PageRenderTime 44ms CodeModel.GetById 13ms RepoModel.GetById 0ms app.codeStats 0ms

/de4dot.blocks/cflow/SwitchCflowDeobfuscator.cs

https://bitbucket.org/gencer/de4dot-original
C# | 483 lines | 359 code | 62 blank | 62 comment | 115 complexity | 4342127925970b307dcdda56116a2aa8 MD5 | raw file
Possible License(s): GPL-3.0
  1. /*
  2. Copyright (C) 2011-2013 de4dot@gmail.com
  3. This file is part of de4dot.
  4. de4dot is free software: you can redistribute it and/or modify
  5. it under the terms of the GNU General Public License as published by
  6. the Free Software Foundation, either version 3 of the License, or
  7. (at your option) any later version.
  8. de4dot is distributed in the hope that it will be useful,
  9. but WITHOUT ANY WARRANTY; without even the implied warranty of
  10. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11. GNU General Public License for more details.
  12. You should have received a copy of the GNU General Public License
  13. along with de4dot. If not, see <http://www.gnu.org/licenses/>.
  14. */
  15. using System;
  16. using System.Collections.Generic;
  17. using dnlib.DotNet;
  18. using dnlib.DotNet.Emit;
  19. namespace de4dot.blocks.cflow {
  20. class SwitchCflowDeobfuscator : BlockDeobfuscator {
  21. InstructionEmulator instructionEmulator = new InstructionEmulator();
  22. protected override bool Deobfuscate(Block switchBlock) {
  23. if (switchBlock.LastInstr.OpCode.Code != Code.Switch)
  24. return false;
  25. if (IsSwitchTopOfStack(switchBlock) && DeobfuscateTOS(switchBlock))
  26. return true;
  27. if (IsLdlocBranch(switchBlock, true) && DeobfuscateLdloc(switchBlock))
  28. return true;
  29. if (IsStLdlocBranch(switchBlock, true) && DeobfuscateStLdloc(switchBlock))
  30. return true;
  31. if (IsSwitchType1(switchBlock) && DeobfuscateType1(switchBlock))
  32. return true;
  33. if (IsSwitchType2(switchBlock) && DeobfuscateType2(switchBlock))
  34. return true;
  35. if (switchBlock.FirstInstr.IsLdloc() && FixSwitchBranch(switchBlock))
  36. return true;
  37. return false;
  38. }
  39. static bool IsSwitchTopOfStack(Block switchBlock) {
  40. return switchBlock.Instructions.Count == 1;
  41. }
  42. static bool IsLdlocBranch(Block switchBlock, bool isSwitch) {
  43. int numInstrs = 1 + (isSwitch ? 1 : 0);
  44. return switchBlock.Instructions.Count == numInstrs && switchBlock.Instructions[0].IsLdloc();
  45. }
  46. static bool IsSwitchType1(Block switchBlock) {
  47. return switchBlock.FirstInstr.IsLdloc();
  48. }
  49. bool IsSwitchType2(Block switchBlock) {
  50. Local local = null;
  51. foreach (var instr in switchBlock.Instructions) {
  52. if (!instr.IsLdloc())
  53. continue;
  54. local = Instr.GetLocalVar(blocks.Locals, instr);
  55. break;
  56. }
  57. if (local == null)
  58. return false;
  59. foreach (var source in switchBlock.Sources) {
  60. var instrs = source.Instructions;
  61. for (int i = 1; i < instrs.Count; i++) {
  62. var ldci4 = instrs[i - 1];
  63. if (!ldci4.IsLdcI4())
  64. continue;
  65. var stloc = instrs[i];
  66. if (!stloc.IsStloc())
  67. continue;
  68. if (Instr.GetLocalVar(blocks.Locals, stloc) != local)
  69. continue;
  70. return true;
  71. }
  72. }
  73. return false;
  74. }
  75. bool IsStLdlocBranch(Block switchBlock, bool isSwitch) {
  76. int numInstrs = 2 + (isSwitch ? 1 : 0);
  77. return switchBlock.Instructions.Count == numInstrs &&
  78. switchBlock.Instructions[0].IsStloc() &&
  79. switchBlock.Instructions[1].IsLdloc() &&
  80. Instr.GetLocalVar(blocks.Locals, switchBlock.Instructions[0]) == Instr.GetLocalVar(blocks.Locals, switchBlock.Instructions[1]);
  81. }
  82. bool DeobfuscateTOS(Block switchBlock) {
  83. bool modified = false;
  84. if (switchBlock.Targets == null)
  85. return modified;
  86. var targets = new List<Block>(switchBlock.Targets);
  87. modified |= DeobfuscateTOS(targets, switchBlock.FallThrough, switchBlock);
  88. return modified;
  89. }
  90. bool DeobfuscateLdloc(Block switchBlock) {
  91. bool modified = false;
  92. var switchVariable = Instr.GetLocalVar(blocks.Locals, switchBlock.Instructions[0]);
  93. if (switchVariable == null)
  94. return modified;
  95. if (switchBlock.Targets == null)
  96. return modified;
  97. var targets = new List<Block>(switchBlock.Targets);
  98. modified |= DeobfuscateLdloc(targets, switchBlock.FallThrough, switchBlock, switchVariable);
  99. return modified;
  100. }
  101. bool DeobfuscateStLdloc(Block switchBlock) {
  102. bool modified = false;
  103. var switchVariable = Instr.GetLocalVar(blocks.Locals, switchBlock.Instructions[0]);
  104. if (switchVariable == null)
  105. return modified;
  106. if (switchBlock.Targets == null)
  107. return modified;
  108. var targets = new List<Block>(switchBlock.Targets);
  109. modified |= DeobfuscateStLdloc(targets, switchBlock.FallThrough, switchBlock);
  110. return modified;
  111. }
  112. // Switch deobfuscation when block uses stloc N, ldloc N to load switch constant
  113. // blk1:
  114. // ldc.i4 X
  115. // br swblk
  116. // swblk:
  117. // stloc N
  118. // ldloc N
  119. // switch (......)
  120. bool DeobfuscateStLdloc(IList<Block> switchTargets, Block switchFallThrough, Block block) {
  121. bool modified = false;
  122. foreach (var source in new List<Block>(block.Sources)) {
  123. if (!isBranchBlock(source))
  124. continue;
  125. instructionEmulator.Initialize(blocks, allBlocks[0] == source);
  126. instructionEmulator.Emulate(source.Instructions);
  127. var target = GetSwitchTarget(switchTargets, switchFallThrough, instructionEmulator.Pop());
  128. if (target == null)
  129. continue;
  130. source.ReplaceLastNonBranchWithBranch(0, target);
  131. source.Add(new Instr(OpCodes.Pop.ToInstruction()));
  132. modified = true;
  133. }
  134. return modified;
  135. }
  136. // Switch deobfuscation when block uses ldloc N to load switch constant
  137. // blk1:
  138. // ldc.i4 X
  139. // stloc N
  140. // br swblk / bcc swblk
  141. // swblk:
  142. // ldloc N
  143. // switch (......)
  144. bool DeobfuscateLdloc(IList<Block> switchTargets, Block switchFallThrough, Block block, Local switchVariable) {
  145. bool modified = false;
  146. foreach (var source in new List<Block>(block.Sources)) {
  147. if (isBranchBlock(source)) {
  148. instructionEmulator.Initialize(blocks, allBlocks[0] == source);
  149. instructionEmulator.Emulate(source.Instructions);
  150. var target = GetSwitchTarget(switchTargets, switchFallThrough, instructionEmulator.GetLocal(switchVariable));
  151. if (target == null)
  152. continue;
  153. source.ReplaceLastNonBranchWithBranch(0, target);
  154. modified = true;
  155. }
  156. else if (IsBccBlock(source)) {
  157. instructionEmulator.Initialize(blocks, allBlocks[0] == source);
  158. instructionEmulator.Emulate(source.Instructions);
  159. var target = GetSwitchTarget(switchTargets, switchFallThrough, instructionEmulator.GetLocal(switchVariable));
  160. if (target == null)
  161. continue;
  162. if (source.Targets[0] == block) {
  163. source.SetNewTarget(0, target);
  164. modified = true;
  165. }
  166. if (source.FallThrough == block) {
  167. source.SetNewFallThrough(target);
  168. modified = true;
  169. }
  170. }
  171. }
  172. return modified;
  173. }
  174. // Switch deobfuscation when block has switch contant on TOS:
  175. // blk1:
  176. // ldc.i4 X
  177. // br swblk
  178. // swblk:
  179. // switch (......)
