Skip to content

Commit

Permalink
Remove earlyDetect()
Browse files Browse the repository at this point in the history
  • Loading branch information
wtfsck committed Aug 12, 2012
1 parent 3b45ddc commit 1768de1
Show file tree
Hide file tree
Showing 4 changed files with 4 additions and 46 deletions.
26 changes: 2 additions & 24 deletions de4dot.code/ObfuscatedFile.cs
Original file line number Diff line number Diff line change
Expand Up @@ -248,7 +248,6 @@ void detectObfuscator(IEnumerable<IDeobfuscator> deobfuscators) {
if (this.deob != null) {
deob.init(module);
deob.DeobfuscatedFile = this;
deob.earlyDetect();
deob.detect();
return;
}
Expand All @@ -261,35 +260,14 @@ void detectObfuscator(IEnumerable<IDeobfuscator> deobfuscators) {
if (options.ForcedObfuscatorType != null) {
foreach (var deob in deobfuscators) {
if (string.Equals(options.ForcedObfuscatorType, deob.Type, StringComparison.OrdinalIgnoreCase)) {
deob.earlyDetect();
this.deob = deob;
deob.detect();
return;
}
}
}
else {
this.deob = earlyDetectObfuscator(deobfuscators);
if (this.deob == null)
this.deob = detectObfuscator2(deobfuscators);
else
this.deob.detect();
}
}

IDeobfuscator earlyDetectObfuscator(IEnumerable<IDeobfuscator> deobfuscators) {
IDeobfuscator detected = null;
int detectVal = 0;
foreach (var deob in deobfuscators) {
int val = deob.earlyDetect();
if (val > 0)
Log.v("{0,3}: {1}", val, deob.TypeLong);
if (val > detectVal) {
detectVal = val;
detected = deob;
}
}
return detected;
else
this.deob = detectObfuscator2(deobfuscators);
}

IDeobfuscator detectObfuscator2(IEnumerable<IDeobfuscator> deobfuscators) {
Expand Down
4 changes: 0 additions & 4 deletions de4dot.code/deobfuscators/DeobfuscatorBase.cs
Original file line number Diff line number Diff line change
Expand Up @@ -127,10 +127,6 @@ protected virtual bool checkValidName(string name) {
return optionsBase.ValidNameRegex.isMatch(name);
}

public virtual int earlyDetect() {
return 0;
}

public virtual int detect() {
scanForObfuscator();
return detectInternal();
Expand Down
5 changes: 0 additions & 5 deletions de4dot.code/deobfuscators/IDeobfuscator.cs
Original file line number Diff line number Diff line change
Expand Up @@ -72,11 +72,6 @@ public interface IDeobfuscator : INameChecker {

void init(ModuleDefinition module);

// Same as detect() but may be used by deobfuscators to detect obfuscator that decrypt
// metadata at runtime. Code in detect() assume they can access everything. 0 should be
// returned if not detected.
int earlyDetect();

// Returns 0 if it's not detected, or > 0 if detected (higher value => more likely true).
// This method is always called.
int detect();
Expand Down
15 changes: 2 additions & 13 deletions de4dot.code/deobfuscators/Unknown/Deobfuscator.cs
Original file line number Diff line number Diff line change
Expand Up @@ -76,19 +76,6 @@ void setName(string name) {
obfuscatorName = string.Format("{0} (not supported)", name);
}

public override int earlyDetect() {
setName(earlyScanTypes());
return obfuscatorName != null ? 1 : 0;
}

string earlyScanTypes() {
foreach (var type in module.Types) {
if (type.FullName == "ConfusedByAttribute")
return "Confuser";
}
return null;
}

protected override int detectInternal() {
setName(scanTypes());
return 1;
Expand All @@ -99,6 +86,8 @@ protected override void scanForObfuscator() {

string scanTypes() {
foreach (var type in module.Types) {
if (type.FullName == "ConfusedByAttribute")
return "Confuser";
if (type.FullName == "ZYXDNGuarder")
return "DNGuard HVM";
if (type.Name.Contains("();\t"))
Expand Down

0 comments on commit 1768de1

Please sign in to comment.