Skip to content

Commit c628462

Browse files
DosX-devDosX-dev
committed
Update __GenericHeuristicAnalysis_By_DosX.7.sg
1 parent 3f96244 commit c628462

File tree

1 file changed

+90
-90
lines changed

1 file changed

+90
-90
lines changed

Diff for: ‎db/PE/__GenericHeuristicAnalysis_By_DosX.7.sg

+90-90
Original file line numberDiff line numberDiff line change
@@ -62,12 +62,12 @@
6262
// Please do not read the code out loud unless you have exorcism skills
6363

6464
const logType = {
65-
warning: -2,
66-
about: -1,
67-
nothing: 0,
68-
any: 1,
69-
net: 2
70-
},
65+
warning: -2,
66+
about: -1,
67+
nothing: 0,
68+
any: 1,
69+
net: 2
70+
},
7171
heurLabel = "HEUR";
7272

7373
var lastOffsetDetected = "0x00";
@@ -178,11 +178,11 @@ function scanForObfuscations_NET() {
178178
var isEntryPointModified = false;
179179

180180
const vbNetEntries = [
181-
"Main",
182-
"main",
183-
"MAIN",
184-
"MyApplication"
185-
],
181+
"Main",
182+
"main",
183+
"MAIN",
184+
"MyApplication"
185+
],
186186
defaultEntries = [ // like MSIL, C#, C++ NET etc
187187
"Main",
188188
"main", // F# entry
@@ -348,9 +348,9 @@ function scanForObfuscations_NET() {
348348

349349
if (validateNetByteCode(intConfusionXorPattern)) {
350350
if (validateNetByteCode( // samples by: Inx Obfuscator
351-
intConfusionXorPattern +
352-
(opCodes.bne_un_s + opCodes.ldc_i4_2 + opCodes.stloc_0 + opCodes.sizeof + opCodes.add)
353-
) ||
351+
intConfusionXorPattern +
352+
(opCodes.bne_un_s + opCodes.ldc_i4_2 + opCodes.stloc_0 + opCodes.sizeof + opCodes.add)
353+
) ||
354354
validateNetByteCode( // samples by: MindLated, NetShield
355355
intConfusionXorPattern +
356356
(opCodes.bne_un + opCodes.ldc_i4 + opCodes.stloc + opCodes.sizeof + opCodes.add)
@@ -455,9 +455,9 @@ function scanForObfuscations_NET() {
455455
var isCalliInvokesPresent = false;
456456

457457
if (validateNetByteCode( // samples by: MindLated
458-
opCodes.setStrict(opCodes.ldftn, "** ?? 00 0A") +
459-
opCodes.setStrict(opCodes.calli, "** 00 00 11")
460-
) ||
458+
opCodes.setStrict(opCodes.ldftn, "** ?? 00 0A") +
459+
opCodes.setStrict(opCodes.calli, "** 00 00 11")
460+
) ||
461461
validateNetByteCode( // samples by: ArmDot, DarksProtector
462462
opCodes.idelem_i +
463463
opCodes.setStrict(opCodes.calli, "** 00 00 11")
@@ -474,8 +474,8 @@ function scanForObfuscations_NET() {
474474
var isLdftnPointersPresent = false;
475475

476476
if (validateNetByteCode(
477-
opCodes.nop + opCodes.setStrict(opCodes.ldftn, "** 00 00 06") + opCodes.stelem_i
478-
) ||
477+
opCodes.nop + opCodes.setStrict(opCodes.ldftn, "** 00 00 06") + opCodes.stelem_i
478+
) ||
479479
validateNetByteCode(
480480
opCodes.nop + opCodes.setStrict(opCodes.ldftn, "** 00 00 0A") + opCodes.stelem_i
481481
) ||
@@ -497,9 +497,9 @@ function scanForObfuscations_NET() {
497497
var isCtrlFlowPresent = false;
498498

499499
if (validateNetByteCode( // samples by: ConfuserEx
500-
opCodes.nop + opCodes.ldloc_0 + opCodes.ldc_i4 + opCodes.mul + opCodes.ldc_i4 + opCodes.xor + opCodes.br_s +
501-
opCodes.nop + opCodes.ldloc_0 + opCodes.ldc_i4 + opCodes.mul + opCodes.ldc_i4 + opCodes.xor + opCodes.br_s
502-
) ||
500+
opCodes.nop + opCodes.ldloc_0 + opCodes.ldc_i4 + opCodes.mul + opCodes.ldc_i4 + opCodes.xor + opCodes.br_s +
501+
opCodes.nop + opCodes.ldloc_0 + opCodes.ldc_i4 + opCodes.mul + opCodes.ldc_i4 + opCodes.xor + opCodes.br_s
502+
) ||
503503
validateNetByteCode( // samples by: ConfuserEx (neo mod)
504504
opCodes.ldc_i4 + opCodes.ldc_i4 + opCodes.xor + opCodes.dup + opCodes.stloc_0 + opCodes.ldc_i4_3 + opCodes.rem_un + opCodes.switch__nobody
505505
) ||
@@ -767,32 +767,32 @@ function scanForObfuscations_NET() {
767767
var isMathInversionsPresent = false;
768768

