-
Notifications
You must be signed in to change notification settings - Fork 4
/
Copy pathProgram.cs
160 lines (154 loc) · 7.09 KB
/
Program.cs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
using System;
using System.IO;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using dnlib.DotNet.Writer;
namespace SinUnfuscator
{
class Program
{
public static ModuleDefMD asm;
public static string path;
static void fixLengthCalls()
{
foreach (TypeDef type in asm.Types)
{
foreach (MethodDef methods in type.Methods)
{
if (!methods.HasBody) { continue; }
for (int x = 0; x < methods.Body.Instructions.Count; x++)
{
Instruction inst = methods.Body.Instructions[x];
if (inst.OpCode.Equals(OpCodes.Call))
{
if (inst.Operand.ToString().Contains("System.String::get_Length"))
{
int newLen = inst.Operand.ToString().Length;
methods.Body.Instructions[x - 1].OpCode = OpCodes.Ldc_I4;
methods.Body.Instructions[x - 1].Operand = newLen;
methods.Body.Instructions.Remove(inst);
}
}
}
}
}
}
static void removeJunk()
{
asm.EntryPoint.DeclaringType.Name = "Entrypoint";
for (int x_type = 0; x_type < asm.Types.Count; x_type++)
{
TypeDef type = asm.Types[x_type];
if (type.IsGlobalModuleType) { type.Name = "<Module>"; }
if (type.HasInterfaces)
{
bool wasInterfaceObf = false;
foreach (InterfaceImpl intrface in type.Interfaces)
{
if (intrface.Interface == type)
{
asm.Types.RemoveAt(x_type);
x_type--;
wasInterfaceObf = true;
break;
}
}
if (wasInterfaceObf) { continue; }
}
for (int x_methods = 0; x_methods < type.Methods.Count; x_methods++)
{
MethodDef methods = type.Methods[x_methods];
if (!methods.HasBody) { continue; }
methods.Body.KeepOldMaxStack = true;
for (int x_inst = 0; x_inst < methods.Body.Instructions.Count; x_inst++)
{
Instruction inst = methods.Body.Instructions[x_inst];
switch (inst.OpCode.Code)
{
case Code.Ret:
if (methods.Body.Instructions[x_inst - 1].OpCode.Equals(OpCodes.Ldc_I4) && methods.Body.Instructions[x_inst - 2].OpCode.Equals(OpCodes.Ldc_I4))
{
type.Methods.RemoveAt(x_methods);
x_methods--;
}
break;
case Code.Call:
if (inst.Operand.ToString().Contains("System.Convert::FromBase64String")) { methods.Name = "StringDecoder"; }
if (inst.Operand.ToString().Contains("<Module>::Initialize")) { methods.Name = ".cctor"; }
break;
}
}
}
if (!type.HasMethods) { asm.Types.RemoveAt(x_type); x_type--; }
}
}
static void fixStrings()
{
foreach (TypeDef type in asm.Types)
{
foreach (MethodDef methods in type.Methods)
{
if (!methods.HasBody) { continue; }
for (int x = 0; x < methods.Body.Instructions.Count; x++)
{
if (x + 1 >= methods.Body.Instructions.Count) { continue; }
Instruction inst = methods.Body.Instructions[x];
if (inst.OpCode.Equals(OpCodes.Ldstr) && methods.Body.Instructions[x + 1].OpCode.Equals(OpCodes.Call))
{
if (methods.Body.Instructions[x + 1].Operand.ToString().Contains("<Module>::StringDecoder"))
{
inst.Operand = Encoding.UTF8.GetString(Convert.FromBase64String(inst.Operand.ToString()));
methods.Body.Instructions.RemoveAt(x + 1);
}
}
}
}
}
}
static void disableProtections()
{
foreach (TypeDef type in asm.Types)
{
if (type.IsGlobalModuleType)
{
type.Methods.Clear();
}
}
}
static void Main(string[] args)
{
Console.Title = "SinUnfuscator";
Console.WriteLine();
Console.WriteLine(" SinUnfuscator by misonothx - SaintFuscator Deobfuscator");
Console.WriteLine(" |- https://github.com/miso-xyz/SinUnfuscator/");
Console.WriteLine();
path = args[0];
asm = ModuleDefMD.Load(args[0]);
Console.ForegroundColor = ConsoleColor.Yellow;
Console.WriteLine(" Removing Junk...");
removeJunk();
Console.WriteLine(" Decoding Strings...");
fixStrings();
Console.WriteLine(" Simplifying Length Calls...");
fixLengthCalls();
Console.WriteLine(" Removing Protections...");
disableProtections();
ModuleWriterOptions moduleWriterOptions = new ModuleWriterOptions(asm);
moduleWriterOptions.MetadataOptions.Flags |= MetadataFlags.PreserveAll;
moduleWriterOptions.Logger = DummyLogger.NoThrowInstance;
NativeModuleWriterOptions nativeModuleWriterOptions = new NativeModuleWriterOptions(asm, true);
nativeModuleWriterOptions.MetadataOptions.Flags |= MetadataFlags.PreserveAll;
nativeModuleWriterOptions.Logger = DummyLogger.NoThrowInstance;
if (asm.IsILOnly) { asm.Write(Path.GetFileNameWithoutExtension(path) + "-SinUnfuscator" + Path.GetExtension(path)); }
else { asm.NativeWrite(Path.GetFileNameWithoutExtension(path) + "-SinUnfuscator" + Path.GetExtension(path)); }
Console.ForegroundColor = ConsoleColor.Green;
Console.WriteLine(" Successfully cleaned! (saved as '" + Path.GetFileNameWithoutExtension(path) + "-SinUnfuscator" + Path.GetExtension(path) + "')");
Console.ResetColor();
Console.WriteLine(" Press any key to exit...");
Console.ReadKey();
}
}
}