From 8f2f2f46ce206d7dacafa2e48c4df20bbc0f5dda Mon Sep 17 00:00:00 2001 From: de4dot Date: Wed, 11 Jul 2012 02:15:33 +0200 Subject: [PATCH] Support latest CO build --- de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs | 3 ++- .../deobfuscators/CryptoObfuscator/ProxyDelegateFinder.cs | 2 +- .../deobfuscators/CryptoObfuscator/ResourceDecrypter.cs | 2 ++ de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs | 2 +- 4 files changed, 6 insertions(+), 3 deletions(-) diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs b/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs index dd4b3c07..736792a8 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs @@ -63,7 +63,8 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { continue; deobfuscate(method); if (!containsString(method, "debugger is activ") && - !containsString(method, "debugger is running")) + !containsString(method, "debugger is running") && + !containsString(method, "run under a debugger")) continue; antiDebuggerType = type; diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/ProxyDelegateFinder.cs b/de4dot.code/deobfuscators/CryptoObfuscator/ProxyDelegateFinder.cs index 996ad062..18cc116f 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/ProxyDelegateFinder.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/ProxyDelegateFinder.cs @@ -127,7 +127,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { MethodDefinition getProxyCreateMethod(TypeDefinition type) { if (DotNetUtils.findFieldType(type, "System.ModuleHandle", true) == null) return null; - if (type.Fields.Count < 1 || type.Fields.Count > 6) + if (type.Fields.Count < 1 || type.Fields.Count > 7) return null; MethodDefinition createMethod = null; diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs b/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs index e0a50b89..aa2afa09 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs @@ -302,6 +302,8 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { return method; if (DotNetUtils.isMethod(method, "System.Byte[]", "(System.Int16,System.IO.Stream)")) return method; + if (DotNetUtils.isMethod(method, "System.Byte[]", "(System.Byte,System.IO.Stream)")) + return method; } return null; } diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs b/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs index 4a979b81..d0ee4ee0 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs @@ -84,7 +84,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()")) return false; - if (type.Methods.Count < 3 || type.Methods.Count > 8) + if (type.Methods.Count < 3 || type.Methods.Count > 9) return false; if (DotNetUtils.getPInvokeMethod(type, "mscoree", "StrongNameSignatureVerificationEx") != null) { }