diff --git a/de4dot.code/deobfuscators/VirtualGuard/Deobfuscator.cs b/de4dot.code/deobfuscators/VirtualGuard/Deobfuscator.cs index 1af21167..f8ab19fd 100644 --- a/de4dot.code/deobfuscators/VirtualGuard/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/VirtualGuard/Deobfuscator.cs @@ -127,6 +127,7 @@ private void DetectVirtualGuard() public override void DeobfuscateBegin() { base.DeobfuscateBegin(); + proxyCallFixer.PatchModuleCctor(module); } public override void DeobfuscateEnd() diff --git a/de4dot.code/deobfuscators/VirtualGuard/ProxyCallFixer.cs b/de4dot.code/deobfuscators/VirtualGuard/ProxyCallFixer.cs index 603a99fa..bc293906 100644 --- a/de4dot.code/deobfuscators/VirtualGuard/ProxyCallFixer.cs +++ b/de4dot.code/deobfuscators/VirtualGuard/ProxyCallFixer.cs @@ -38,30 +38,32 @@ public ProxyCallFixer(ModuleDefMD module) foundMethods.Add(method); } } + } - moduleCctor = DotNetUtils.GetModuleTypeCctor(module); - if (moduleCctor == null) - return; - var instrs = moduleCctor.Body.Instructions; - var instrCount = instrs.Count; - for (int i = 0; i < instrCount; i++) - { - if (instrs[i].OpCode == OpCodes.Ldftn) - { - objList.Add(instrs[i].Operand as IMethod); - } - if (instrs[i].OpCode == OpCodes.Stsfld) - { - realObj = instrs[i].Operand as FieldDef; - stsfldIdx = i; - } - } - //if found nop out all instructions till stsfld instruction - if (stsfldIdx != -1) - { - for (int i = 0; i <= stsfldIdx; i++) - instrs[i].OpCode = OpCodes.Nop; - } + public void PatchModuleCctor(ModuleDefMD module) { + moduleCctor = DotNetUtils.GetModuleTypeCctor(module); + if (moduleCctor == null) + return; + var instrs = moduleCctor.Body.Instructions; + var instrCount = instrs.Count; + for (int i = 0; i < instrCount; i++) + { + if (instrs[i].OpCode == OpCodes.Ldftn) + { + objList.Add(instrs[i].Operand as IMethod); + } + if (instrs[i].OpCode == OpCodes.Stsfld) + { + realObj = instrs[i].Operand as FieldDef; + stsfldIdx = i; + } + } + //if found nop out all instructions till stsfld instruction + if (stsfldIdx != -1) + { + for (int i = 0; i <= stsfldIdx; i++) + instrs[i].OpCode = OpCodes.Nop; + } } public void ReplaceMethodCalls(IMethod toFind, IMethod toReplace)