  180. bool DeobfuscateTOS(IList<Block> switchTargets, Block switchFallThrough, Block block) {
  181. bool modified = false;
  182. foreach (var source in new List<Block>(block.Sources)) {
  183. if (!isBranchBlock(source))
  184. continue;
  185. instructionEmulator.Initialize(blocks, allBlocks[0] == source);
  186. instructionEmulator.Emulate(source.Instructions);
  187. var target = GetSwitchTarget(switchTargets, switchFallThrough, instructionEmulator.Pop());
  188. if (target == null) {
  189. modified |= DeobfuscateTos_Ldloc(switchTargets, switchFallThrough, source);
  190. }
  191. else {
  192. source.ReplaceLastNonBranchWithBranch(0, target);
  193. source.Add(new Instr(OpCodes.Pop.ToInstruction()));
  194. modified = true;
  195. }
  196. }
  197. return modified;
  198. }
  199. // ldloc N
  200. // br swblk
  201. // or
  202. // stloc N
  203. // ldloc N
  204. // br swblk
  205. bool DeobfuscateTos_Ldloc(IList<Block> switchTargets, Block switchFallThrough, Block block) {
  206. if (IsLdlocBranch(block, false)) {
  207. var switchVariable = Instr.GetLocalVar(blocks.Locals, block.Instructions[0]);
  208. if (switchVariable == null)
  209. return false;
  210. return DeobfuscateLdloc(switchTargets, switchFallThrough, block, switchVariable);
  211. }
  212. else if (IsStLdlocBranch(block, false))
  213. return DeobfuscateStLdloc(switchTargets, switchFallThrough, block);
  214. return false;
  215. }
  216. static bool isBranchBlock(Block block) {
  217. if (block.Targets != null)
  218. return false;
  219. if (block.FallThrough == null)
  220. return false;
  221. switch (block.LastInstr.OpCode.Code) {
  222. case Code.Switch:
  223. case Code.Leave:
  224. case Code.Leave_S:
  225. return false;
  226. default:
  227. return true;
  228. }
  229. }
  230. static bool IsBccBlock(Block block) {
  231. if (block.Targets == null || block.Targets.Count != 1)
  232. return false;
  233. if (block.FallThrough == null)
  234. return false;
  235. switch (block.LastInstr.OpCode.Code) {
  236. case Code.Beq:
  237. case Code.Beq_S:
  238. case Code.Bge:
  239. case Code.Bge_S:
  240. case Code.Bge_Un:
  241. case Code.Bge_Un_S:
  242. case Code.Bgt:
  243. case Code.Bgt_S:
  244. case Code.Bgt_Un:
  245. case Code.Bgt_Un_S:
  246. case Code.Ble:
  247. case Code.Ble_S:
  248. case Code.Ble_Un:
  249. case Code.Ble_Un_S:
  250. case Code.Blt:
  251. case Code.Blt_S:
  252. case Code.Blt_Un:
  253. case Code.Blt_Un_S:
  254. case Code.Bne_Un:
  255. case Code.Bne_Un_S:
  256. case Code.Brfalse:
  257. case Code.Brfalse_S:
  258. case Code.Brtrue:
  259. case Code.Brtrue_S:
  260. return true;
  261. default:
  262. return false;
  263. }
  264. }
  265. bool DeobfuscateType1(Block switchBlock) {
  266. Block target;
  267. if (!EmulateGetTarget(switchBlock, out target) || target != null)
  268. return false;
  269. bool modified = false;
  270. foreach (var source in new List<Block>(switchBlock.Sources)) {
  271. if (!source.CanAppend(switchBlock))
  272. continue;
  273. if (!WillHaveKnownTarget(switchBlock, source))
  274. continue;
  275. source.Append(switchBlock);
  276. modified = true;
  277. }
  278. return modified;
  279. }
  280. bool DeobfuscateType2(Block switchBlock) {
  281. bool modified = false;
  282. var bccSources = new List<Block>();
  283. foreach (var source in new List<Block>(switchBlock.Sources)) {
  284. if (source.LastInstr.IsConditionalBranch()) {
  285. bccSources.Add(source);
  286. continue;
  287. }
  288. if (!source.CanAppend(switchBlock))
  289. continue;
  290. if (!WillHaveKnownTarget(switchBlock, source))
  291. continue;
  292. source.Append(switchBlock);
  293. modified = true;
  294. }
  295. foreach (var bccSource in bccSources) {
  296. if (!WillHaveKnownTarget(switchBlock, bccSource))
  297. continue;
  298. var consts = GetBccLocalConstants(bccSource);
  299. if (consts.Count == 0)
  300. continue;
  301. var newFallThrough = CreateBlock(consts, bccSource.FallThrough);
  302. var newTarget = CreateBlock(consts, bccSource.Targets[0]);
