Skip to content

Commit cfc3494

Browse files
committed
Some minor changes.
1 parent e88d785 commit cfc3494

7 files changed

Lines changed: 76 additions & 42 deletions

File tree

NETReactorSlayer.Core/Deobfuscators/BooleanDecrypter.cs

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,14 @@ internal class BooleanDecrypter : IStage
2626
{
2727
public void Execute()
2828
{
29-
if (!Find())
30-
{
31-
Logger.Warn("Couldn't find any encrypted boolean.");
32-
return;
33-
}
34-
3529
try
3630
{
31+
if (!Find())
32+
{
33+
Logger.Warn("Couldn't find any encrypted boolean.");
34+
return;
35+
}
36+
3737
var bytes = _encryptedResource.Decrypt();
3838

3939
var count = InlineAllBooleans(bytes);
@@ -71,6 +71,11 @@ private bool Find()
7171
EncryptedResource.IsKnownDecrypter(methodDef, Array.Empty<string>(), true))
7272
{
7373
_encryptedResource = new EncryptedResource(methodDef);
74+
if (_encryptedResource.EmbeddedResource == null)
75+
{
76+
_encryptedResource.Dispose();
77+
continue;
78+
}
7479
return true;
7580
}
7681

NETReactorSlayer.Core/Deobfuscators/ControlFlowDeobfuscator.cs

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,12 @@ private void FindFieldsDynamically()
145145
break;
146146
}
147147

148+
if(_fields.All(x=> x.Value == 0))
149+
{
150+
_fields.Clear();
151+
return;
152+
}
153+
148154
if (typeDef != null)
149155
Cleaner.AddTypeToBeRemoved(typeDef);
150156
}

NETReactorSlayer.Core/Deobfuscators/MethodDecrypter.cs

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -29,16 +29,16 @@ internal class MethodDecrypter : IStage
2929
{
3030
public void Execute()
3131
{
32-
if (!Find())
32+
try
3333
{
34-
Logger.Warn("Couldn't find any encrypted method.");
35-
return;
36-
}
34+
if (!Find())
35+
{
36+
Logger.Warn("Couldn't find any encrypted method.");
37+
return;
38+
}
3739

38-
Context.ObfuscatorInfo.NecroBit = true;
40+
Context.ObfuscatorInfo.NecroBit = true;
3941

40-
try
41-
{
4242
var bytes = _encryptedResource.Decrypt();
4343

4444
if (!RestoreMethodsBody(bytes))
@@ -73,12 +73,17 @@ from call in DotNetUtils.GetMethodCalls(methodDef)
7373
where call.MDToken.ToInt32() == method.MDToken.ToInt32()
7474
select methodDef)
7575
{
76-
if (!EncryptedResource.IsKnownDecrypter(methodDef, Array.Empty<string>(), true))
77-
continue;
76+
if (!EncryptedResource.IsKnownDecrypter(methodDef, Array.Empty<string>(), true))
77+
continue;
7878

79-
_encryptedResource = new EncryptedResource(methodDef);
79+
_encryptedResource = new EncryptedResource(methodDef);
80+
if (_encryptedResource.EmbeddedResource == null)
81+
{
82+
_encryptedResource.Dispose();
83+
continue;
84+
}
8085

81-
return true;
86+
return true;
8287
}
8388

8489
return false;

NETReactorSlayer.Core/Deobfuscators/ProxyCallFixer.cs

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -28,14 +28,14 @@ internal class ProxyCallFixer : IStage
2828
{
2929
public void Execute()
3030
{
31-
if (!Find())
32-
{
33-
Logger.Warn("Couldn't find any hidden call.");
34-
return;
35-
}
36-
3731
try
3832
{
33+
if (!Find())
34+
{
35+
Logger.Warn("Couldn't find any hidden call.");
36+
return;
37+
}
38+
3939
var bytes = _encryptedResource.Decrypt();
4040

4141
if (!GetDictionary(bytes))
@@ -81,6 +81,11 @@ where x.Namespace.Equals("") && DotNetUtils.DerivesFromDelegate(x)
8181
return false;
8282

8383
_encryptedResource = new EncryptedResource(methodDef);
84+
if (_encryptedResource.EmbeddedResource == null)
85+
{
86+
_encryptedResource.Dispose();
87+
return false;
88+
}
8489

8590
return true;
8691
}

NETReactorSlayer.Core/Deobfuscators/ResourceResolver.cs

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,14 @@ internal class ResourceResolver : IStage
2626
{
2727
public void Execute()
2828
{
29-
if (!Find())
30-
{
31-
Logger.Warn("Couldn't find any encrypted resource.");
32-
return;
33-
}
34-
3529
try
3630
{
31+
if (!Find())
32+
{
33+
Logger.Warn("Couldn't find any encrypted resource.");
34+
return;
35+
}
36+
3737
DeobUtils.DecryptAndAddResources(Context.Module,
3838
() => Decompress(_encryptedResource.Decrypt()));
3939

@@ -78,6 +78,12 @@ private bool Find()
7878
continue;
7979

8080
_encryptedResource = new EncryptedResource(decrypterMethod);
81+
if (_encryptedResource.EmbeddedResource == null)
82+
{
83+
_encryptedResource.Dispose();
84+
continue;
85+
}
86+
8187
_methodToRemove.AddRange(type.Methods);
8288
return true;
8389
}

NETReactorSlayer.Core/Deobfuscators/StringDecrypter.cs

Lines changed: 18 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -31,21 +31,23 @@ internal class StringDecrypter : IStage
3131
{
3232
public void Execute()
3333
{
34-
if (!Find())
35-
{
36-
var count = InlineStringsDynamically();
37-
if(count > 0)
38-
Logger.Done(count + " Strings decrypted.");
39-
else
40-
Logger.Warn("Couldn't find any encrypted string.");
41-
return;
42-
}
43-
4434
try
4535
{
36+
long count = 0;
37+
38+
if (!Find())
39+
{
40+
count = InlineStringsDynamically();
41+
if(count > 0)
42+
Logger.Done(count + " Strings decrypted.");
43+
else
44+
Logger.Warn("Couldn't find any encrypted string.");
45+
return;
46+
}
47+
4648
_decryptedResource = _encryptedResource.Decrypt();
4749

48-
var count = InlineStringsStatically();
50+
count = InlineStringsStatically();
4951

5052
if (count > 0)
5153
{
@@ -86,6 +88,11 @@ private bool Find()
8688
FindKeyIv(method);
8789

8890
_encryptedResource = new EncryptedResource(method, new[] { "System.String" });
91+
if (_encryptedResource.EmbeddedResource == null)
92+
{
93+
_encryptedResource.Dispose();
94+
continue;
95+
}
8996

9097
return true;
9198
}

NETReactorSlayer.Core/Helper/EncryptedResource.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -85,13 +85,13 @@ public static bool IsKnownDecrypter(MethodDef method, IList<string> additionalTy
8585
private EmbeddedResource GetEncryptedResource()
8686
{
8787
if (DecrypterMethod is not { HasBody: true, Body.HasInstructions: true })
88-
throw new NullReferenceException();
88+
return null;
8989

9090
foreach (var s in DotNetUtils.GetCodeStrings(DecrypterMethod))
9191
if (DotNetUtils.GetResource(Context.Module, s) is EmbeddedResource resource)
9292
return resource;
9393

94-
throw new NullReferenceException();
94+
return null;
9595
}
9696

9797
private IDecrypter GetDecrypter()

0 commit comments

Comments
 (0)