Ldftn, 64 | Ldlen, 65 | Ldloc, 66 | Ldloca, 67 | Ldobj, 68 | Ldstr, 69 | Ldtoken, 70 | Ldvirtftn, 71 | Leave, 72 | Mul, 73 | Mul_Ovf, 74 | Mul_Ovf_Un, 75 | Neg, 76 | Newarr, 77 | Newobj, 78 | Nop, 79 | Not, 80 | Or, 81 | Pop, 82 | Rem, 83 | Rem_Un, 84 | Ret, 85 | Rethrow, 86 | Shl, 87 | Shr, 88 | Shr_Un, 89 | Starg, 90 | Stelem, 91 | Stfld_Stsfld, 92 | Stloc, 93 | Stobj, 94 | Sub, 95 | Sub_Ovf, 96 | Sub_Ovf_Un, 97 | Switch, 98 | Throw, 99 | Unbox_Any, 100 | Xor, 101 | } 102 | } 103 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/Agile_NET/vm/v2/VmOpCode.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Collections.Generic; 21 | using System.Text; 22 | 23 | namespace de4dot.code.deobfuscators.Agile_NET.vm.v2 { 24 | class VmOpCode { 25 | public List HandlerTypeCodes { get; private set; } 26 | 27 | public VmOpCode(List opCodeHandlerInfos) { 28 | this.HandlerTypeCodes = new List(opCodeHandlerInfos.Count); 29 | this.HandlerTypeCodes.AddRange(opCodeHandlerInfos); 30 | } 31 | 32 | public override string ToString() { 33 | return OpCodeHandlerInfo.GetCompositeName(HandlerTypeCodes); 34 | } 35 | } 36 | } 37 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/Babel_NET/BabelInflater.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using ICSharpCode.SharpZipLib; 21 | using ICSharpCode.SharpZipLib.Zip.Compression; 22 | 23 | namespace de4dot.code.deobfuscators.Babel_NET { 24 | class BabelInflater : Inflater { 25 | int magic; 26 | 27 | public BabelInflater(bool noHeader, int magic) 28 | : base(noHeader) { 29 | this.magic = magic; 30 | } 31 | 32 | protected override bool ReadHeader(ref bool isLastBlock, out int blockType) { 33 | const int numBits = 4; 34 | 35 | int type = input.PeekBits(numBits); 36 | if (type < 0) { 37 | blockType = -1; 38 | return false; 39 | } 40 | input.DropBits(numBits); 41 | 42 | if ((type & 1) != 0) 43 | isLastBlock = true; 44 | switch (type >> 1) { 45 | case 1: blockType = STORED_BLOCK; break; 46 | case 5: blockType = STATIC_TREES; break; 47 | case 6: blockType = DYN_TREES; break; 48 | default: throw new SharpZipBaseException("Unknown block type: " + type); 49 | } 50 | return true; 51 | } 52 | 53 | protected override bool DecodeStoredLength() { 54 | if ((uncomprLen = input.PeekBits(16)) < 0) 55 | return false; 56 | input.DropBits(16); 57 | 58 | uncomprLen ^= magic; 59 | 60 | return true; 61 | } 62 | } 63 | } 64 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/CodeFort/CfMethodCallInliner.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using dnlib.DotNet; 21 | using de4dot.blocks; 22 | using de4dot.blocks.cflow; 23 | 24 | namespace de4dot.code.deobfuscators.CodeFort { 25 | class CfMethodCallInliner : MethodCallInliner { 26 | ProxyCallFixer proxyCallFixer; 27 | 28 | public CfMethodCallInliner(ProxyCallFixer proxyCallFixer) 29 | : base(false) { 30 | this.proxyCallFixer = proxyCallFixer; 31 | } 32 | 33 | protected override bool CanInline(MethodDef method) { 34 | return proxyCallFixer.IsProxyTargetMethod(method); 35 | } 36 | 37 | protected override bool IsCompatibleType(int paramIndex, IType origType, IType newType) { 38 | return true; 39 | } 40 | } 41 | } 42 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/CodeVeil/InvalidDataException.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | 22 | namespace de4dot.code.deobfuscators.CodeVeil { 23 | [Serializable] 24 | class InvalidDataException : Exception { 25 | public InvalidDataException(string msg) 26 | : base(msg) { 27 | } 28 | } 29 | } 30 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/CodeVeil/InvalidMethodsFinder.