.Net零基础逆向教程 第十课（de4dot反混淆）

// DIE's signature file
init("protector", ".NET Reactor");
function detect(bShowType, bShowVersion, bShowOptions)
{
    if (PE.section[".reacto"])
    {
        if (PE.section[1].FileSize == 0 && PE.section[2].FileSize == 0 && PE.section[3].FileSize == 0)
        {
            sVersion = "2.0-2.1";
            bDetected = 1;
        }
    }
    else if (PE.compareEP("558becb90f0000006a006a004975f951535657b8........e8"))
    {
        sVersion = "2.X-3.X";
        bDetected = 1;
    }
    else if (PE.resource["__"] && PE.compareEP("e8$$$$$$$$8bff558bec83ec10"))
    {
        if (PE.compareEP("e8........e9........6a0c68"))
        {
            sVersion = "4.2";
            bDetected = 1;
        }
        else if (PE.compareEP("e8........e9........8bff558bec83ec208b45085657"))
        {
            sVersion = "4.5-4.7";
            bDetected = 1;
        }
    }
    else if (PE.isNET())
    {
        if (PE.isSignatureInSectionPresent(0, "558becb90f0000006a006a004975f951535657b8........e8"))
        {
            sVersion = "3.X";
            bDetected = 1;
        }
        else if (PE.section.length >= 2)
        {
            if (PE.section[1].Characteristics == 0xc0000040)
            {
                if (PE.isSignatureInSectionPresent(1, "5266686E204D182276B5331112330C6D0A204D18229EA129611C76B505190158"))
                {
                    sVersion = "4.8-4.9";
                    bDetected = 1;
                }
            }
        }
    }
    return result(bShowType, bShowVersion, bShowOptions);
}

"D:\Program Files (x86)\de4dot\de4dot\de4dot.exe" C:\Users\muruoxi\Desktop\EP10_Locked\Secured\EP10-cleaned.exe -d