Skip to content

Instantly share code, notes, and snippets.

@hasherezade

hasherezade/decode_indexes.cs Secret

Last active November 14, 2022 19:56
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save hasherezade/107a61eebb345313b34d1bb49f282f54 to your computer and use it in GitHub Desktop.
Save hasherezade/107a61eebb345313b34d1bb49f282f54 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
decode_indexes.cs
static void decodeIndexes()
{
byte[] indexes = {
250,
242,
240,
235,
243,
249,
247,
245,
238,
232,
253,
244,
237,
251,
234,
233,
236,
246,
241,
255,
252
};
List<string> resolved = new List<string>();
for (var i = 0; i < indexes.Length; i++)
{
var val = indexes[i] ^ 248;
//make IP
string str = val.ToString();
byte[] a = Encoding.ASCII.GetBytes(str);
string lenIP = String.Format("199.0.0.{0}", str.Length + 1);
resolved.Add(lenIP);
string valIP = "";
if (str.Length > 1)
{
valIP = String.Format("43.{0}.{1}.0", a[0], a[1]);
}
else
{
valIP = String.Format("43.{0}.0.0", a[0]);
}
resolved.Add(valIP);
}
for (var i = 0; i < resolved.Count; i++)
{
//Console.WriteLine("DomainsList.Add(\"{0}\");", resolved[i]);
Console.WriteLine("{0}", resolved[i]);
}
}
static void Main(string[] args)
{
decodeIndexes();
}
Raw
find_and_patch.cs
byte[] currentBody = methodBody.GetILAsByteArray();
if (currentBody.Length != decChunk.Length)
{
Console.WriteLine("Length mismatch: {0:X} {1}", metadataToken, mi.Name);
continue;
}
// offset where the method body starts (headers may have various sizes)
int bodyOffset = 0;
for (var i = offset; i < (offset + hdrSize + decChunk.Length); i++)
{
//memcmp:
bool isOk = true;
for (var k = 0; k < decChunk.Length; k++)
{
if (fileBuf[i + k] != currentBody[k])
{
isOk = false;
break;
}
}
if (isOk)
{
bodyOffset = i;
break;
}
}
if (bodyOffset == 0)
{
Console.WriteLine("Function body not found: {0:X} {1}", metadataToken, mi.Name);
continue;
}
// apply the patch on the file buffer:
Buffer.BlockCopy(decChunk, 0, fileBuf, bodyOffset, decChunk.Length)
Raw
flare_71.cs
// Token: 0x060000BC RID: 188 RVA: 0x00013EB8 File Offset: 0x0001AEB8
public static object flare_71(InvalidProgramException e, object[] args, Dictionary<uint, int> m, byte[] b)
{
StackTrace stackTrace = new StackTrace(e);
int metadataToken = stackTrace.GetFrame(0).GetMethod().MetadataToken;
Module module = typeof(Program).Module;
MethodInfo methodInfo = (MethodInfo)module.ResolveMethod(metadataToken);
MethodBase methodBase = module.ResolveMethod(metadataToken);
ParameterInfo[] parameters = methodInfo.GetParameters();
Type[] array = new Type[parameters.Length];
SignatureHelper localVarSigHelper = SignatureHelper.GetLocalVarSigHelper();
for (int i = 0; i < array.Length; i++)
{
array[i] = parameters[i].ParameterType;
}
Type declaringType = methodBase.DeclaringType;
DynamicMethod dynamicMethod = new DynamicMethod("", methodInfo.ReturnType, array, declaringType, true);
DynamicILInfo dynamicILInfo = dynamicMethod.GetDynamicILInfo();
MethodBody methodBody = methodInfo.GetMethodBody();
foreach (LocalVariableInfo localVariableInfo in methodBody.LocalVariables)
{
localVarSigHelper.AddArgument(localVariableInfo.LocalType);
}
byte[] signature = localVarSigHelper.GetSignature();
dynamicILInfo.SetLocalSignature(signature);
foreach (KeyValuePair<uint, int> keyValuePair in m)
{
int value = keyValuePair.Value;
uint key = keyValuePair.Key;
bool flag = value >= 1879048192 && value < 1879113727;
int tokenFor;
if (flag)
{
tokenFor = dynamicILInfo.GetTokenFor(module.ResolveString(value));
}
else
{
MemberInfo memberInfo = declaringType.Module.ResolveMember(value, null, null);
bool flag2 = memberInfo.GetType().Name == "RtFieldInfo";
if (flag2)
{
tokenFor = dynamicILInfo.GetTokenFor(((FieldInfo)memberInfo).FieldHandle, ((TypeInfo)((FieldInfo)memberInfo).DeclaringType).TypeHandle);
}
else
{
bool flag3 = memberInfo.GetType().Name == "RuntimeType";
if (flag3)
{
tokenFor = dynamicILInfo.GetTokenFor(((TypeInfo)memberInfo).TypeHandle);
}
else
{
bool flag4 = memberInfo.Name == ".ctor" || memberInfo.Name == ".cctor";
if (flag4)
{
tokenFor = dynamicILInfo.GetTokenFor(((ConstructorInfo)memberInfo).MethodHandle, ((TypeInfo)((ConstructorInfo)memberInfo).DeclaringType).TypeHandle);
}
else
{
tokenFor = dynamicILInfo.GetTokenFor(((MethodInfo)memberInfo).MethodHandle, ((TypeInfo)((MethodInfo)memberInfo).DeclaringType).TypeHandle);
}
}
}
}
b[(int)key] = (byte)tokenFor;
b[(int)(key + 1U)] = (byte)(tokenFor >> 8);
b[(int)(key + 2U)] = (byte)(tokenFor >> 16);
b[(int)(key + 3U)] = (byte)(tokenFor >> 24);
}
dynamicILInfo.SetCode(b, methodBody.MaxStackSize);
return dynamicMethod.Invoke(null, args);
}
Raw
flare_71_modified.cs
public static byte[] flare_71(Dictionary<uint, int> m, byte[] b)
{
foreach (KeyValuePair<uint, int> keyValuePair in m)
{
int value = keyValuePair.Value;
uint key = keyValuePair.Key;
int tokenFor = value;
b[(int)key] = (byte)tokenFor;
b[(int)(key + 1U)] = (byte)(tokenFor >> 8);
b[(int)(key + 2U)] = (byte)(tokenFor >> 16);
b[(int)(key + 3U)] = (byte)(tokenFor >> 24);
}
return b;
}
Raw
flared_67.cs
