Skip to content

Fix (Babel_NET): fix Decrypter4 AES key initialization and update MethodsDecrypter heuristics #48

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
meck-gd merged 3 commits into from
Oct 13, 2026
Merged

Fix (Babel_NET): fix Decrypter4 AES key initialization and update MethodsDecrypter heuristics #48

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c8129e0
Fix (babel): correct AES key buffer initialization in Decrypter4
Deltafox79 Oct 9, 2026
9836f8f
Fix (babel) : loosen type signature check in MethodsDecrypter
Deltafox79 Oct 9, 2026
325e789
Remove surplus whitespace
meck-gd Oct 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions de4dot.code/deobfuscators/Babel_NET/MethodsDecrypter.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,8 +45,7 @@ public MethodsDecrypter(ModuleDefMD module, ResourceDecrypter resourceDecrypter,

public void Find() {
var requiredFields = new string[] {
"System.Threading.ReaderWriterLock",
"System.Collections.Hashtable",
"System.Threading.ReaderWriterLock"
};
foreach (var type in module.GetTypes()) {
var fieldTypes = new FieldTypes(type);
Expand Down
16 changes: 11 additions & 5 deletions de4dot.code/deobfuscators/Babel_NET/ResourceDecrypter.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,6 +215,7 @@ public byte[] Decrypt(byte[] encryptedData) {
out var key,
out var flag,
out var cipherType);

bool isEncrypted = (flag & 2) != 0;
bool isCompressed = (flag & 1) != 0;

Expand All @@ -239,14 +240,16 @@ public byte[] Decrypt(byte[] encryptedData) {
return data;
}

byte[] GetHeaderData(byte[] encryptedData, ref int index, out byte[] iv) {
var headerData = new byte[BitConverter.ToUInt16(encryptedData, index)];
byte[] GetHeaderData(byte[] encryptedData, ref int index, out byte[] iv) {
var headerLength = BitConverter.ToUInt16(encryptedData, index);
var headerData = new byte[headerLength];
Array.Copy(encryptedData, index + 2, headerData, 0, headerData.Length);
index += headerData.Length + 2;

iv = new byte[encryptedData[index++]];
Array.Copy(encryptedData, index, iv, 0, iv.Length);
index += iv.Length;

for (int i = 0; i < headerData.Length; i++)
headerData[i] ^= iv[i % iv.Length];

Expand All @@ -260,15 +263,18 @@ void ParseHeader(byte[] headerData, out byte[] key, out byte flag, out byte ciph
flag = reader.ReadByte();
cipherType = reader.ReadByte();
byte pubKeyOffset = reader.ReadByte();
byte keyLength = reader.ReadByte();
key = new byte[keyLength];

key = reader.ReadBytes(reader.ReadByte());
if (pubKeyOffset < 64) {
reader.Read(key, 0, keyLength);
if (reader.BaseStream.Position < reader.BaseStream.Length)
throw new Exception("Expected end of header");
}
else {
Array.Copy(module.Assembly.PublicKey.Data, pubKeyOffset + 12, key, 0, key.Length);
//key[5] |= 0x80;
if (module.Assembly != null && module.Assembly.PublicKey != null && module.Assembly.PublicKey.Data != null) {
Array.Copy(module.Assembly.PublicKey.Data, pubKeyOffset + 12, key, 0, keyLength);
}
}
}
}
Expand Down
Loading