Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Can't restore ldtoken instructions for obfuscated codes #3

Closed
Rextor opened this issue Nov 21, 2021 · 1 comment
Closed

Can't restore ldtoken instructions for obfuscated codes #3

Rextor opened this issue Nov 21, 2021 · 1 comment
Labels
enhancement New feature or request

Comments

@Rextor
Copy link

Rextor commented Nov 21, 2021

i think there are nothing about restoring encrypted tokens for ldtoken opcode
they are something like :

Type.GetTypeFromHandle(\u0086\u0086\u0086\u000D\u000A\u0086\u0086\u0086\u0086\u0099\u0091.\u0086\u0086\u0086\u000D\u000A\u0086\u0086\u0086\u0087\u0089\u0089(33554439))

file: https://ufile.io/7m5ho9q2
ss:
image

@SychicBoy SychicBoy added the enhancement New feature or request label Nov 21, 2021
@Rextor
Copy link
Author

Rextor commented Nov 21, 2021

Here is my old codes for this protection

`static class LdTokenFixer {
public static void CleanMethods() {
foreach (var item in NETReactorSlayer.Core.Utils.Context.Module.GetTypes()) {
foreach (var item1 in item.Methods) {
if (item1.HasBody) {
CleanMethod(item1);
}
}
}
}
public static void CleanMethod(MethodDef methodDef) {
for (int i = 0; i < methodDef.Body.Instructions.Count; i++) {
try {
if (!methodDef.Body.Instructions[i].IsLdcI4()) continue;
if (methodDef.Body.Instructions[i + 1].OpCode != OpCodes.Call) continue;
if (methodDef.Body.Instructions[i + 2].OpCode != OpCodes.Call) continue;
if (!methodDef.Body.Instructions[i + 2].Operand.ToString().Contains("GetTypeFromHandle")) continue;

				var a = methodDef.Module.ResolveToken(methodDef.Body.Instructions[i].GetLdcI4Value())  as ITypeDefOrRef;
				methodDef.Body.Instructions[i].OpCode = OpCodes.Nop;
				methodDef.Body.Instructions[i + 1].OpCode = OpCodes.Ldtoken;
				methodDef.Body.Instructions[i + 1].Operand = a;
			}
			catch {

			}
		}
	}
}`

SychicBoy added a commit that referenced this issue Nov 22, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants