diff --git a/de4dot.code/deobfuscators/Agile_NET/ProxyCallFixer.cs b/de4dot.code/deobfuscators/Agile_NET/ProxyCallFixer.cs index 35f402ce3..930c3420b 100644 --- a/de4dot.code/deobfuscators/Agile_NET/ProxyCallFixer.cs +++ b/de4dot.code/deobfuscators/Agile_NET/ProxyCallFixer.cs @@ -18,6 +18,7 @@ You should have received a copy of the GNU General Public License */ using System; +using de4dot.blocks; using dnlib.DotNet; using dnlib.DotNet.Emit; @@ -41,6 +42,17 @@ public void FindDelegateCreator() { SetDelegateCreatorMethod(method); return; } + // Sometimes, the method name is different. + if (method.IsStatic && !method.IsStaticConstructor && DotNetUtils.IsMethod(method, "System.Void", "(System.Int32)")) { + var instrs = DotNetUtils.GetInstructions(method.Body.Instructions, 0, OpCodes.Ldsflda, + OpCodes.Ldc_I4, OpCodes.Ldarg_0, OpCodes.Add, OpCodes.Call, OpCodes.Call); + if (instrs != null && instrs[1].GetLdcI4Value() == 0x2000001 + // This is important to differentiate from SmartAssembly + && DotNetUtils.CallsMethod(method, "System.Byte[] System.Convert::FromBase64String(System.String)")) { + SetDelegateCreatorMethod(method); + return; + } + } } } } diff --git a/de4dot.code/deobfuscators/Confuser/ProxyCallFixer.cs b/de4dot.code/deobfuscators/Confuser/ProxyCallFixer.cs index 8b27aba65..051e220e4 100644 --- a/de4dot.code/deobfuscators/Confuser/ProxyCallFixer.cs +++ b/de4dot.code/deobfuscators/Confuser/ProxyCallFixer.cs @@ -115,10 +115,10 @@ public IEnumerable Fields { var fields = new List(fieldToMethods.GetKeys()); var type = DotNetUtils.GetModuleType(module); if (fields.Count > 0 && type != null) { - foreach (var field in type.Fields) { - var fieldType = field.FieldType.TryGetTypeDef(); + foreach (var tField in type.Fields) { + var fieldType = tField.FieldType.TryGetTypeDef(); if (fieldType != null && delegateTypesDict.ContainsKey(fieldType)) - fields.Add(field); + fields.Add(tField); } } return fields;