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Collections.Generic; 21 | using dnlib.DotNet; 22 | 23 | namespace de4dot.code.deobfuscators.CodeVeil { 24 | class InvalidMethodsFinder { 25 | public static List FindAll(ModuleDefMD module) { 26 | var list = new List(); 27 | foreach (var type in module.GetTypes()) { 28 | foreach (var method in type.Methods) { 29 | if (IsInvalidMethod(method)) 30 | list.Add(method); 31 | } 32 | } 33 | return list; 34 | } 35 | 36 | public static bool IsInvalidMethod(MethodDef method) { 37 | if (method == null || method.IsStatic) 38 | return false; 39 | var sig = method.MethodSig; 40 | if (sig == null || sig.Params.Count != 0) 41 | return false; 42 | if (sig.RetType == null) 43 | return true; 44 | var retType = sig.RetType as GenericSig; 45 | if (retType == null) 46 | return false; 47 | 48 | if (retType.IsMethodVar) 49 | return retType.Number >= sig.GenParamCount; 50 | var dt = method.DeclaringType; 51 | return dt == null || retType.Number >= dt.GenericParameters.Count; 52 | } 53 | } 54 | } 55 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/CodeVeil/ObfuscatorVersion.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | namespace de4dot.code.deobfuscators.CodeVeil { 21 | enum ObfuscatorVersion { 22 | Unknown, 23 | V3, 24 | V4_0, 25 | V4_1, 26 | V5_0, 27 | } 28 | } 29 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/CodeVeil/ResourceInfo.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | using dnlib.IO; 22 | 23 | namespace de4dot.code.deobfuscators.CodeVeil { 24 | class ResourceInfo { 25 | public string name; 26 | public byte flags; 27 | public int offset; 28 | public int length; 29 | public IBinaryReader dataReader; 30 | public ResourceInfo(string name, byte flags, int offset, int length) { 31 | this.name = name; 32 | this.flags = flags; 33 | this.offset = offset; 34 | this.length = length; 35 | } 36 | 37 | public override string ToString() { 38 | return string.Format("{0:X2} {1:X8} {2} {3}", flags, offset, length, name); 39 | } 40 | } 41 | } 42 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/CodeWall/KeyGenerator.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System; 21 | using de4dot.code.deobfuscators.CodeWall.randomc; 22 | 23 | namespace de4dot.code.deobfuscators.CodeWall { 24 | class KeyGenerator { 25 | CRandomMersenne mersenne; 26 | CRandomMother mother; 27 | 28 | public KeyGenerator(int seed) { 29 | mersenne = new CRandomMersenne(seed); 30 | mother = new CRandomMother(seed); 31 | } 32 | 33 | uint Random() { 34 | return (mersenne.BRandom() >> 1) ^ (uint)Math.Abs((int)(mother.Random() * int.MinValue)); 35 | } 36 | 37 | public byte[] Generate(int size) { 38 | var key = new byte[size]; 39 | for (int i = 0; i < size; i++) 40 | key[i] = (byte)Random(); 41 | return key; 42 | } 43 | } 44 | } 45 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/Confuser/Arg64ConstantsReader.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Collections.Generic; 21 | using dnlib.DotNet.Emit; 22 | 23 | namespace de4dot.code.deobfuscators.Confuser { 24 | class Arg64ConstantsReader : ConstantsReader { 25 | long arg; 26 | bool firstTime; 27 | 28 | public long Arg { 29 | get { return arg; } 30 | set { 31 | arg = value; 32 | firstTime = true; 33 | } 34 | } 35 | 36 | public Arg64ConstantsReader(IList instrs, bool emulateConvInstrs) 37 | : base(instrs, emulateConvInstrs) { 38 | } 39 | 40 | protected override bool ProcessInstructionInt64(ref int index, Stack> stack) { 41 | if (!firstTime) 42 | return false; 43 | firstTime = false; 44 | if (instructions[index].OpCode.Code != Code.Conv_I8) 45 | return false; 46 | 47 | stack.Push(new ConstantInfo(index, arg)); 48 | index = index + 1; 49 | return true; 50 | } 51 | } 52 | } 53 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/Confuser/IVersionProvider.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | namespace de4dot.code.deobfuscators.Confuser { 21 | interface IVersionProvider { 22 | bool GetRevisionRange(out int minRev, out int maxRev); 23 | } 24 | } 25 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/ConfuserEx/NativeSwitchData.cs: -------------------------------------------------------------------------------- 1 | using de4dot.blocks; 2 | using de4dot.code.deobfuscators.ConfuserEx.x86; 3 | using dnlib.DotNet; 4 | using dnlib.DotNet.Emit; 5 | 6 | namespace de4dot.code.deobfuscators.ConfuserEx 7 | { 8 | public class NativeSwitchData : SwitchData 9 | { 10 | public NativeSwitchData(Block switchBlock) : base(switchBlock) 11 | { 12 | } 13 | 14 | public MethodDef NativeMethodDef; 15 | 16 | public override bool Initialize() 17 | { 18 | var instr = _block.Instructions; 19 | if (instr.Count <= 4) 20 | return false; 21 | 22 | if (instr[0].IsLdcI4() && instr[1].OpCode == OpCodes.Call) 23 | { 24 | IsKeyHardCoded = true; 25 | Key = instr[0].GetLdcI4Value(); 26 | } 27 | 28 | if (!IsKeyHardCoded && instr[0].OpCode != OpCodes.Call) 29 | return false; 30 | 31 | var nativeMethodDef = _block.Instructions[IsKeyHardCoded ? 1 : 0].Operand as MethodDef; 32 | 33 | if (nativeMethodDef == null || !nativeMethodDef.IsStatic || !nativeMethodDef.IsNative) 34 | return false; 35 | if (!DotNetUtils.IsMethod(nativeMethodDef, "System.Int32", "(System.Int32)")) 36 | return false; 37 | for (var i = IsKeyHardCoded ? 2 : 1; i < instr.Count - 1; i++) 38 | if (!instr[i].IsValidInstr()) 39 | return false; 40 | 41 | NativeMethodDef = nativeMethodDef; 42 | return true; 43 | } 44 | } 45 | } 46 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/ConfuserEx/NormalSwitchData.cs: -------------------------------------------------------------------------------- 1 | using de4dot.blocks; 2 | using dnlib.DotNet.Emit; 3 | 4 | namespace de4dot.code.deobfuscators.ConfuserEx 5 | { 6 | public class NormalSwitchData : SwitchData 7 | { 8 | public readonly Block Block; 9 | public NormalSwitchData(Block switchBlock) : base(switchBlock) 10 | { 11 | Block = switchBlock; 12 | } 13 | 14 | public int DivisionKey; 15 | 16 | public override bool Initialize() 17 | { 18 | var instr = _block.Instructions; 19 | if (instr.Count != 7) 20 | return false; 21 | 22 | if (!instr[0].IsLdcI4()) 23 | return false; 24 | if (instr[1].OpCode != OpCodes.Xor) 25 | return false; 26 | if (instr[2].OpCode != OpCodes.Dup) 27 | return false; 28 | if (!instr[3].IsStloc()) 29 | return false; 30 | if (!instr[4].IsLdcI4()) 31 | return false; 32 | if (instr[5].OpCode != OpCodes.Rem_Un) 33 | return false; 34 | 35 | Key = instr[0].GetLdcI4Value(); 36 | DivisionKey = instr[4].GetLdcI4Value(); 37 | return true; 38 | } 39 | } 40 | } 41 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/ConfuserEx/x86/Bea/Engine.cs: -------------------------------------------------------------------------------- 1 | using System.IO; 2 | using System.Runtime.InteropServices; 