using System;
using System.Collections;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using System.Diagnostics;
using System.IO;
using Microsoft.Win32;
using System.Xml;
namespace deprotect
{
public partial class MainForm : Form
{
public MainForm()
{
InitializeComponent();
}
private void openAssembly_LinkClicked(object sender, LinkLabelLinkClickedEventArgs e)
{
openFileDialog.FileName = "*.exe";
openFileDialog.Filter = "Applications | *.exe";
if (openFileDialog.ShowDialog() == DialogResult.OK
&& openFileDialog.CheckFileExists)
{
this.exeFile.Text = openFileDialog.FileName;
this.launch.Enabled = true;
}
}
private void workdir_LinkClicked(object sender, LinkLabelLinkClickedEventArgs e)
{
if (folderBrowserDialog.ShowDialog() == DialogResult.OK)
{
this.workdir.Text = folderBrowserDialog.SelectedPath;
}
}
private void exeFile_TextChanged(object sender, EventArgs e)
{
this.launch.Enabled = true;
}
// the result xml file created by the decryption process
string resultXMLFile = null;
// the directory that files are dumped
string dumpDir = null;
private void launch_LinkClicked(object sender, LinkLabelLinkClickedEventArgs e)
{
DllRegister.Register();
ProcessStartInfo processStartInfo = new ProcessStartInfo(exeFile.Text);
processStartInfo.EnvironmentVariables["Cor_Enable_Profiling"] = "0x1";
processStartInfo.EnvironmentVariables["COR_PROFILER"] = "{DFFC737C-D0B1-4b86-A6FD-FDD998BEEB03}";
if (args.Text != null && args.Text != "")
processStartInfo.Arguments = args.Text;
if (workdir.Text != null && workdir.Text != "")
processStartInfo.WorkingDirectory = workdir.Text;
processStartInfo.UseShellExecute = false;
Process process = Process.Start(processStartInfo);
process.WaitForExit();
// find the result xml file, dumped\xxx.exe.xml
FileInfo fi = new FileInfo(exeFile.Text);
string dir;
if (workdir.Text != null && workdir.Text != "")
dir = workdir.Text;
else
dir = fi.DirectoryName;
dumpDir = dir + "\\dumped";
resultXMLFile = dumpDir + "\\" + fi.Name + ".xml";
this.results.Enabled = true;
}
private void exitToolStripMenuItem_Click(object sender, EventArgs e)
{
Application.Exit();
}
private void aboutToolStripMenuItem_Click(object sender, EventArgs e)
{
new AboutBox().ShowDialog();
}
private void onlineHelpToolStripMenuItem_Click(object sender, EventArgs e)
{
System.Diagnostics.Process.Start("http://www.remotesoft.com/deprotector/manual.html");
}
private void decyptionArticleToolStripMenuItem_Click(object sender, EventArgs e)
{
System.Diagnostics.Process.Start("http://www.remotesoft.com/deprotector/index.html");
}
// the .NET Explorer cmd we can invole to view all dumped modules
static string dotexplorer = null;
private void results_LinkClicked(object sender, LinkLabelLinkClickedEventArgs e)
{
// open the dump directory
if (dumpDir != null)
Process.Start(dumpDir);
// trying to find .NET Explorer
if (dotexplorer == null)
{
RegistryKey lm = Registry.LocalMachine;
RegistryKey sc = lm.OpenSubKey("Software\\Remotesoft\\DotExplorer");
if (sc != null)
{
dotexplorer = (string)sc.GetValue("InstallDir");
dotexplorer += "\\dotexplorer.exe";
sc.Close();
dotexplorerInstallLink.Visible = false;
dotexplorerInstallLink.Enabled = false;
}
else
{
MessageBox.Show("Remotesoft .NET Explorer is not installed.\nPlease click the link beside View results to download and install it.");
dotexplorerInstallLink.Visible = true;
dotexplorerInstallLink.Enabled = true;
return;
}
}
// find the result xml file
ArrayList dumpedFiles = new ArrayList();
ReadResultXML(dumpedFiles);
// invoke .NET Explorer to load all dumped files
string allfiles = "";
bool first = true;
foreach (string fn in dumpedFiles)
{
if (first)
first = false;
else
allfiles += ";";
allfiles += fn;
}
// launch .NET Explorer, load all dumped assemblies
ProcessStartInfo processStartInfo = new ProcessStartInfo(dotexplorer);
processStartInfo.Arguments = allfiles;
Process process = Process.Start(processStartInfo);
}
///
/// Read the result xml file
///
/*
*/
public void ReadResultXML(ArrayList dumpedFiles)
{
XmlTextReader reader = new XmlTextReader(resultXMLFile);
// Create an XmlDocument from the XmlTextReader
XmlDocument xmldoc = new XmlDocument();
xmldoc.Load(reader);
// Start from the document Element,
XmlElement root = xmldoc.DocumentElement;
XmlNode module_node = root.FirstChild;
while (module_node != null)
{
XmlNode node = module_node.FirstChild;
while (node != null)
{
if (node.Name.Equals("dump"))
{
string dumpfile = GetNodeValue(node);
dumpedFiles.Add(dumpfile);
break;
}
node = node.NextSibling;
}
module_node = module_node.NextSibling;
}
reader.Close();
}
private static string GetNodeValue(XmlNode node)
{
if (node.FirstChild != null)
return node.FirstChild.Value;
else
return "";
}
private void dotexplorerInstallLink_LinkClicked(object sender, LinkLabelLinkClickedEventArgs e)
{
System.Diagnostics.Process.Start("http://remotesoft.com/eval_download/Remotesoft_DOTNET_Explorer_Evaluation.msi");
}
}
}