From ef59696d5f11a6d4dd921b8b937521936dc02731 Mon Sep 17 00:00:00 2001
From: etmatrix <etmatrix@etmatrix>
Date: Sat, 2 Feb 2019 08:42:50 +0100
Subject: [PATCH] CryptoObfuscator: Improvements for ResourceDecrypter and
 AntiDebugger

---
 de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs      | 1 +
 de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs b/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs
index 78b7f090d..90eccda6c 100644
--- a/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs
+++ b/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs
@@ -66,6 +66,7 @@ bool Find(MethodDef methodToCheck) {
 					!ContainsString(method, "run with") &&
 					!ContainsString(method, "started under") &&
 					!ContainsString(method, "{0} detected") &&
+					!ContainsString(method, "{0} was found - this software cannot be executed") &&
 					!ContainsString(method, "{0} found"))
 					continue;
 
diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs b/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs
index 3fca701fe..5b96349fb 100644
--- a/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs
+++ b/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs
@@ -313,6 +313,8 @@ static IEnumerable<MethodDef> GetDecrypterMethods(TypeDef type) {
 					yield return method;
 				else if (DotNetUtils.IsMethod(method, "System.Byte[]", "(System.Char,System.IO.Stream)"))
 					yield return method;
+				else if (DotNetUtils.IsMethod(method, "System.Byte[]", "(System.Int64,System.Object)"))
+					yield return method;
 			}
 		}