Skip to content
This repository was archived by the owner on Mar 20, 2023. It is now read-only.

Commit 80632e5

Browse files
void-stackvoid-stack
committed
Upload
1 parent ceff9b6 commit 80632e5

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

49 files changed

+3244
-0
lines changed

‎.idea/.idea.DNR 6.7 Cflow/.idea/.gitignore‎

Lines changed: 13 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎.idea/.idea.DNR 6.7 Cflow/.idea/.name‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎.idea/.idea.DNR 6.7 Cflow/.idea/encodings.xml‎

Lines changed: 4 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎.idea/.idea.DNR 6.7 Cflow/.idea/indexLayout.xml‎

Lines changed: 8 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎.idea/.idea.DNR 6.7 Cflow/.idea/vcs.xml‎

Lines changed: 6 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎DNR 6.7 Cflow.sln‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DNR 6.7 Cflow", "DNR 6.7 Cflow\DNR 6.7 Cflow.csproj", "{F606B3A7-E390-442C-9BF4-8882C6AD4B19}"
4+
EndProject
5+
Global
6+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
7+
Debug|Any CPU = Debug|Any CPU
8+
Release|Any CPU = Release|Any CPU
9+
EndGlobalSection
10+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
11+
{F606B3A7-E390-442C-9BF4-8882C6AD4B19}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
12+
{F606B3A7-E390-442C-9BF4-8882C6AD4B19}.Debug|Any CPU.Build.0 = Debug|Any CPU
13+
{F606B3A7-E390-442C-9BF4-8882C6AD4B19}.Release|Any CPU.ActiveCfg = Release|Any CPU
14+
{F606B3A7-E390-442C-9BF4-8882C6AD4B19}.Release|Any CPU.Build.0 = Release|Any CPU
15+
EndGlobalSection
16+
EndGlobal

‎DNR 6.7 Cflow.sln.DotSettings.user‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<wpf:ResourceDictionary xml:space="preserve" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" xmlns:s="clr-namespace:System;assembly=mscorlib" xmlns:ss="urn:shemas-jetbrains-com:settings-storage-xaml" xmlns:wpf="http://schemas.microsoft.com/winfx/2006/xaml/presentation">
2+
<s:Boolean x:Key="/Default/UserDictionary/Words/=Brfalse/@EntryIndexedValue">True</s:Boolean>
3+
<s:Boolean x:Key="/Default/UserDictionary/Words/=Brtrue/@EntryIndexedValue">True</s:Boolean>
4+
<s:Boolean x:Key="/Default/UserDictionary/Words/=Cflow/@EntryIndexedValue">True</s:Boolean>
5+
<s:Boolean x:Key="/Default/UserDictionary/Words/=Deob/@EntryIndexedValue">True</s:Boolean>
6+
<s:Boolean x:Key="/Default/UserDictionary/Words/=nocflow/@EntryIndexedValue">True</s:Boolean></wpf:ResourceDictionary>

