chizui/Il2CppInspectorRedux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ELF: Dramatically speed up processing of XOR encryption

Browse Source
This commit is contained in:
Katy Coe
2020-09-14 12:29:31 +02:00
parent a6c693d771
commit 2543e1ad77
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
Il2CppInspector.Common/FileFormatReaders/ElfReader.cs
View File

@@ -280,7 +280,7 @@ namespace Il2CppInspector
if (getDynamic(Elf.DT_INIT) != null && sectionByName.ContainsKey(".rodata")) { if (getDynamic(Elf.DT_INIT) != null && sectionByName.ContainsKey(".rodata")) {
// Use the data section to determine IF the file is obfuscated // Use the data section to determine IF the file is obfuscated
var rodataFirstBytes = ReadArray<byte>(conv.Long(sectionByName[".rodata"].sh_offset), 256); var rodataFirstBytes = ReadBytes(conv.Long(sectionByName[".rodata"].sh_offset), 256);
var xorKeyCandidate = rodataFirstBytes.GroupBy(b => b).OrderByDescending(f => f.Count()).First().Key; var xorKeyCandidate = rodataFirstBytes.GroupBy(b => b).OrderByDescending(f => f.Count()).First().Key;
// We examine the bottom nibble of the 2nd byte and top nibble of 4th byte // We examine the bottom nibble of the 2nd byte and top nibble of 4th byte
@@ -303,7 +303,7 @@ namespace Il2CppInspector
// We have seen several examples (eg. #14 and #26) where most of the file is zeroed // We have seen several examples (eg. #14 and #26) where most of the file is zeroed
// and packed data is found in the latter third. So far these files always have zeroed .rodata sections // and packed data is found in the latter third. So far these files always have zeroed .rodata sections
if (sectionByName.ContainsKey(".rodata")) { if (sectionByName.ContainsKey(".rodata")) {
var rodataBytes = ReadArray<byte>(conv.Long(sectionByName[".rodata"].sh_offset), conv.Int(sectionByName[".rodata"].sh_size)); var rodataBytes = ReadBytes(conv.Long(sectionByName[".rodata"].sh_offset), conv.Int(sectionByName[".rodata"].sh_size));
if (rodataBytes.All(b => b == 0x00)) if (rodataBytes.All(b => b == 0x00))
throw new InvalidOperationException("This IL2CPP binary is packed in a way not currently supported by Il2CppInspector and cannot be loaded."); throw new InvalidOperationException("This IL2CPP binary is packed in a way not currently supported by Il2CppInspector and cannot be loaded.");
} }
@@ -317,7 +317,7 @@ namespace Il2CppInspector
private void xorRange(int offset, int length, byte xorValue) { private void xorRange(int offset, int length, byte xorValue) {
using var writer = new BinaryWriter(BaseStream, Encoding.Default, true); using var writer = new BinaryWriter(BaseStream, Encoding.Default, true);
var bytes = ReadArray<byte>(offset, length); var bytes = ReadBytes(offset, length);
bytes = bytes.Select(b => (byte) (b ^ xorValue)).ToArray(); bytes = bytes.Select(b => (byte) (b ^ xorValue)).ToArray();
writer.Seek(offset, SeekOrigin.Begin); writer.Seek(offset, SeekOrigin.Begin);
writer.Write(bytes); writer.Write(bytes);