// Token: 0x060000B4 RID: 180 RVA: 0x00012E00 File Offset: 0x00019E00
public static object flared_67(byte[] b, int tk, object[] a)
{
Dictionary<uint, FLARE06.OT> dictionary = new Dictionary<uint, FLARE06.OT>
{
{
88U,
FLARE06.OT.A
},
{
214U,
FLARE06.OT.A
},
{
215U,
FLARE06.OT.A
},
{
95U,
FLARE06.OT.A
},
{
65024U,
FLARE06.OT.A
},
{
59U,
FLARE06.OT.D
},
{
46U,
FLARE06.OT.C
},
{
60U,
FLARE06.OT.D
},
{
47U,
FLARE06.OT.C
},
{
65U,
FLARE06.OT.D
},
{
52U,
FLARE06.OT.C
},
{
61U,
FLARE06.OT.D
},
{
48U,
FLARE06.OT.C
},
{
66U,
FLARE06.OT.D
},
{
53U,
FLARE06.OT.C
},
{
62U,
FLARE06.OT.D
},
{
49U,
FLARE06.OT.C
},
{
67U,
FLARE06.OT.D
},
{
54U,
FLARE06.OT.C
},
{
63U,
FLARE06.OT.D
},
{
50U,
FLARE06.OT.C
},
{
68U,
FLARE06.OT.D
},
{
55U,
FLARE06.OT.C
},
{
64U,
FLARE06.OT.D
},
{
51U,
FLARE06.OT.C
},
{
140U,
FLARE06.OT.B
},
{
56U,
FLARE06.OT.D
},
{
43U,
FLARE06.OT.C
},
{
1U,
FLARE06.OT.A
},
{
57U,
FLARE06.OT.D
},
{
44U,
FLARE06.OT.C
},
{
58U,
FLARE06.OT.D
},
{
45U,
FLARE06.OT.C
},
{
40U,
FLARE06.OT.B
},
{
41U,
FLARE06.OT.B
},
{
111U,
FLARE06.OT.B
},
{
116U,
FLARE06.OT.B
},
{
65025U,
FLARE06.OT.A
},
{
65026U,
FLARE06.OT.A
},
{
65027U,
FLARE06.OT.A
},
{
195U,
FLARE06.OT.A
},
{
65028U,
FLARE06.OT.A
},
{
65029U,
FLARE06.OT.A
},
{
65046U,
FLARE06.OT.B
},
{
211U,
FLARE06.OT.A
},
{
103U,
FLARE06.OT.A
},
{
104U,
FLARE06.OT.A
},
{
105U,
FLARE06.OT.A
},
{
106U,
FLARE06.OT.A
},
{
212U,
FLARE06.OT.A
},
{
138U,
FLARE06.OT.A
},
{
179U,
FLARE06.OT.A
},
{
130U,
FLARE06.OT.A
},
{
181U,
FLARE06.OT.A
},
{
131U,
FLARE06.OT.A
},
{
183U,
FLARE06.OT.A
},
{
132U,
FLARE06.OT.A
},
{
185U,
FLARE06.OT.A
},
{
133U,
FLARE06.OT.A
},
{
213U,
FLARE06.OT.A
},
{
139U,
FLARE06.OT.A
},
{
180U,
FLARE06.OT.A
},
{
134U,
FLARE06.OT.A
},
{
182U,
FLARE06.OT.A
},
{
135U,
FLARE06.OT.A
},
{
184U,
FLARE06.OT.A
},
{
136U,
FLARE06.OT.A
},
{
186U,
FLARE06.OT.A
},
{
137U,
FLARE06.OT.A
},
{
118U,
FLARE06.OT.A
},
{
107U,
FLARE06.OT.A
},
{
108U,
FLARE06.OT.A
},
{
224U,
FLARE06.OT.A
},
{
210U,
FLARE06.OT.A
},
{
209U,
FLARE06.OT.A
},
{
109U,
FLARE06.OT.A
},
{
110U,
FLARE06.OT.A
},
{
65047U,
FLARE06.OT.A
},
{
112U,
FLARE06.OT.B
},
{
91U,
FLARE06.OT.A
},
{
92U,
FLARE06.OT.A
},
{
37U,
FLARE06.OT.A
},
{
65041U,
FLARE06.OT.A
},
{
220U,
FLARE06.OT.A
},
{
65048U,
FLARE06.OT.A
},
{
65045U,
FLARE06.OT.B
},
{
117U,
FLARE06.OT.B
},
{
39U,
FLARE06.OT.B
},
{
65033U,
FLARE06.OT.F
},
{
2U,
FLARE06.OT.A
},
{
3U,
FLARE06.OT.A
},
{
4U,
FLARE06.OT.A
},
{
5U,
FLARE06.OT.A
},
{
14U,
FLARE06.OT.E
},
{
65034U,
FLARE06.OT.F
},
{
15U,
FLARE06.OT.E
},
{
32U,
FLARE06.OT.G
},
{
22U,