3 | 4 | namespace de4dot.Bea 5 | { 6 | public static class BeaEngine 7 | { 8 | // 'de4dot\bin\de4dot.blocks.dll' -> 'de4dot\bin\' 9 | private static string _executingPath = Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly().Location); 10 | 11 | static BeaEngine() 12 | { 13 | if (!File.Exists(Path.Combine(_executingPath, "BeaEngine.dll"))) 14 | { 15 | throw new FileNotFoundException("BeaEngine.dll missing!"); 16 | } 17 | 18 | //TODO: Better handle native DLL discovery 19 | SetDllDirectory(_executingPath); 20 | } 21 | 22 | [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)] 23 | private static extern bool SetDllDirectory(string lpPathName); 24 | 25 | [DllImport("BeaEngine.dll")] 26 | public static extern int Disasm([In, Out, MarshalAs(UnmanagedType.LPStruct)] Disasm disasm); 27 | 28 | [DllImport("BeaEngine.dll")] 29 | private static extern string BeaEngineVersion(); 30 | 31 | [DllImport("BeaEngine.dll")] 32 | private static extern string BeaEngineRevision(); 33 | 34 | public static string Version 35 | { 36 | get 37 | { 38 | return BeaEngineVersion(); 39 | } 40 | } 41 | 42 | public static string Revision 43 | { 44 | get 45 | { 46 | return BeaEngineRevision(); 47 | } 48 | } 49 | } 50 | } 51 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/ConfuserEx/x86/Instructions/X86ADD.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using de4dot.Bea; 3 | using de4dot.code.deobfuscators.ConfuserEx.x86; 4 | 5 | namespace ConfuserDeobfuscator.Engine.Routines.Ex.x86.Instructions 6 | { 7 | class X86ADD : X86Instruction 8 | { 9 | public X86ADD(Disasm rawInstruction) : base() 10 | { 11 | Operands = new IX86Operand[2]; 12 | Operands[0] = GetOperand(rawInstruction.Argument1); 13 | Operands[1] = GetOperand(rawInstruction.Argument2); 14 | } 15 | 16 | public override X86OpCode OpCode { get { return X86OpCode.ADD; } } 17 | 18 | public override void Execute(Dictionary registers, Stack localStack) 19 | { 20 | if (Operands[1] is X86ImmediateOperand) 21 | registers[((X86RegisterOperand) Operands[0]).Register.ToString()] += 22 | ((X86ImmediateOperand) Operands[1]).Immediate; 23 | else 24 | registers[((X86RegisterOperand) Operands[0]).Register.ToString()] += 25 | registers[((X86RegisterOperand) Operands[1]).Register.ToString()]; 26 | } 27 | } 28 | } 29 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/ConfuserEx/x86/Instructions/X86DIV.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using de4dot.Bea; 3 | using de4dot.code.deobfuscators.ConfuserEx.x86; 4 | 5 | namespace ConfuserDeobfuscator.Engine.Routines.Ex.x86.Instructions 6 | { 7 | class X86DIV : X86Instruction 8 | { 9 | public X86DIV(Disasm rawInstruction) : base() 10 | { 11 | Operands = new IX86Operand[2]; 12 | Operands[0] = GetOperand(rawInstruction.Argument1); 13 | Operands[1] = GetOperand(rawInstruction.Argument2); 14 | } 15 | 16 | public override X86OpCode OpCode { get { return X86OpCode.DIV; } } 17 | 18 | public override void Execute(Dictionary registers, Stack localStack) 19 | { 20 | 21 | } 22 | } 23 | } 24 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/ConfuserEx/x86/Instructions/X86IMUL.