Support AN 6.0.0.5 (new build, same version)

CPU4004 · May 19, 2012 · c48b2d9 · c48b2d9
1 parent f6c5ed1
commit c48b2d9
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 7 deletions.
diff --git a/de4dot.code/deobfuscators/CliSecure/vm/UnknownHandlerInfo.cs b/de4dot.code/deobfuscators/CliSecure/vm/UnknownHandlerInfo.cs
@@ -18,6 +18,7 @@ You should have received a copy of the GNU General Public License
 */
 
 using System;
+using System.Collections.Generic;
 using Mono.Cecil;
 using Mono.Cecil.Cil;
 using de4dot.blocks;
@@ -66,13 +67,34 @@ public int NumCtors {
 		public UnknownHandlerInfo(TypeDefinition type, CsvmInfo csvmInfo) {
 			this.type = type;
 			this.csvmInfo = csvmInfo;
-			fieldsInfo = new FieldsInfo(type);
+			fieldsInfo = new FieldsInfo(getFields(type));
 			countMethods();
 			findOverrideMethods();
 			executeMethodThrows = countThrows(executeMethod);
 			executeMethodPops = countPops(executeMethod);
 		}
 
+		static IEnumerable<FieldDefinition> getFields(TypeDefinition type) {
+			var typeFields = new FieldDefinitionAndDeclaringTypeDict<FieldDefinition>();
+			foreach (var field in type.Fields)
+				typeFields.add(field, field);
+			var realFields = new Dictionary<FieldDefinition, bool>();
+			foreach (var method in type.Methods) {
+				if (method.Body == null)
+					continue;
+				foreach (var instr in method.Body.Instructions) {
+					var fieldRef = instr.Operand as FieldReference;
+					if (fieldRef == null)
+						continue;
+					var field = typeFields.find(fieldRef);
+					if (field == null)
+						continue;
+					realFields[field] = true;
+				}
+			}
+			return realFields.Keys;
+		}
+
 		void countMethods() {
 			foreach (var method in type.Methods) {
 				if (method.Name == ".cctor") {

diff --git a/de4dot.mdecrypt/DynamicMethodsDecrypter.cs b/de4dot.mdecrypt/DynamicMethodsDecrypter.cs
@@ -242,12 +242,6 @@ unsafe static IntPtr getEndOfText(IntPtr hDll) {
 				if (!compareName(textName, name, name.Length))
 					continue;
 
-				uint oldProtect;
-				if (!VirtualProtect(new IntPtr(pSection), sizeof(IMAGE_SECTION_HEADER), PAGE_EXECUTE_READWRITE, out oldProtect))
-					throw new ApplicationException("Could not enable write access to jitter .text section");
-				pSection->VirtualSize = (pSection->VirtualSize + sectionAlignment - 1) & ~(sectionAlignment - 1);
-				VirtualProtect(new IntPtr(pSection), sizeof(IMAGE_SECTION_HEADER), oldProtect, out oldProtect);
-
 				uint size = pSection->VirtualSize;
 				uint rva = pSection->VirtualAddress;
 				return new IntPtr((byte*)hDll + rva + size);