FLARE06.OT.A
},
{
23U,
FLARE06.OT.A
},
{
24U,
FLARE06.OT.A
},
{
25U,
FLARE06.OT.A
},
{
26U,
FLARE06.OT.A
},
{
27U,
FLARE06.OT.A
},
{
28U,
FLARE06.OT.A
},
{
29U,
FLARE06.OT.A
},
{
30U,
FLARE06.OT.A
},
{
21U,
FLARE06.OT.A
},
{
31U,
FLARE06.OT.E
},
{
33U,
FLARE06.OT.H
},
{
34U,
FLARE06.OT.G
},
{
35U,
FLARE06.OT.H
},
{
163U,
FLARE06.OT.B
},
{
151U,
FLARE06.OT.A
},
{
144U,
FLARE06.OT.A
},
{
146U,
FLARE06.OT.A
},
{
148U,
FLARE06.OT.A
},
{
150U,
FLARE06.OT.A
},
{
152U,
FLARE06.OT.A
},
{
153U,
FLARE06.OT.A
},
{
154U,
FLARE06.OT.A
},
{
145U,
FLARE06.OT.A
},
{
147U,
FLARE06.OT.A
},
{
149U,
FLARE06.OT.A
},
{
143U,
FLARE06.OT.B
},
{
123U,
FLARE06.OT.B
},
{
124U,
FLARE06.OT.B
},
{
65030U,
FLARE06.OT.B
},
{
77U,
FLARE06.OT.A
},
{
70U,
FLARE06.OT.A
},
{
72U,
FLARE06.OT.A
},
{
74U,
FLARE06.OT.A
},
{
76U,
FLARE06.OT.A
},
{
78U,
FLARE06.OT.A
},
{
79U,
FLARE06.OT.A
},
{
80U,
FLARE06.OT.A
},
{
71U,
FLARE06.OT.A
},
{
73U,
FLARE06.OT.A
},
{
75U,
FLARE06.OT.A
},
{
142U,
FLARE06.OT.A
},
{
65036U,
FLARE06.OT.F
},
{
6U,
FLARE06.OT.A
},
{
7U,
FLARE06.OT.A
},
{
8U,
FLARE06.OT.A
},
{
9U,
FLARE06.OT.A
},
{
17U,
FLARE06.OT.E
},
{
65037U,
FLARE06.OT.F
},
{
18U,
FLARE06.OT.E
},
{
20U,
FLARE06.OT.A
},
{
113U,
FLARE06.OT.B
},
{
126U,
FLARE06.OT.B
},
{
127U,
FLARE06.OT.B
},
{
114U,
FLARE06.OT.B
},
{
208U,
FLARE06.OT.B
},
{
65031U,
FLARE06.OT.B
},
{
221U,
FLARE06.OT.D
},
{
222U,
FLARE06.OT.C
},
{
65039U,
FLARE06.OT.A
},
{
198U,
FLARE06.OT.B
},
{
90U,
FLARE06.OT.A
},
{
216U,
FLARE06.OT.A
},
{
217U,
FLARE06.OT.A
},
{
101U,
FLARE06.OT.A
},
{
141U,
FLARE06.OT.B
},
{
115U,
FLARE06.OT.B
},
{
65049U,
FLARE06.OT.E
},
{
0U,
FLARE06.OT.A
},
{
102U,
FLARE06.OT.A
},
{
96U,
FLARE06.OT.A
},
{
38U,
FLARE06.OT.A
},
{
254U,
FLARE06.OT.A
},
{
253U,
FLARE06.OT.A
},
{
252U,
FLARE06.OT.A
},
{
251U,
FLARE06.OT.A
},
{
250U,
FLARE06.OT.A
},
{
249U,
FLARE06.OT.A
},
{
248U,
FLARE06.OT.A
},
{
255U,
FLARE06.OT.A
},
{
65054U,
FLARE06.OT.A
},
{
65053U,
FLARE06.OT.A
},
{
194U,
FLARE06.OT.B
},
{
93U,
FLARE06.OT.A
},
{
94U,
FLARE06.OT.A
},
{
42U,
FLARE06.OT.A
},
{
65050U,
FLARE06.OT.A
},
{
98U,
FLARE06.OT.A
},
{
99U,
FLARE06.OT.A
},
{
100U,
FLARE06.OT.A
},
{
65052U,
FLARE06.OT.B
},
{
65035U,
FLARE06.OT.F
},
{
16U,
FLARE06.OT.E
},
{
164U,
FLARE06.OT.B
},
{
155U,
FLARE06.OT.A
},
{
156U,
FLARE06.OT.A
},
{
157U,
FLARE06.OT.A
},
{
158U,
FLARE06.OT.A
},
{
159U,
FLARE06.OT.A
},
{
160U,
FLARE06.OT.A
},
{
161U,
FLARE06.OT.A
},
{
162U,
FLARE06.OT.A
},
{
125U,
FLARE06.OT.B
},
{
223U,
FLARE06.OT.A
},
{
82U,
FLARE06.OT.A
},
{
83U,
FLARE06.OT.A
},
{
84U,
FLARE06.OT.A