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using de4dot.Bea; 3 | using de4dot.code.deobfuscators.ConfuserEx.x86; 4 | 5 | namespace ConfuserDeobfuscator.Engine.Routines.Ex.x86.Instructions 6 | { 7 | class X86IMUL : X86Instruction 8 | { 9 | public X86IMUL(Disasm rawInstruction) : base() 10 | { 11 | Operands = new IX86Operand[3]; 12 | Operands[0] = GetOperand(rawInstruction.Argument1); 13 | Operands[1] =GetOperand( rawInstruction.Argument2); 14 | Operands[2] = GetOperand(rawInstruction.Argument3); 15 | } 16 | 17 | public override X86OpCode OpCode { get { return X86OpCode.IMUL; } } 18 | 19 | public override void Execute(Dictionary registers, Stack localStack) 20 | { 21 | var source = ((X86RegisterOperand) Operands[0]).Register.ToString(); 22 | var target1 = ((X86RegisterOperand) Operands[1]).Register.ToString(); 23 | 24 | if (Operands[2] is X86ImmediateOperand) 25 | registers[source] = registers[target1]*((X86ImmediateOperand) Operands[2]).Immediate; 26 | else 27 | registers[source] = registers[target1]*registers[((X86RegisterOperand) Operands[2]).Register.ToString()]; 28 | } 29 | } 30 | } 31 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/ConfuserEx/x86/Instructions/X86MOV.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using de4dot.Bea; 3 | using de4dot.code.deobfuscators.ConfuserEx.x86; 4 | 5 | namespace ConfuserDeobfuscator.Engine.Routines.Ex.x86.Instructions 6 | { 7 | internal class X86MOV : X86Instruction 8 | { 9 | public X86MOV(Disasm rawInstruction) : base() 10 | { 11 | Operands = new IX86Operand[2]; 12 | Operands[0] = GetOperand(rawInstruction.Argument1); 13 | Operands[1] = GetOperand(rawInstruction.Argument2); 14 | } 15 | 16 | public override X86OpCode OpCode 17 | { 18 | get { return X86OpCode.MOV; } 19 | } 20 | 21 | public override void Execute(Dictionary registers, Stack localStack) 22 | { 23 | if (Operands[1] is X86ImmediateOperand) 24 | registers[((X86RegisterOperand) Operands[0]).Register.ToString()] = 25 | (Operands[1] as X86ImmediateOperand).Immediate; 26 | else 27 | { 28 | var regOperand = (X86RegisterOperand) Operands[0]; 29 | registers[regOperand.Register.ToString()] = 30 | registers[(Operands[1] as X86RegisterOperand).Register.ToString()]; 31 | } 32 | } 33 | } 34 | } 35 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/ConfuserEx/x86/Instructions/X86NEG.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using de4dot.Bea; 3 | using de4dot.code.deobfuscators.ConfuserEx.x86; 4 | 5 | namespace ConfuserDeobfuscator.Engine.Routines.Ex.x86.Instructions 6 | { 7 | class X86NEG : X86Instruction 8 | { 9 | public X86NEG(Disasm rawInstruction) : base() 10 | { 11 | Operands = new IX86Operand[1]; 12 | Operands[0] = GetOperand(rawInstruction.Argument1); 13 | } 14 | 15 | public override X86OpCode OpCode { get { return X86OpCode.NEG; } } 16 | 17 | public override void Execute(Dictionary registers, Stack localStack) 18 | { 19 | registers[((X86RegisterOperand) Operands[0]).Register.ToString()] = 20 | -registers[((X86RegisterOperand) Operands[0]).Register.ToString()]; 21 | } 22 | } 23 | } 24 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/ConfuserEx/x86/Instructions/X86NOT.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using de4dot.Bea; 3 | using de4dot.code.deobfuscators.ConfuserEx.x86; 4 | 5 | namespace ConfuserDeobfuscator.Engine.Routines.Ex.x86.Instructions 6 | { 7 | class X86NOT : X86Instruction 8 | { 9 | public X86NOT(Disasm rawInstruction) : base() 10 | { 11 | Operands = new IX86Operand[1]; 12 | Operands[0] = GetOperand(rawInstruction.Argument1); 13 | } 14 | 15 | public override X86OpCode OpCode { get { return X86OpCode.NOT; } } 16 | 17 | public override void Execute(Dictionary registers, Stack localStack) 18 | { 19 | registers[((X86RegisterOperand)Operands[0]).Register.ToString()] = 20 | ~registers[((X86RegisterOperand) Operands[0]).Register.ToString()]; 21 | } 22 | 23 | } 24 | } 25 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/ConfuserEx/x86/Instructions/X86POP.