‎DNR 6.7 Cflow/Core/CflowRemover.cs‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
using System.Linq;
2+
using de4dot.blocks;
3+
using de4dot.blocks.cflow;
4+
using dnlib.DotNet;
5+
using dnlib.DotNet.Emit;
6+
7+
namespace DNR.Core
8+
{
9+
// Credits: https://github.com/SychicBoy/.NetReactorCfCleaner This is just my recoded updated version
10+
internal static class CflowRemover
11+
{
12+
public static uint FixedMethods { get; private set; }
13+
14+
public static void Execute(Context ctx)
15+
{
16+
SimplifyArithmetic(ctx);
17+
18+
var CfDeob = new BlocksCflowDeobfuscator();
19+
20+
foreach (var TypeDef in ctx.Module.Types.ToArray())
21+
foreach (var MethodDef in TypeDef.Methods.Where(x => x.HasBody && ContainsSwitch(x)).ToArray())
22+
try {
23+
var blocks = new Blocks(MethodDef);
24+
blocks.MethodBlocks.GetAllBlocks();
25+
blocks.RemoveDeadBlocks();
26+
blocks.RepartitionBlocks();
27+
blocks.UpdateBlocks();
28+
blocks.Method.Body.SimplifyBranches();
29+
blocks.Method.Body.OptimizeBranches();
30+
CfDeob.Initialize(blocks);
31+
CfDeob.Deobfuscate();
32+
blocks.RepartitionBlocks();
33+
blocks.GetCode(out var instructions, out var exceptionHandlers);
34+
DotNetUtils.RestoreBody(MethodDef, instructions, exceptionHandlers);
35+
}
36+
catch {
37+
// ignored
38+
}
39+
}
40+
41+
private static void SimplifyArithmetic(Context ctx)
42+
{
43+
var logger = ctx.Options.Logger;
44+
45+
foreach (var type in ctx.Module.Types)
46+
foreach (var method in type.Methods.Where(x =>
47+
x.HasBody && x.Body.HasInstructions && x.Body.Instructions.Count >= 3)) {
48+
var Instructions = method.Body.Instructions;
49+
50+
for (var i = 1; i < Instructions.Count; i++) {
51+
if (i + 1 >= Instructions.Count) continue;
52+
53+
var prevInstr = Instructions[i - 1];
54+
var curInstr = Instructions[i];
55+
var nextInstr = Instructions[i + 1];
56+
57+
// Too lazy to strip these two into one function
58+
#region Ldsfld
59+
if (curInstr.OpCode == OpCodes.Brtrue &&
60+
nextInstr.OpCode == OpCodes.Pop &&
61+
prevInstr.OpCode == OpCodes.Ldsfld) {
62+
/*if (prevInstr.Operand.ToString().Contains("System.Boolean")) {
63+
logger.Info($"Brtrue with Boolean: {method.FullName}");
64+
prevInstr.OpCode = OpCodes.Nop;
65+
curInstr.OpCode = OpCodes.Br_S;
66+
FixedMethods++;
67+
}
68+
else*/ {
69+
logger.Info($"Brtrue: {method.FullName}");
70+
prevInstr.OpCode = OpCodes.Nop;
71+
curInstr.OpCode = OpCodes.Br_S;
72+
FixedMethods++;
73+
}
74+
}
75+
76+
else if (curInstr.OpCode == OpCodes.Brfalse &&
77+
nextInstr.OpCode == OpCodes.Pop &&
78+
prevInstr.OpCode == OpCodes.Ldsfld) {
79+
/*if (prevInstr.Operand.ToString().Contains("System.Boolean")) {
80+
logger.Info($"Brfalse with Boolean: {method.FullName}");
81+
prevInstr.OpCode = OpCodes.Nop;
82+
curInstr.OpCode = OpCodes.Br_S;
83+
FixedMethods++;
84+
}
85+
else*/ {
86+
logger.Info($"Brfalse: {method.FullName}");
87+
prevInstr.OpCode = OpCodes.Nop;
88+
curInstr.OpCode = OpCodes.Br_S;
89+
FixedMethods++;
90+
}
91+
}
92+
#endregion
93+
#region Call
94+
if (curInstr.OpCode == OpCodes.Brtrue &&
95+
nextInstr.OpCode == OpCodes.Pop &&
96+
prevInstr.OpCode == OpCodes.Call) {
97+
if (prevInstr.Operand.ToString().Contains("System.Boolean")) {
98+
logger.Info($"Call with Boolean: {method.FullName}");
99+
prevInstr.OpCode = OpCodes.Nop;
100+
curInstr.OpCode = OpCodes.Br_S;
101+
}
102+
else {
103+
logger.Info($"Call: {method.FullName}");
104+
prevInstr.OpCode = OpCodes.Nop;
105+
curInstr.OpCode = OpCodes.Nop;
106+
}
107+
}
108+
109+
else if (curInstr.OpCode == OpCodes.Brfalse &&
110+
nextInstr.OpCode == OpCodes.Pop &&
111+
prevInstr.OpCode == OpCodes.Call) {
112+
if (prevInstr.Operand.ToString().Contains("System.Boolean")) {
113+
logger.Info($"Call with Boolean: {method.FullName}");
114+
prevInstr.OpCode = OpCodes.Nop;
115+
curInstr.OpCode = OpCodes.Nop;
116+
}
117+
else {
118+
logger.Info($"Call: {method.FullName}");
119+
prevInstr.OpCode = OpCodes.Nop;
120+
curInstr.OpCode = OpCodes.Br_S;
121+
}
122+
}
123+
#endregion
124+
}
125+
}
126+
}
127+
128+
private static bool ContainsSwitch(MethodDef method) => method.Body.Instructions.Any(t => t.OpCode == OpCodes.Switch);
129+
}
130+
}

‎DNR 6.7 Cflow/Core/Context.cs‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
using dnlib.DotNet;
2+
using dnlib.DotNet.Writer;
3+
4+
namespace DNR.Core
5+
{
6+
public class Context
7+
{
8+
public CtxOptions Options { get; }
9+
public ModuleDefMD Module { get; }
10+
11+
public Context(CtxOptions ctxOptions)
12+
{
13+
Options = ctxOptions;
14+
Module = ModuleDefMD.Load(Options.FilePath);
15+
}
16+
17+
public void Save()
18+
{
19+
var writerOptions = new ModuleWriterOptions(Module) {
20+
Logger = DummyLogger.NoThrowInstance,
21+
MetadataOptions = {
22+
Flags = MetadataFlags.PreserveAll & MetadataFlags.KeepOldMaxStack
23+
}
24+
};
25+
26+
Module.Write(Options.OutputPath, writerOptions);
27+
}
28+
}
29+
}

‎DNR 6.7 Cflow/Core/CtxOptions.cs‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
using System.IO;
2+
using DNR.Utils;
3+
4+
namespace DNR.Core
5+
{
6+
public class CtxOptions
7+
{
8+
public CtxOptions(string filePath, ILogger logger)
9+
{
10+
Logger = logger;
11+
FilePath = filePath;
12+
OutputPath = Path.Combine(Path.GetDirectoryName(filePath)!,
13+
$"{Path.GetFileNameWithoutExtension(filePath)}-nocflow{Path.GetExtension(filePath)}");
14+
}
15+
16+
public ILogger Logger { get; }
17+
public string FilePath { get; }
18+
public string OutputPath { get; }
19+
}
20+
}

0 commit comments

Comments
 (0)