  303. var oldFallThrough = bccSource.FallThrough;
  304. var oldTarget = bccSource.Targets[0];
  305. bccSource.SetNewFallThrough(newFallThrough);
  306. bccSource.SetNewTarget(0, newTarget);
  307. newFallThrough.SetNewFallThrough(oldFallThrough);
  308. newTarget.SetNewFallThrough(oldTarget);
  309. modified = true;
  310. }
  311. return modified;
  312. }
  313. static Block CreateBlock(Dictionary<Local, int> consts, Block fallThrough) {
  314. var block = new Block();
  315. foreach (var kv in consts) {
  316. block.Instructions.Add(new Instr(Instruction.CreateLdcI4(kv.Value)));
  317. block.Instructions.Add(new Instr(OpCodes.Stloc.ToInstruction(kv.Key)));
  318. }
  319. fallThrough.Parent.Add(block);
  320. return block;
  321. }
  322. Dictionary<Local, int> GetBccLocalConstants(Block block) {
  323. var dict = new Dictionary<Local, int>();
  324. var instrs = block.Instructions;
  325. for (int i = 0; i < instrs.Count; i++) {
  326. var instr = instrs[i];
  327. if (instr.IsStloc()) {
  328. var local = Instr.GetLocalVar(blocks.Locals, instr);
  329. if (local == null)
  330. continue;
  331. var ldci4 = i == 0 ? null : instrs[i - 1];
  332. if (ldci4 == null || !ldci4.IsLdcI4())
  333. dict.Remove(local);
  334. else
  335. dict[local] = ldci4.GetLdcI4Value();
  336. }
  337. else if (instr.IsLdloc()) {
  338. var local = Instr.GetLocalVar(blocks.Locals, instr);
  339. if (local != null)
  340. dict.Remove(local);
  341. }
  342. else if (instr.OpCode.Code == Code.Ldloca || instr.OpCode.Code == Code.Ldloca_S) {
  343. var local = instr.Operand as Local;
  344. if (local != null)
  345. dict.Remove(local);
  346. }
  347. }
  348. return dict;
  349. }
  350. bool EmulateGetTarget(Block switchBlock, out Block target) {
  351. instructionEmulator.Initialize(blocks, allBlocks[0] == switchBlock);
  352. try {
  353. instructionEmulator.Emulate(switchBlock.Instructions, 0, switchBlock.Instructions.Count - 1);
  354. }
  355. catch (NullReferenceException) {
  356. // Here if eg. invalid metadata token in a call instruction (operand is null)
  357. target = null;
  358. return false;
  359. }
  360. target = GetTarget(switchBlock);
  361. return true;
  362. }
  363. bool WillHaveKnownTarget(Block switchBlock, Block source) {
  364. instructionEmulator.Initialize(blocks, allBlocks[0] == source);
  365. try {
  366. instructionEmulator.Emulate(source.Instructions);
  367. instructionEmulator.Emulate(switchBlock.Instructions, 0, switchBlock.Instructions.Count - 1);
  368. }
  369. catch (NullReferenceException) {
  370. // Here if eg. invalid metadata token in a call instruction (operand is null)
  371. return false;
  372. }
  373. return GetTarget(switchBlock) != null;
  374. }
  375. Block GetTarget(Block switchBlock) {
  376. var val1 = instructionEmulator.Pop();
  377. if (!val1.IsInt32())
  378. return null;
  379. return CflowUtils.GetSwitchTarget(switchBlock.Targets, switchBlock.FallThrough, (Int32Value)val1);
  380. }
  381. static Block GetSwitchTarget(IList<Block> targets, Block fallThrough, Value value) {
  382. if (!value.IsInt32())
  383. return null;
  384. return CflowUtils.GetSwitchTarget(targets, fallThrough, (Int32Value)value);
  385. }
  386. static bool FixSwitchBranch(Block switchBlock) {
  387. // Code:
  388. // blk1:
  389. // ldc.i4 XXX
  390. // br common
  391. // blk2:
  392. // ldc.i4 YYY
  393. // br common
  394. // common:
  395. // stloc X
  396. // br swblk
  397. // swblk:
  398. // ldloc X
  399. // switch
  400. // Inline common into blk1 and blk2.
  401. bool modified = false;
  402. foreach (var commonSource in new List<Block>(switchBlock.Sources)) {
  403. if (commonSource.Instructions.Count != 1)
  404. continue;
  405. if (!commonSource.FirstInstr.IsStloc())
  406. continue;
  407. foreach (var blk in new List<Block>(commonSource.Sources)) {
  408. if (blk.CanAppend(commonSource)) {
  409. blk.Append(commonSource);
  410. modified = true;
  411. }
  412. }
  413. }
  414. return modified;
  415. }
  416. }
  417. }