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using de4dot.Bea; 3 | using de4dot.code.deobfuscators.ConfuserEx.x86; 4 | 5 | namespace ConfuserDeobfuscator.Engine.Routines.Ex.x86.Instructions 6 | { 7 | class X86POP : X86Instruction 8 | { 9 | public X86POP(Disasm rawInstruction) : base() 10 | { 11 | Operands = new IX86Operand[1]; 12 | Operands[0] = GetOperand(rawInstruction.Argument1); 13 | } 14 | 15 | public override X86OpCode OpCode { get { return X86OpCode.POP; } } 16 | 17 | public override void Execute(Dictionary registers, Stack localStack) 18 | { 19 | // Pretend to pop stack 20 | if (localStack.Count < 1) 21 | return; 22 | 23 | registers[((X86RegisterOperand) Operands[0]).Register.ToString()] = localStack.Pop(); 24 | } 25 | 26 | } 27 | } 28 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/ConfuserEx/x86/Instructions/X86PUSH.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using de4dot.Bea; 3 | using de4dot.code.deobfuscators.ConfuserEx.x86; 4 | 5 | namespace ConfuserDeobfuscator.Engine.Routines.Ex.x86.Instructions 6 | { 7 | class X86PUSH : X86Instruction 8 | { 9 | public X86PUSH(Disasm rawInstruction) : base() 10 | { 11 | Operands = new IX86Operand[1]; 12 | Operands[0] = GetOperand(rawInstruction.Argument1); 13 | } 14 | 15 | public override X86OpCode OpCode { get { return X86OpCode.PUSH; } } 16 | 17 | public override void Execute(Dictionary registers, Stack localStack) 18 | { 19 | // Pretend to pop stack 20 | if (localStack.Count < 1) 21 | return; 22 | 23 | registers[((X86RegisterOperand) Operands[0]).Register.ToString()] = localStack.Pop(); 24 | } 25 | 26 | } 27 | } 28 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/ConfuserEx/x86/Instructions/X86SUB.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using de4dot.Bea; 3 | using de4dot.code.deobfuscators.ConfuserEx.x86; 4 | 5 | namespace ConfuserDeobfuscator.Engine.Routines.Ex.x86.Instructions 6 | { 7 | class X86SUB : X86Instruction 8 | { 9 | public X86SUB(Disasm rawInstruction) : base() 10 | { 11 | Operands = new IX86Operand[2]; 12 | Operands[0] = GetOperand(rawInstruction.Argument1); 13 | Operands[1] = GetOperand(rawInstruction.Argument2); 14 | } 15 | 16 | public override X86OpCode OpCode { get { return X86OpCode.SUB; } } 17 | 18 | public override void Execute(Dictionary registers, Stack localStack) 19 | { 20 | if (Operands[1] is X86ImmediateOperand) 21 | registers[((X86RegisterOperand)Operands[0]).Register.ToString()] -= 22 | ((X86ImmediateOperand)Operands[1]).Immediate; 23 | else 24 | registers[((X86RegisterOperand)Operands[0]).Register.ToString()] -= 25 | registers[((X86RegisterOperand)Operands[1]).Register.ToString()]; 26 | } 27 | } 28 | } 29 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/ConfuserEx/x86/Instructions/X86XOR.