769769
if (validateNetByteCode(opCodes.ldc_i4 + opCodes.not) && (
770-
validateNetByteCode( // ~(-(~(-(~(-(~(-( num ))))))))
771-
opCodes.ldc_i4 +
772-
opCodes.not + opCodes.neg + opCodes.not + opCodes.neg +
773-
opCodes.not + opCodes.neg + opCodes.not + opCodes.neg
774-
) ||
775-
validateNetByteCode( // ~(~(-(-(~(~( num ))))))
776-
opCodes.ldc_i4 +
777-
opCodes.not + opCodes.not + opCodes.neg + opCodes.neg +
778-
opCodes.not + opCodes.not
779-
) ||
780-
validateNetByteCode( // ~(-(~(~(-(-( num ))))))
781-
opCodes.ldc_i4 +
782-
opCodes.not + opCodes.neg + opCodes.not + opCodes.not +
783-
opCodes.neg + opCodes.neg
784-
) ||
785-
validateNetByteCode( // ~(-(~(-(~(~( num ))))))
786-
opCodes.ldc_i4 +
787-
opCodes.not + opCodes.neg + opCodes.not + opCodes.neg +
788-
opCodes.not + opCodes.not
789-
) ||
790-
validateNetByteCode( // ~(-(~(-(~(-( num ))))))
791-
opCodes.ldc_i4 +
792-
opCodes.not + opCodes.neg + opCodes.not + opCodes.neg +
793-
opCodes.not + opCodes.neg
794-
)
795-
)) {
770+
validateNetByteCode( // ~(-(~(-(~(-(~(-( num ))))))))
771+
opCodes.ldc_i4 +
772+
opCodes.not + opCodes.neg + opCodes.not + opCodes.neg +
773+
opCodes.not + opCodes.neg + opCodes.not + opCodes.neg
774+
) ||
775+
validateNetByteCode( // ~(~(-(-(~(~( num ))))))
776+
opCodes.ldc_i4 +
777+
opCodes.not + opCodes.not + opCodes.neg + opCodes.neg +
778+
opCodes.not + opCodes.not
779+
) ||
780+
validateNetByteCode( // ~(-(~(~(-(-( num ))))))
781+
opCodes.ldc_i4 +
782+
opCodes.not + opCodes.neg + opCodes.not + opCodes.not +
783+
opCodes.neg + opCodes.neg
784+
) ||
785+
validateNetByteCode( // ~(-(~(-(~(~( num ))))))
786+
opCodes.ldc_i4 +
787+
opCodes.not + opCodes.neg + opCodes.not + opCodes.neg +
788+
opCodes.not + opCodes.not
789+
) ||
790+
validateNetByteCode( // ~(-(~(-(~(-( num ))))))
791+
opCodes.ldc_i4 +
792+
opCodes.not + opCodes.neg + opCodes.not + opCodes.neg +
793+
opCodes.not + opCodes.neg
794+
)
795+
)) {
796796
log(logType.net, "Math inversions detected, offset " + lastOffsetDetected);
797797
isMathInversionsPresent = true;
798798
}
@@ -923,12 +923,12 @@ function scanForObfuscations_NET() {
923923
}
924924

925925
if ((!isWatermarkPresent && (
926-
validateSignature("'Obfuscated'") ||
927-
validateSignature("'obfuscated'") ||
928-
validateSignature("'ByAttribute'") ||
929-
validateSignature("'ObfuscatorAttribute'") ||
930-
validateNetObject("ObfuscationAttribute")
931-
)) && !isFrameworkComponent()) // System.Reflection.ObfuscationAttribute
926+
validateSignature("'Obfuscated'") ||
927+
validateSignature("'obfuscated'") ||
928+
validateSignature("'ByAttribute'") ||
929+
validateSignature("'ObfuscatorAttribute'") ||
930+
validateNetObject("ObfuscationAttribute")
931+
)) && !isFrameworkComponent()) // System.Reflection.ObfuscationAttribute
932932
{
933933
isWatermarkPresent = true;
934934
}
@@ -940,23 +940,23 @@ function scanForObfuscations_NET() {
940940

