From b219f3ef82b7131abc132a41cde1fc985c2181a7 Mon Sep 17 00:00:00 2001 From: Melissa Eckardt Date: Thu, 20 Nov 2025 17:13:34 +0100 Subject: [PATCH 1/2] Agile.NET: Fix delegate deobfuscation for some binaries --- .../deobfuscators/Agile_NET/ProxyCallFixer.cs | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/de4dot.code/deobfuscators/Agile_NET/ProxyCallFixer.cs b/de4dot.code/deobfuscators/Agile_NET/ProxyCallFixer.cs index 35f402ce3..930c3420b 100644 --- a/de4dot.code/deobfuscators/Agile_NET/ProxyCallFixer.cs +++ b/de4dot.code/deobfuscators/Agile_NET/ProxyCallFixer.cs @@ -18,6 +18,7 @@ You should have received a copy of the GNU General Public License */ using System; +using de4dot.blocks; using dnlib.DotNet; using dnlib.DotNet.Emit; @@ -41,6 +42,17 @@ public void FindDelegateCreator() { SetDelegateCreatorMethod(method); return; } + // Sometimes, the method name is different. + if (method.IsStatic && !method.IsStaticConstructor && DotNetUtils.IsMethod(method, "System.Void", "(System.Int32)")) { + var instrs = DotNetUtils.GetInstructions(method.Body.Instructions, 0, OpCodes.Ldsflda, + OpCodes.Ldc_I4, OpCodes.Ldarg_0, OpCodes.Add, OpCodes.Call, OpCodes.Call); + if (instrs != null && instrs[1].GetLdcI4Value() == 0x2000001 + // This is important to differentiate from SmartAssembly + && DotNetUtils.CallsMethod(method, "System.Byte[] System.Convert::FromBase64String(System.String)")) { + SetDelegateCreatorMethod(method); + return; + } + } } } } From 6146a98fbee89762daaf376cafb9c8df559a9ded Mon Sep 17 00:00:00 2001 From: Melissa Eckardt Date: Thu, 20 Nov 2025 17:20:16 +0100 Subject: [PATCH 2/2] Fix C# 14.0 compatibility --- de4dot.code/deobfuscators/Confuser/ProxyCallFixer.cs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/de4dot.code/deobfuscators/Confuser/ProxyCallFixer.cs b/de4dot.code/deobfuscators/Confuser/ProxyCallFixer.cs index 8b27aba65..051e220e4 100644 --- a/de4dot.code/deobfuscators/Confuser/ProxyCallFixer.cs +++ b/de4dot.code/deobfuscators/Confuser/ProxyCallFixer.cs @@ -115,10 +115,10 @@ public IEnumerable Fields { var fields = new List(fieldToMethods.GetKeys()); var type = DotNetUtils.GetModuleType(module); if (fields.Count > 0 && type != null) { - foreach (var field in type.Fields) { - var fieldType = field.FieldType.TryGetTypeDef(); + foreach (var tField in type.Fields) { + var fieldType = tField.FieldType.TryGetTypeDef(); if (fieldType != null && delegateTypesDict.ContainsKey(fieldType)) - fields.Add(field); + fields.Add(tField); } } return fields;