public void ReferenceReplace(MethodDef method)
{
method.Body.SimplifyBranches();
if (Keys.ContainsKey(method.RVA))
{
List <Tuple <int, int, int> > keys = Keys[method.RVA];
keys.Reverse();
foreach (Tuple <int, int, int> v in keys)
{
// Experimental renamer
method.Body.Instructions[v.Item1].Operand = Renamer.GetRandomName();
method.Body.Instructions.Insert(v.Item1 + 1, new Instruction(OpCodes.Ldc_I4, v.Item2));
method.Body.Instructions.Insert(v.Item1 + 2, new Instruction(OpCodes.Ldc_I4, v.Item3));
method.Body.Instructions.Insert(v.Item1 + 3, new Instruction(OpCodes.Call, Decryptor));
}
}
method.Body.OptimizeBranches();
}
public void Execute(ModuleDefMD md)
{
var consttype = RuntimeHelper.GetRuntimeType("AsStrongAsFuck.Runtime.Constants");
FieldDef field = consttype.FindField("array");
Renamer.Rename(field, Renamer.RenameMode.Base64, 2);
field.DeclaringType = null;
foreach (TypeDef type in md.Types)
{
foreach (MethodDef method in type.Methods)
{
if (method.HasBody && method.Body.HasInstructions)
{
ExtractStrings(method);
}
}
}
md.GlobalType.Fields.Add(field);
MethodDef todef = consttype.FindMethod("Get");
todef.DeclaringType = null;
todef.Body.Instructions[59].Operand = field;
Renamer.Rename(todef, Renamer.RenameMode.Logical);
md.GlobalType.Methods.Add(todef);
MethodDef init = consttype.FindMethod("Initialize");
MethodDef add = consttype.FindMethod("Set");
init.DeclaringType = null;
init.Body.Instructions[3].Operand = field;
List <Instruction> insts = new List <Instruction>(add.Body.Instructions);
insts[1].Operand = field;
insts[insts.Count - 1].OpCode = OpCodes.Nop;
insts.RemoveAt(0);
insts[1].OpCode = OpCodes.Ldc_I4;
insts[2].OpCode = OpCodes.Ldc_I4;
var compressed = Compress(array.ToArray());
for (int i = 0; i < compressed.Length; i++)
{
insts[1].Operand = i;
insts[2].Operand = Convert.ToInt32(compressed[i]);
for (int x = insts.Count - 1; x >= 0; x--)
{
init.Body.Instructions.Insert(4, new Instruction(insts[x].OpCode, insts[x].Operand));
}
}
init.Body.Instructions[init.Body.Instructions.Count - 1 - 1].Operand = field;
init.Body.Instructions[init.Body.Instructions.Count - 1 - 99].Operand = field;
Renamer.Rename(init, Renamer.RenameMode.Base64, 2);
md.GlobalType.Methods.Add(init);
Decryptor = todef;
MethodDef cctor = md.GlobalType.FindOrCreateStaticConstructor();
cctor.Body = new CilBody();
cctor.Body.Instructions.Add(new Instruction(OpCodes.Ldc_I4, compressed.Length));
cctor.Body.Instructions.Add(new Instruction(OpCodes.Call, init));
cctor.Body.Instructions.Add(new Instruction(OpCodes.Ret));
foreach (TypeDef type2 in md.Types)
{
foreach (MethodDef method2 in type2.Methods)
{
if (method2.HasBody && method2.Body.HasInstructions)
{
ReferenceReplace(method2);
}
}
}
}
public void ExecuteMethod(MethodDef method)
{
for (int i = 0; i < method.Body.Instructions.Count; i++)
{
var instr = method.Body.Instructions[i];
if (instr.OpCode == OpCodes.Call)
{
var target = (IMethod)instr.Operand;
if (!target.ResolveMethodDefThrow().IsPublic || !target.ResolveMethodDefThrow().IsStatic || !target.DeclaringType.ResolveTypeDef().IsPublic || target.DeclaringType.ResolveTypeDef().IsSealed)
{
continue;
}
var key = target.FullName;
MethodDef value;
if (!Proxies.TryGetValue(key, out value))
{
var consttype = RuntimeHelper.GetRuntimeType("AsStrongAsFuck.Runtime.RefProxy");
var proxysig = ReferenceProxyHelper.CreateProxySignature(target, method.Module);
var deleg = ReferenceProxyHelper.CreateDelegateType(proxysig, method.Module, target.ResolveMethodDef());
FieldDefUser field = new FieldDefUser("ZYXDNGuarder", new FieldSig(deleg.ToTypeSig()));
Renamer.Rename(field, Renamer.RenameMode.Base64);
method.DeclaringType.Fields.Add(field);
field.IsStatic = true;
var typedef = target.ResolveMethodDefThrow().DeclaringType;
var mdtoken = target.ResolveMethodDef().MDToken;
var asshole = consttype.Methods.First(x => x.Name == "Load");
asshole.Body.Instructions[1].Operand = deleg;
asshole.Body.Instructions[3].Operand = method.Module.Import(typedef);
asshole.Body.Instructions[6].OpCode = OpCodes.Ldc_I4;
asshole.Body.Instructions[6].Operand = (int)mdtoken.Raw;
asshole.Body.Instructions[10].Operand = deleg;
asshole.Body.Instructions[11].Operand = field;
asshole.Body.Instructions.RemoveAt(12);
var cctor = method.DeclaringType.FindOrCreateStaticConstructor();
foreach (var item in asshole.Body.Instructions)
{
cctor.Body.Instructions.Add(item);
}
if (cctor.Body.Instructions[0].OpCode == OpCodes.Ret)
{
cctor.Body.Instructions.RemoveAt(0);
}
var proxy = new MethodDefUser(Renamer.GetRandomName(), proxysig);
proxy.Attributes = MethodAttributes.PrivateScope | MethodAttributes.Static;
proxy.ImplAttributes = MethodImplAttributes.Managed | MethodImplAttributes.IL;
method.DeclaringType.Methods.Add(proxy);
proxy.Body = new CilBody();
proxy.Body.Instructions.Add(Instruction.Create(OpCodes.Ldsfld, field));
for (int x = 0; x < target.ResolveMethodDefThrow().Parameters.Count; x++)
{
proxy.Body.Instructions.Add(Instruction.Create(OpCodes.Ldarg, proxy.Parameters[x]));
}
proxy.Body.Instructions.Add(Instruction.Create(OpCodes.Callvirt, deleg.FindMethod("Invoke")));
proxy.Body.Instructions.Add(Instruction.Create(OpCodes.Ret));
value = proxy;
Proxies.Add(key, value);
}