941941

942942
const protectorsLabelsToRemove = [ // Protectors with these names will be removed from results
943-
"SafeNet Sentinel LDK .NET",
944-
"Xenocode Postbuild",
945-
"Smart Assembly",
946-
"Dotfuscator",
947-
"Babel .NET",
948-
"Spices.Net",
949-
"Maxtocode",
950-
"FISH .NET",
951-
"CliSecure",
952-
"CodeWall",
953-
"CodeVeil",
954-
"Sixxpack",
955-
"DNGuard",
956-
"Goliath",
957-
"Agile",
958-
"Yano"
959-
],
943+
"SafeNet Sentinel LDK .NET",
944+
"Xenocode Postbuild",
945+
"Smart Assembly",
946+
"Dotfuscator",
947+
"Babel .NET",
948+
"Spices.Net",
949+
"Maxtocode",
950+
"FISH .NET",
951+
"CliSecure",
952+
"CodeWall",
953+
"CodeVeil",
954+
"Sixxpack",
955+
"DNGuard",
956+
"Goliath",
957+
"Agile",
958+
"Yano"
959+
],
960960
packersLabelsToRemove = [
961961
"ChainskiCrypter",
962962
"Quest PowerGUI",
@@ -1269,7 +1269,7 @@ function NetOpCodes() {
12691269

12701270
// setStrict sets the strict value of the opcode for substitution
12711271
// btw I like what I do
1272-
this.setStrict = function(opCodeMask, value) {
1272+
this.setStrict = function (opCodeMask, value) {
12731273
// Remove spaces from opcode mask and value
12741274
opCodeMask = removeSpaces(opCodeMask);
12751275
value = removeSpaces(value);
@@ -1293,7 +1293,7 @@ function NetOpCodes() {
12931293
}
12941294

12951295
// Sets the mask value to zero for the specified opcode
1296-
this.setNullValue = function(opCodeMask) {
1296+
this.setNullValue = function (opCodeMask) {
12971297

12981298
if (opCodeMask.indexOf("??") === -1) {
12991299
_error("Instruction does not have a body to overwrite the value.");
@@ -1362,14 +1362,14 @@ function scanForPackersAndCryptors_NET_and_Native() { // For .NET and Native app
13621362
var isAssemblyInvokeFound = false;
13631363

13641364
if (isAllNetReferencesPresent( // TODO: update [!!!]
1365-
references = [
1366-
"System.Reflection", // System.Reflection.dll
1367-
"get_EntryPoint", // MSIL: '*.Assembly::get_EntryPoint()'
1368-
"Assembly", // MSIL: 'System.Reflection.Assembly' from System.Reflection.dll
1369-
"Invoke", // MSIL: '*.MethodBase::Invoke(object, object[])'
1370-
"Load" // MSIL: '*.Assembly::Load(uint8[])'
1371-
]
1372-
)) {
1365+
references = [
1366+
"System.Reflection", // System.Reflection.dll
1367+
"get_EntryPoint", // MSIL: '*.Assembly::get_EntryPoint()'
1368+
"Assembly", // MSIL: 'System.Reflection.Assembly' from System.Reflection.dll
1369+
"Invoke", // MSIL: '*.MethodBase::Invoke(object, object[])'
1370+
"Load" // MSIL: '*.Assembly::Load(uint8[])'
1371+
]
1372+
)) {
13731373
isAssemblyInvokeFound = true;
13741374

13751375
options = "Assembly invoke";
@@ -2515,8 +2515,8 @@ function isAllNetReferencesPresent(references) {
25152515
*/
25162516
function findAndMark(sign, isFullName) {
25172517
if (PE.isSignatureInSectionPresent(0,
2518-
("00'" + sign + "'") + // 00'string
2519-
(isFullName ? "00" : String()))) { // ... '00
2518+
("00'" + sign + "'") + // 00'string
2519+
(isFullName ? "00" : String()))) { // ... '00
25202520
return sign;
25212521
}
25222522
return String();
@@ -2727,9 +2727,9 @@ function scanForObfuscations_Native() {
27272727
var exeAsDll = false;
27282728

27292729
if (PE.isDll() && (
2730-
PE.isExportFunctionPresent("Start") ||
2731-
PE.isExportFunctionPresent("main") ||
2732-
PE.isExportFunctionPresent("_start"))) {
2730+
PE.isExportFunctionPresent("Start") ||
2731+
PE.isExportFunctionPresent("main") ||
2732+
PE.isExportFunctionPresent("_start"))) {
27332733
exeAsDll = true;
27342734
}
27352735

@@ -2877,8 +2877,8 @@ function getEpAsmPattern(onlyOpCodes, numberOf) {
28772877
// Append either the opcode or the full instruction to the result
28782878
result += (
28792879
onlyOpCodes ?
2880-
getAsmOpCode(asmInstruction) : // "MOV"
2881-
asmInstruction // "MOV EAX, 4"
2880+
getAsmOpCode(asmInstruction) : // "MOV"
2881+
asmInstruction // "MOV EAX, 4"
28822882
) + _patternSplitter;
28832883
}
28842884

@@ -2937,8 +2937,8 @@ function getInstructionsAsmPattern(instruction) {
29372937
return _patternSplitter +
29382938
(
29392939
Array.isArray(instruction) ?
2940-
instruction.join(_patternSplitter) :
2941-
instruction
2940+
instruction.join(_patternSplitter) :
2941+
instruction
29422942
) +
29432943
_patternSplitter;
29442944
}

0 commit comments

Comments
 (0)