From e87f40930d9fb63ee84b4bc06fca6d7ce907fff6 Mon Sep 17 00:00:00 2001
From: Harry Stoltz <hbstoltz7@gmail.com>
Date: Mon, 30 Dec 2024 14:37:40 +0000
Subject: [PATCH] Fix block signature in switch deobfuscator

---
 UnConfuserEx/Protections/AntiDebug/AntiDebugRemover.cs     | 2 +-
 UnConfuserEx/Protections/AntiDump/AntiDumpRemover.cs       | 2 +-
 UnConfuserEx/Protections/AntiTamper/AntiTamperRemover.cs   | 2 +-
 UnConfuserEx/Protections/Constants/ConstantsRemover.cs     | 2 +-
 UnConfuserEx/Protections/ControlFlow/SwitchDeobfuscator.cs | 1 +
 UnConfuserEx/Protections/Resources/ResourcesRemover.cs     | 2 +-
 UnConfuserEx/UnConfuserEx.cs                               | 1 -
 UnConfuserEx/UnConfuserEx.csproj                           | 2 +-
 8 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/UnConfuserEx/Protections/AntiDebug/AntiDebugRemover.cs b/UnConfuserEx/Protections/AntiDebug/AntiDebugRemover.cs
index 4f46ad9..87e636e 100644
--- a/UnConfuserEx/Protections/AntiDebug/AntiDebugRemover.cs
+++ b/UnConfuserEx/Protections/AntiDebug/AntiDebugRemover.cs
@@ -26,7 +26,7 @@ namespace UnConfuserEx.Protections.AntiDebug
         {
             var cctor = module.GlobalType.FindStaticConstructor();
 
-            if (cctor == null || !(cctor.HasBody))
+            if (cctor == null || !(cctor.HasBody) || cctor.Body.Instructions.Count == 0)
                 return false;
 
             IList<Instruction> instrs;
diff --git a/UnConfuserEx/Protections/AntiDump/AntiDumpRemover.cs b/UnConfuserEx/Protections/AntiDump/AntiDumpRemover.cs
index 058d61d..eda22e0 100644
--- a/UnConfuserEx/Protections/AntiDump/AntiDumpRemover.cs
+++ b/UnConfuserEx/Protections/AntiDump/AntiDumpRemover.cs
@@ -19,7 +19,7 @@ namespace UnConfuserEx.Protections.AntiDump
         {
             var cctor = module.GlobalType.FindStaticConstructor();
 
-            if (cctor == null || !(cctor.HasBody))
+            if (cctor == null || !(cctor.HasBody) || cctor.Body.Instructions.Count == 0)
                 return false;
 
             IList<Instruction> instrs;
diff --git a/UnConfuserEx/Protections/AntiTamper/AntiTamperRemover.cs b/UnConfuserEx/Protections/AntiTamper/AntiTamperRemover.cs
index b9ed3e3..50be713 100644
--- a/UnConfuserEx/Protections/AntiTamper/AntiTamperRemover.cs
+++ b/UnConfuserEx/Protections/AntiTamper/AntiTamperRemover.cs
@@ -215,7 +215,7 @@ namespace UnConfuserEx.Protections
         {
             var cctor = module.GlobalType.FindStaticConstructor();
 
-            if (cctor == null || !(cctor.HasBody))
+            if (cctor == null || !(cctor.HasBody) || cctor.Body.Instructions.Count == 0)
                 return null;
 
             IList<Instruction> instrs;
diff --git a/UnConfuserEx/Protections/Constants/ConstantsRemover.cs b/UnConfuserEx/Protections/Constants/ConstantsRemover.cs
index 2ac09e0..e4b3ae6 100644
--- a/UnConfuserEx/Protections/Constants/ConstantsRemover.cs
+++ b/UnConfuserEx/Protections/Constants/ConstantsRemover.cs
@@ -35,7 +35,7 @@ namespace UnConfuserEx.Protections
         {
             var cctor = module.GlobalType.FindStaticConstructor();
 
-            if (cctor == null || !(cctor.HasBody))
+            if (cctor == null || !(cctor.HasBody) || cctor.Body.Instructions.Count == 0)
                 return false;
 
             IList<Instruction> instrs;
diff --git a/UnConfuserEx/Protections/ControlFlow/SwitchDeobfuscator.cs b/UnConfuserEx/Protections/ControlFlow/SwitchDeobfuscator.cs
index d272951..0e381f0 100644
--- a/UnConfuserEx/Protections/ControlFlow/SwitchDeobfuscator.cs
+++ b/UnConfuserEx/Protections/ControlFlow/SwitchDeobfuscator.cs
@@ -145,6 +145,7 @@ namespace UnConfuserEx.Protections.ControlFlow
                         processedCount++;
                     }
                     else if (block.Instructions.Count >= 5 &&
+                             block.Instructions[^1].OpCode == OpCodes.Xor &&
                              block.Instructions[^2].IsLdcI4() &&
                              block.Instructions[^4].IsLdcI4())
                     {
diff --git a/UnConfuserEx/Protections/Resources/ResourcesRemover.cs b/UnConfuserEx/Protections/Resources/ResourcesRemover.cs
index 6eb43d0..01a7efb 100644
--- a/UnConfuserEx/Protections/Resources/ResourcesRemover.cs
+++ b/UnConfuserEx/Protections/Resources/ResourcesRemover.cs
@@ -35,7 +35,7 @@ namespace UnConfuserEx.Protections
         {
             var cctor = module.GlobalType.FindStaticConstructor();
 
-            if (cctor == null || !(cctor.HasBody))
+            if (cctor == null || !(cctor.HasBody) || cctor.Body.Instructions.Count == 0)
                 return false;
 
             IList<Instruction> instrs;
diff --git a/UnConfuserEx/UnConfuserEx.cs b/UnConfuserEx/UnConfuserEx.cs
index ce99248..c029bad 100644
--- a/UnConfuserEx/UnConfuserEx.cs
+++ b/UnConfuserEx/UnConfuserEx.cs
@@ -100,7 +100,6 @@ namespace UnConfuserEx
                 else
                 {
                     NativeModuleWriterOptions writerOptions = new NativeModuleWriterOptions(module, true);
-                    //writerOptions.MetadataOptions.Flags = MetadataFlags.PreserveAll;
                     module.NativeWrite(newPath, writerOptions);
                 }
             }
diff --git a/UnConfuserEx/UnConfuserEx.csproj b/UnConfuserEx/UnConfuserEx.csproj
index 4c7b446..ba6b84c 100644
--- a/UnConfuserEx/UnConfuserEx.csproj
+++ b/UnConfuserEx/UnConfuserEx.csproj
@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>net7.0-windows</TargetFramework>
+    <TargetFramework>net9.0-windows7.0</TargetFramework>
     <Nullable>enable</Nullable>
     <UseWindowsForms>True</UseWindowsForms>
     <AllowUnsafeBlocks>True</AllowUnsafeBlocks>