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using de4dot.Bea; 3 | using de4dot.code.deobfuscators.ConfuserEx.x86; 4 | 5 | namespace ConfuserDeobfuscator.Engine.Routines.Ex.x86.Instructions 6 | { 7 | class X86XOR : X86Instruction 8 | { 9 | public X86XOR(Disasm rawInstruction) : base() 10 | { 11 | Operands = new IX86Operand[2]; 12 | Operands[0] = GetOperand(rawInstruction.Argument1); 13 | Operands[1] = GetOperand(rawInstruction.Argument2); 14 | } 15 | 16 | public override X86OpCode OpCode { get { return X86OpCode.XOR; } } 17 | 18 | public override void Execute(Dictionary registers, Stack localStack) 19 | { 20 | if (Operands[1] is X86ImmediateOperand) 21 | registers[((X86RegisterOperand)Operands[0]).Register.ToString()] ^= 22 | ((X86ImmediateOperand)Operands[1]).Immediate; 23 | else 24 | registers[((X86RegisterOperand)Operands[0]).Register.ToString()] ^= 25 | registers[((X86RegisterOperand)Operands[1]).Register.ToString()]; 26 | } 27 | } 28 | } 29 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/ConfuserEx/x86/UnmanagedBuff.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.InteropServices; 3 | 4 | namespace de4dot.code.deobfuscators.ConfuserEx.x86 5 | { 6 | public class UnmanagedBuffer 7 | { 8 | public readonly IntPtr Ptr; 9 | public readonly int Length; 10 | 11 | public UnmanagedBuffer(byte[] data) 12 | { 13 | Ptr = Marshal.AllocHGlobal(data.Length); 14 | Marshal.Copy(data, 0, Ptr, data.Length); 15 | Length = data.Length; 16 | } 17 | } 18 | } 19 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/ConfuserEx/x86/X86Instruction.cs: -------------------------------------------------------------------------------- 1 | using System.Collections.Generic; 2 | using System.Globalization; 3 | using de4dot.Bea; 4 | 5 | namespace de4dot.code.deobfuscators.ConfuserEx.x86 6 | { 7 | public enum X86OpCode 8 | { 9 | MOV, 10 | ADD, 11 | SUB, 12 | IMUL, 13 | DIV, 14 | NEG, 15 | NOT, 16 | XOR, 17 | POP, 18 | PUSH 19 | } 20 | 21 | public enum X86Register 22 | { 23 | EAX = 537001985, 24 | ECX = 537001986, 25 | EDX = 537001988, 26 | EBX = 537001992, 27 | ESP = 537001989, 28 | EBP = 537001990, 29 | ESI = 537002048, 30 | EDI = 537002112 31 | } 32 | 33 | public interface IX86Operand 34 | { 35 | } 36 | 37 | public class X86RegisterOperand : IX86Operand 38 | { 39 | public X86Register Register { get; set; } 40 | 41 | public X86RegisterOperand(X86Register reg) 42 | { 43 | Register = reg; 44 | } 45 | } 46 | 47 | public class X86ImmediateOperand : IX86Operand 48 | { 49 | public int Immediate { get; set; } 50 | 51 | public X86ImmediateOperand(int imm) 52 | { 53 | Immediate = imm; 54 | } 55 | } 56 | 57 | public abstract class X86Instruction 58 | { 59 | public abstract X86OpCode OpCode { get; } 60 | public IX86Operand[] Operands { get; set; } 61 | public abstract void Execute(Dictionary registers, Stack localStack); 62 | 63 | public static IX86Operand GetOperand(ArgumentType argument) 64 | { 65 | if (argument.ArgType == -2013265920) 66 | return 67 | new X86ImmediateOperand(int.Parse(argument.ArgMnemonic.TrimEnd('h'), 68 | NumberStyles.HexNumber)); 69 | return new X86RegisterOperand((X86Register)argument.ArgType); 70 | } 71 | } 72 | } 73 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/CryptoObfuscator/CoMethodCallInliner.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using dnlib.DotNet; 21 | using de4dot.blocks.cflow; 22 | 23 | namespace de4dot.code.deobfuscators.CryptoObfuscator { 24 | class CoMethodCallInliner : MethodCallInliner { 25 | readonly InlinedMethodTypes inlinedMethodTypes; 26 | 27 | public CoMethodCallInliner(InlinedMethodTypes inlinedMethodTypes) 28 | : base(false) { 29 | this.inlinedMethodTypes = inlinedMethodTypes; 30 | } 31 | 32 | protected override bool CanInline(MethodDef method) { 33 | if (method == null) 34 | return false; 35 | 36 | if (method.Attributes != (MethodAttributes.Assembly | MethodAttributes.Static | MethodAttributes.HideBySig)) 37 | return false; 38 | if (method.HasGenericParameters) 39 | return false; 40 | if (!InlinedMethodTypes.IsValidMethodType(method.DeclaringType)) 41 | return false; 42 | 43 | return true; 44 | } 45 | 46 | protected override void OnInlinedMethod(MethodDef methodToInline, bool inlinedMethod) { 47 | if (inlinedMethod) 48 | inlinedMethodTypes.Add(methodToInline.DeclaringType); 49 | else 50 | inlinedMethodTypes.DontRemoveType(methodToInline.DeclaringType); 51 | } 52 | } 53 | } 54 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/DeepSea/DsConstantsReader.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Collections.Generic; 21 | using dnlib.DotNet.Emit; 22 | using de4dot.blocks; 23 | 24 | namespace de4dot.code.deobfuscators.DeepSea { 25 | class DsConstantsReader : ConstantsReader { 26 | public DsConstantsReader(List instrs) 27 | : base(instrs) { 28 | } 29 | 30 | protected override bool GetLocalConstantInt32(Instruction instr, out int value) { 31 | value = 0; 32 | return true; 33 | } 34 | 35 | protected override bool GetArgConstantInt32(Instruction instr, out int value) { 36 | value = 0; 37 | return true; 38 | } 39 | } 40 | } 41 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/DeepSea/DsInlinedMethodsFinder.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Collections.Generic; 21 | using dnlib.DotNet; 22 | 23 | namespace de4dot.code.deobfuscators.DeepSea { 24 | static class DsInlinedMethodsFinder { 25 | public static List Find(ModuleDefMD module, IEnumerable notInlinedMethods) { 26 | var notInlinedMethodsDict = new Dictionary(); 27 | foreach (var method in notInlinedMethods) 28 | notInlinedMethodsDict[method] = true; 29 | 30 | var inlinedMethods = new List(); 31 | 32 | foreach (var type in module.GetTypes()) { 33 | foreach (var method in type.Methods) { 34 | if (!notInlinedMethodsDict.ContainsKey(method) && DsMethodCallInliner.CanInline(method)) 35 | inlinedMethods.Add(method); 36 | } 37 | } 38 | 39 | return inlinedMethods; 40 | } 41 | } 42 | } 43 | -------------------------------------------------------------------------------- /de4dot.code/deobfuscators/DeobfuscatorInfoBase.cs: -------------------------------------------------------------------------------- 1 | /* 2 | Copyright (C) 2011-2015 de4dot@gmail.com 3 | 4 | This file is part of de4dot. 5 | 6 | de4dot is free software: you can redistribute it and/or modify 7 | it under the terms of the GNU General Public License as published by 8 | the Free Software Foundation, either version 3 of the License, or 9 | (at your option) any later version. 10 | 11 | de4dot is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | GNU General Public License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with de4dot. If not, see . 18 | */ 19 | 20 | using System.Collections.Generic; 21 | 22 | namespace de4dot.code.deobfuscators { 23 | public abstract class DeobfuscatorInfoBase : IDeobfuscatorInfo { 24 | protected NameRegexOption validNameRegex; 25 | 26 | public DeobfuscatorInfoBase(string nameRegex) { 27 | validNameRegex = new NameRegexOption(null, MakeArgName("name"), "Valid name regex pattern", nameRegex ?? DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX); 28 | } 29 | 30 | protected string MakeArgName(string name) { 31 | return string.Format("{0}-{1}", Type, name); 32 | } 33 | 34 | public abstract string Type { get; } 35 | public abstract string Name { get; } 36 | public abstract IDeobfuscator CreateDeobfuscator(); 37 | 38 | protected virtual IEnumerable