Console.WriteLine($"{key} - {value}");
instr.Operand = value;
}
}
}
public void Watermark()
{
Console.WriteLine("Watermarking...");
var attrType = new TypeDefUser("", "MoneydevAttribute");
Module.Types.Add(attrType);
var attrType2 = new TypeDefUser("", "BabelObfuscatorAttribute", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType2);
var attrType3 = new TypeDefUser("", "Beds-Protector", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType3);
var attrType4 = new TypeDefUser("", "ConfusedByAttribute", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType4);
var attrType5 = new TypeDefUser("", "CryptoObfuscator.ProtectedWithCryptoObfuscatorAttribute", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType5);
var attrType6 = new TypeDefUser("", "DotfuscatorAttribute", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType6);
var attrType7 = new TypeDefUser("", "EMyPID_8234_", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType7);
var attrType8 = new TypeDefUser("", "moneydev", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType8);
var attrType9 = new TypeDefUser("", "NETGuard", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType9);
var attrType10 = new TypeDefUser("", "NineRays.Obfuscator.Evaluation", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType10);
var attrType11 = new TypeDefUser("", "ObfuscatedByGoliath", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType11);
var attrType12 = new TypeDefUser("", "OiCuntJollyGoodDayYeHavin_____________________________________________________", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType12);
var attrType13 = new TypeDefUser("", "Reactor", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType13);
var attrType14 = new TypeDefUser("", "SecureTeam.Attributes.ObfuscatedByAgileDotNetAttribute", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType14);
var attrType15 = new TypeDefUser("", "SkidfuscatorAttribute", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType15);
var attrType16 = new TypeDefUser("", "SmartAssembly.Attributes.PoweredByAttribute", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType16);
var attrType17 = new TypeDefUser("", "VMProtect", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType17);
var attrType18 = new TypeDefUser("", "VMProtectAttribute", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType18);
var attrType19 = new TypeDefUser("", "Xenocode.Client.Attributes.AssemblyAttributes.ProcessedByXenocode", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType19);
var attrType20 = new TypeDefUser("", "YanoAttribute", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType20);
var attrType21 = new TypeDefUser("", "ZYXDNGuarder", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType21);
var attrType22 = new TypeDefUser("", "<Module>{5463E459-C078-4545-9554-6B8CC9042999}", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType22);
var attrType23 = new TypeDefUser("", "ILLicenseModule", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType23);
var attrType24 = new TypeDefUser("", "de4fuckyou", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType24);
var attrType25 = new TypeDefUser("", "NetShield", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType25);
var attrType26 = new TypeDefUser("", "CrytpoObfuscator", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType26);
var attrType27 = new TypeDefUser("", "CryptoObfuscator", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType27);
var attrType28 = new TypeDefUser("", ".NETReactorAttribute", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType28);
var attrType29 = new TypeDefUser("", "MaxtoCodeAttribute", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType29);
var attrType30 = new TypeDefUser("", "Shitfuscator-PRO", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType30);
var attrType31 = new TypeDefUser("", "VMEntry", Module.CorLibTypes.GetTypeRef("System", "Attribute"));
Module.Types.Add(attrType31);
var ctor = new MethodDefUser(
".ctor",
MethodSig.CreateInstance(Module.CorLibTypes.Void, Module.CorLibTypes.String),
dnlib.DotNet.MethodImplAttributes.Managed,
dnlib.DotNet.MethodAttributes.HideBySig | dnlib.DotNet.MethodAttributes.Public | dnlib.DotNet.MethodAttributes.SpecialName | dnlib.DotNet.MethodAttributes.RTSpecialName);
ctor.Body = new CilBody();
ctor.Body.MaxStack = 1;
ctor.Body.Instructions.Add(OpCodes.Ldarg_0.ToInstruction());
ctor.Body.Instructions.Add(OpCodes.Call.ToInstruction(new MemberRefUser(Module, ".ctor", MethodSig.CreateInstance(Module.CorLibTypes.Void), Module.CorLibTypes.GetTypeRef("System", "Attribute"))));
ctor.Body.Instructions.Add(OpCodes.Ret.ToInstruction());
attrType.Methods.Add(ctor);
var attr = new CustomAttribute(ctor);
attr.ConstructorArguments.Add(new CAArgument(Module.CorLibTypes.String, Renamer.GetFuckedString(69)));
Module.CustomAttributes.Add(attr);
}
public void Execute(ModuleDefMD md)
{
string shit = Renamer.Hell + Renamer.GetRandomName() + Renamer.Hell + Renamer.GetRandomName() + Renamer.Hell + Renamer.GetRandomName() + Renamer.Hell + Renamer.GetRandomName() + Renamer.Hell + Renamer.GetRandomName() + Renamer.Hell + Renamer.GetRandomName();
md.Name = shit;
}
