forked from sn-0w/UD-Pro-Cfex-Unpacker
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathInvoke_Remover.cs
43 lines (42 loc) · 1.15 KB
/
Invoke_Remover.cs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
using System;
using System.Reflection;
using dnlib.DotNet;
using dnlib.DotNet.Emit;
namespace Krawk_Unpacker.Protections
{
// Token: 0x0200000F RID: 15
internal class Invoke_Remover
{
// Token: 0x06000045 RID: 69 RVA: 0x00004E94 File Offset: 0x00003094
public static void run(ModuleDefMD module)
{
int num = 0;
foreach (TypeDef typeDef in module.GetTypes())
{
bool flag = !typeDef.IsGlobalModuleType;
bool flag4 = !flag;
if (flag4)
{
foreach (MethodDef methodDef in typeDef.Methods)
{
bool flag2 = !methodDef.HasBody && !methodDef.Body.HasInstructions;
bool flag5 = !flag2;
if (flag5)
{
for (int i = 0; i < methodDef.Body.Instructions.Count; i++)
{
bool flag3 = methodDef.Body.Instructions[i].OpCode == OpCodes.Call && methodDef.Body.Instructions[i].Operand.ToString().Contains("CallingAssembly");
bool flag6 = flag3;
if (flag6)
{
methodDef.Body.Instructions[i].Operand = (methodDef.Body.Instructions[i].Operand = module.Import(typeof(Assembly).GetMethod("GetExecutingAssembly")));
num++;
}
}
}
}
}
}
}
}
}