},
{
85U,
FLARE06.OT.A
},
{
86U,
FLARE06.OT.A
},
{
87U,
FLARE06.OT.A
},
{
81U,
FLARE06.OT.A
},
{
65038U,
FLARE06.OT.F
},
{
10U,
FLARE06.OT.A
},
{
11U,
FLARE06.OT.A
},
{
12U,
FLARE06.OT.A
},
{
13U,
FLARE06.OT.A
},
{
19U,
FLARE06.OT.E
},
{
129U,
FLARE06.OT.B
},
{
128U,
FLARE06.OT.B
},
{
89U,
FLARE06.OT.A
},
{
218U,
FLARE06.OT.A
},
{
219U,
FLARE06.OT.A
},
{
69U,
FLARE06.OT.I
},
{
65044U,
FLARE06.OT.A
},
{
122U,
FLARE06.OT.A
},
{
65042U,
FLARE06.OT.E
},
{
121U,
FLARE06.OT.B
},
{
165U,
FLARE06.OT.B
},
{
65043U,
FLARE06.OT.A
},
{
97U,
FLARE06.OT.A
}
};
Module module = typeof(Program).Module;
MethodBase methodBase = module.ResolveMethod(tk);
MethodInfo methodInfo = (MethodInfo)methodBase;
ParameterInfo[] parameters = methodInfo.GetParameters();
Type[] array = new Type[parameters.Length];
SignatureHelper localVarSigHelper = SignatureHelper.GetLocalVarSigHelper();
for (int i = 0; i < array.Length; i++)
{
array[i] = parameters[i].ParameterType;
}
Type declaringType = methodBase.DeclaringType;
DynamicMethod dynamicMethod = new DynamicMethod("", methodInfo.ReturnType, array, declaringType, true);
DynamicILInfo dynamicILInfo = dynamicMethod.GetDynamicILInfo();
MethodBody methodBody = methodInfo.GetMethodBody();
foreach (LocalVariableInfo localVariableInfo in methodBody.LocalVariables)
{
localVarSigHelper.AddArgument(localVariableInfo.LocalType);
}
byte[] signature = localVarSigHelper.GetSignature();
dynamicILInfo.SetLocalSignature(signature);
int j = 0;
while (j < b.Length)
{
bool flag = b[j] == 254;
uint key;
if (flag)
{
key = 65024U + (uint)b[j + 1];
j++;
}
else
{
key = (uint)b[j];
}
FLARE06.OT ot = dictionary[key];
j++;
switch (ot)
{
case FLARE06.OT.B:
{
uint num = (uint)FLARE15.flare_68(b, j);
num ^= 2727913149U;
bool flag2 = num >= 1879048192U && num < 1879113727U;
int tokenFor;
if (flag2)
{
tokenFor = dynamicILInfo.GetTokenFor(module.ResolveString((int)num));
}
else
{
Type declaringType2 = methodInfo.DeclaringType;
Type[] genericTypeArguments = null;
Type[] genericMethodArguments = null;
bool flag3 = declaringType2.IsGenericType || declaringType2.IsGenericTypeDefinition;
if (flag3)
{
genericTypeArguments = declaringType2.GetGenericArguments();
}
bool flag4 = methodInfo.IsGenericMethod || methodInfo.IsGenericMethodDefinition;
if (flag4)
{
genericMethodArguments = methodInfo.GetGenericArguments();
}
MemberInfo memberInfo = declaringType2.Module.ResolveMember((int)num, genericTypeArguments, genericMethodArguments);
bool flag5 = memberInfo.GetType().Name == "RtFieldInfo";
if (flag5)
