dotscope 0.6.0

A high-performance, cross-platform framework for analyzing and reverse engineering .NET PE executables
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86

//! Deobfuscation result types.
//!
//! This module contains the [`DeobfuscationResult`] struct which encapsulates
//! the outcome of running the deobfuscation engine on an assembly.

use std::time::Duration;

use crate::{
    compiler::{DerivedStats, EventLog},
    deobfuscation::findings::DeobfuscationFindings,
};

/// Result of running deobfuscation.
///
/// Contains the event log capturing all activity during deobfuscation,
/// and the findings describing what was detected. Statistics are
/// derived from the event log on demand.
///
/// # Example
///
/// ```rust,ignore
/// use dotscope::deobfuscation::{DeobfuscationEngine, EngineConfig};
///
/// let engine = DeobfuscationEngine::new(EngineConfig::default());
/// let result = engine.process_file(&mut assembly)?;
///
/// println!("Detection: {}", result.findings.detection_summary());
/// println!("Events: {}", result.events.len());
/// println!("Stats: {}", result.stats().summary());
/// ```
#[derive(Debug, Clone)]
pub struct DeobfuscationResult {
    /// All events from the deobfuscation run.
    pub events: EventLog,
    /// Framework-level findings from detection and deobfuscation.
    pub findings: DeobfuscationFindings,
    /// Number of pass iterations.
    pub iterations: usize,
    /// Total processing time.
    pub total_time: Duration,
}

impl DeobfuscationResult {
    /// Creates a new deobfuscation result.
    #[must_use]
    pub fn new(events: EventLog, findings: DeobfuscationFindings) -> Self {
        Self {
            events,
            findings,
            iterations: 0,
            total_time: Duration::ZERO,
        }
    }

    /// Sets timing and iteration info.
    #[must_use]
    pub fn with_timing(mut self, time: Duration, iterations: usize) -> Self {
        self.total_time = time;
        self.iterations = iterations;
        self
    }

    /// Computes statistics derived from the event log.
    #[must_use]
    pub fn stats(&self) -> DerivedStats {
        DerivedStats::from_log(&self.events)
            .with_time(self.total_time)
            .with_iterations(self.iterations)
    }

    /// Generates a human-readable summary of the deobfuscation results.
    #[must_use]
    pub fn summary(&self) -> String {
        self.stats().summary()
    }

    /// Generates a detailed multi-line summary including detection info.
    #[must_use]
    pub fn detailed_summary(&self) -> String {
        format!(
            "Deobfuscation complete: {}\nDetection: {}",
            self.stats().summary(),
            self.findings.detection_summary()
        )
    }
}