From cf72870a99adf01675e94021caa13cba1ad0be3b Mon Sep 17 00:00:00 2001 From: Melissa Eckardt Date: Thu, 24 Sep 2026 16:17:41 +0200 Subject: [PATCH 1/2] Babel .NET: Add another double obfuscation guard --- de4dot.code/deobfuscators/Babel_NET/StringDecrypter.cs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/de4dot.code/deobfuscators/Babel_NET/StringDecrypter.cs b/de4dot.code/deobfuscators/Babel_NET/StringDecrypter.cs index 2319b98e..f583e639 100644 --- a/de4dot.code/deobfuscators/Babel_NET/StringDecrypter.cs +++ b/de4dot.code/deobfuscators/Babel_NET/StringDecrypter.cs @@ -247,6 +247,9 @@ IDecrypterInfo CheckNested(TypeDef type, TypeDef nested) { // Check for string,int variant with 3 nested fields and key length 16. // When .NET Reactor was applied on top, field count is +1 due to an extraneous object field. if (CheckFields(nested, "System.Byte[]", nested)) { + if (BabelUtils.IsChainedObfuscation(nested.FindMethod(".ctor"))) + return null; + var nestedDecrypter16 = DotNetUtils.GetMethod(nested, "System.String", "(System.String,System.Int32)"); if (nestedDecrypter16 is { IsStatic: false }) { var decrypter16 = DotNetUtils.GetMethod(type, "System.String", "(System.String,System.Int32)"); From bc8e9cc52fe7fd988efbe175f1e8cea2f1714b7d Mon Sep 17 00:00:00 2001 From: Melissa Eckardt Date: Thu, 24 Sep 2026 16:22:12 +0200 Subject: [PATCH 2/2] Babel .NET: Add missing MethodCallInliner emu opcodes --- .../deobfuscators/Babel_NET/BabelMethodCallInliner.cs | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/de4dot.code/deobfuscators/Babel_NET/BabelMethodCallInliner.cs b/de4dot.code/deobfuscators/Babel_NET/BabelMethodCallInliner.cs index 5b6fd453..9c27078a 100644 --- a/de4dot.code/deobfuscators/Babel_NET/BabelMethodCallInliner.cs +++ b/de4dot.code/deobfuscators/Babel_NET/BabelMethodCallInliner.cs @@ -116,8 +116,10 @@ bool InlineMethod(Instruction callInstr, int instrIndex) { if (!GetNewValue(methodToInline, ldci4.GetLdcI4Value(), out int newValue)) return false; - block.Instructions[instrIndex - 1] = new Instr(OpCodes.Nop.ToInstruction()); - block.Instructions[instrIndex] = new Instr(Instruction.CreateLdcI4(newValue)); + block.Instructions[instrIndex - 1].Instruction.OpCode = OpCodes.Nop; + var newLdc = Instruction.CreateLdcI4(newValue); + block.Instructions[instrIndex].Instruction.OpCode = newLdc.OpCode; + block.Instructions[instrIndex].Instruction.Operand = newLdc.Operand; return true; } @@ -171,6 +173,10 @@ bool GetNewValue(MethodDef method, int arg, out int newValue) { case Code.Sub: case Code.Xor: case Code.Or: + case Code.Shl: + case Code.Shr: + case Code.Neg: + case Code.Not: case Code.Nop: case Code.Dup: case Code.Mul: