CryptoObfuscator: Improvements for ResourceDecrypter and AntiDebugger

Ploosh0 · Feb 2, 2019 · ef59696 · ef59696
1 parent 8c5d2b0
commit ef59696
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs b/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs
@@ -66,6 +66,7 @@ bool Find(MethodDef methodToCheck) {
 					!ContainsString(method, "run with") &&
 					!ContainsString(method, "started under") &&
 					!ContainsString(method, "{0} detected") &&
+					!ContainsString(method, "{0} was found - this software cannot be executed") &&
 					!ContainsString(method, "{0} found"))
 					continue;
 

diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs b/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs
@@ -313,6 +313,8 @@ static IEnumerable<MethodDef> GetDecrypterMethods(TypeDef type) {
 					yield return method;
 				else if (DotNetUtils.IsMethod(method, "System.Byte[]", "(System.Char,System.IO.Stream)"))
 					yield return method;
+				else if (DotNetUtils.IsMethod(method, "System.Byte[]", "(System.Int64,System.Object)"))
+					yield return method;
 			}
 		}