{
tokenFor = dynamicILInfo.GetTokenFor(((FieldInfo)memberInfo).FieldHandle, ((TypeInfo)((FieldInfo)memberInfo).DeclaringType).TypeHandle);
}
else
{
bool flag6 = memberInfo.GetType().Name == "RuntimeType";
if (flag6)
{
tokenFor = dynamicILInfo.GetTokenFor(((TypeInfo)memberInfo).TypeHandle);
}
else
{
bool flag7 = memberInfo.Name == ".ctor" || memberInfo.Name == ".cctor";
if (flag7)
{
tokenFor = dynamicILInfo.GetTokenFor(((ConstructorInfo)memberInfo).MethodHandle, ((TypeInfo)((ConstructorInfo)memberInfo).DeclaringType).TypeHandle);
}
else
{
tokenFor = dynamicILInfo.GetTokenFor(((MethodInfo)memberInfo).MethodHandle, ((TypeInfo)((MethodInfo)memberInfo).DeclaringType).TypeHandle);
}
}
}
}
b[j] = (byte)tokenFor;
b[j + 1] = (byte)(tokenFor >> 8);
b[j + 2] = (byte)(tokenFor >> 16);
b[j + 3] = (byte)(tokenFor >> 24);
j += 4;
break;
}
case FLARE06.OT.C:
case FLARE06.OT.E:
j++;
break;
case FLARE06.OT.D:
case FLARE06.OT.G:
j += 4;
break;
case FLARE06.OT.F:
j += 2;
break;
case FLARE06.OT.H:
j += 8;
break;
case FLARE06.OT.I:
j += 4 + FLARE15.flare_68(b, j) * 4;
break;
}
}
dynamicILInfo.SetCode(b, methodBody.MaxStackSize);
return dynamicMethod.Invoke(null, a);
}
Raw
map_tokens.cs
static Dictionary<int, int> createMapOfTokens(string tokensFile)
{
string tokenStr = "Token: ";
string offsetStr = "File Offset: ";
string sepStr = " RID:";
var tokenToOffset = new Dictionary<int, int>();
foreach (string line in System.IO.File.ReadLines(tokensFile))
{
int tokenStart = line.IndexOf(tokenStr);
int sep = line.IndexOf(sepStr);
int offsetStart = line.IndexOf(offsetStr);
int len = sep - (tokenStart + tokenStr.Length);
string tokenPart = line.Substring(tokenStart + tokenStr.Length, len);
string offsetPart = line.Substring(offsetStart + offsetStr.Length);
int tokenVal = Convert.ToInt32(tokenPart, 16);
int offsetVal = Convert.ToInt32(offsetPart, 16);
Console.WriteLine(System.String.Format(@"Adding: '{0}' '{1:X}'", tokenPart, offsetVal));
tokenToOffset[tokenVal] = offsetVal;
}
return tokenToOffset;
};
Raw
snippet1.cs
Assembly a = Assembly.LoadFrom(fileToPatch);
Module[] m = a.Modules.ToArray();
if (m.Length == 0) return false;
Module module = m[0];
Type[] tArray = module.FindTypes(Module.FilterTypeName, "*");
int notFound = 0;
foreach (Type t in tArray)
{
foreach (MethodInfo mi in t.GetMethods())
{
var metadataToken = mi.MetadataToken;
string name = mi.Name;
if (!mi.IsStatic) { continue; }
if (!name.StartsWith("flared_")) { continue; }
// Do the stuff
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment