[a.ahmed]

PHP كود :

using System;
using System.Text;
using System.IO;
using dnlib.DotNet;
using dnlib.DotNet.Emit;

namespace DumpStrings
{
    class Program
    {
        static void Main(string[] args)
        {
            if (args.Length == 0)
            {
                Console.WriteLine("args not found");
                Console.ReadKey();
                return;
            }
            else
            {
                try
                {
                    // Last args part is our path, maybe I'll add some - options in future...
                    var ExePath = args[args.Length - 1];
                    if (!File.Exists(ExePath))
                    {
                        Console.WriteLine("File doesn't exist!\nPath => {0}", ExePath);
                        return;
                    }

                    string OutputPath = ExePath.Substring(0, ExePath.Length - 4) + ".txt";

                    if (File.Exists(OutputPath))
                        File.Delete(OutputPath);

                    var UTFEncoder = new UTF8Encoding(true);

                    using (FileStream fs = File.Create(OutputPath))
                    {
                        ModuleDefMD Module = ModuleDefMD.Load(ExePath);

                        foreach (TypeDef Type in Module.GetTypes())
                        {
                            foreach (MethodDef Method in Type.Methods)
                            {
                                if (!Method.HasBody)
                                    continue;

                                foreach (Instruction Instr in Method.Body.Instructions)
                                {
                                    if (Instr.OpCode == OpCodes.Ldstr)
                                    {
                                        // (string)Instr.Operand <= this holds string "value"
                                        //var String = "[{Type.Name}.{Method.Name}] {(string)Instr.Operand}{Environment.NewLine}";
                                        var String = "[" + Type.Name + "." + Method.Name + "] " + (string)Instr.Operand + Environment.NewLine;
                                        string ch = Base64Decode((string)Instr.Operand);
                                        if (ch != null)
                                        {
                                            String += "Decode Base64: " + (string)Instr.Operand + Environment.NewLine;
                                            String += ch + Environment.NewLine + Environment.NewLine;
                                        }
                                        //Console.WriteLine("[{0}.{1}] {2}{3}", Type.Name, Method.Name, (string)Instr.Operand, Environment.NewLine);
                                        Console.WriteLine(String);

                                        byte[] Bytes = UTFEncoder.GetBytes(String);
                                        fs.Write(Bytes, 0, Bytes.Length);
                                    }
                                }
                            }
                        }
                    }
                }
                catch (Exception ex)
                {
                    Console.WriteLine("Exception: {0}", ex.Message);
                    Console.ReadKey();
                }
            }
        }

        public static string Base64Decode(string base64EncodedData)
        {
            try
            {
                foreach (char c in base64EncodedData)
                    if (!"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+= ".Trim().Contains(c.ToString())) return null;
                var base64EncodedBytes = System.Convert.FromBase64String(base64EncodedData);
                return System.Text.Encoding.UTF8.GetString(base64EncodedBytes);
            }
            catch (Exception ex) { return null; }
        }

    }
}