public static void Execute(ModuleDefMD module)
{
Write("Fixing the local to field...");
RemoveNops.Execute(module);
LocalsFixed = 0;
try
{
GrabFieldValues(module);
if (ProxyInt != null)
{
ReplaceProxyInt(module);
}
else
{
Write("Could not find fields values ! Aborting...", Type.Error);
}
}
catch
{
// Ignored.
}
Write(LocalsFixed == 0 ? "No Local to Field found !" :
LocalsFixed == 1 ? $"Fixed {LocalsFixed} local !" :
LocalsFixed > 1 ? $"Fixed {LocalsFixed} locals !" : "", Type.Success);
}
public static void Execute(ModuleDefMD module)
{
Write("Fixing the Empty Types protection..");
RemoveNops.Execute(module);
var emptyTypesFixed = 0;
foreach (TypeDef type in module.GetTypes().Where(t => t.HasMethods))
{
foreach (MethodDef method in type.Methods.Where(m => m.HasBody && m.Body.HasInstructions))
{
IList <Instruction> instr = method.Body.Instructions;
for (var i = 1; i < instr.Count; i++)
{
if (instr[i].OpCode != OpCodes.Ldlen || instr[i - 1].OpCode != OpCodes.Ldsfld)
{
continue;
}
if (!(instr[i - 1].Operand is MemberRef memberRef) || memberRef.Name != "EmptyTypes")
{
continue;
}
instr[i - 1] = Instruction.Create(OpCodes.Nop);
instr[i] = Instruction.Create(OpCodes.Ldc_I4_0);
emptyTypesFixed++;
Write($"Fixed the empty types in method: {method.Name} at offset: {instr[i].Offset}", Type.Debug);
}
}
}
Write(emptyTypesFixed == 0 ? "No Empty Types found !" : $"Fixed {emptyTypesFixed} empty types protection !", Type.Success);
}
public static void Execute(ModuleDefMD module)
{
Write("Fixing the Call To Calli protection..");
RemoveNops.Execute(module);
var callsFixed = 0;
foreach (TypeDef type in module.GetTypes().Where(t => t.HasMethods))
{
foreach (MethodDef method in type.Methods.Where(m => m.HasBody && m.Body.HasInstructions))
{
IList <Instruction> instr = method.Body.Instructions;
for (var i = 0; i < instr.Count; i++)
{
if (instr[i].OpCode != OpCodes.Ldftn || instr[i + 1].OpCode != OpCodes.Calli)
{
continue;
}
instr[i + 1].OpCode = OpCodes.Nop;
instr[i].OpCode = OpCodes.Call;
callsFixed++;
Write($"Fixed the call in method: {method.Name} at offset: {instr[i].Offset}", Type.Debug);
}
}
}
Write(callsFixed == 0 ? "No Call To Calli found !" :
callsFixed == 1 ? $"Fixed {callsFixed} call !" :
callsFixed > 1 ? $"Fixed {callsFixed} calls !" : "", Type.Success);
}
public static void Execute(ModuleDefMD module)
{
Write("Decrypting the constants...");
RemoveNops.Execute(module);
var decrypted = 0;
MethodDef decryptionMethod = null;
foreach (TypeDef type in module.GetTypes().Where(t => t.HasMethods))
{
foreach (MethodDef method in type.Methods.Where(m => m.HasBody && m.Body.HasInstructions))
{
IList <Instruction> instr = method.Body.Instructions;
for (var i = 0; i < instr.Count; i++)
{
if (instr[i].OpCode != OpCodes.Ldc_I4 || instr[i + 1].OpCode != OpCodes.Ldc_I4 ||
instr[i + 2].OpCode != OpCodes.Call)
{
continue;
}
decryptionMethod = instr[i + 2].Operand as MethodDef;
if (decryptionMethod == null)
{
continue;
}
if (decryptionMethod.DeclaringType != module.GlobalType)
{
continue;
}
int decodedInt = (int)instr[i].Operand ^ (int)instr[i + 1].Operand;
instr[i].OpCode = OpCodes.Nop;
instr[i + 1].OpCode = OpCodes.Nop;
instr[i + 2] = Instruction.CreateLdcI4(decodedInt);
decrypted++;
Write($"Decrypted: {decodedInt.ToString()} in method: {method.Name} at offset: {instr[i + 2].Offset}", Type.Debug);
}
}
}
if (decryptionMethod != null)
{
module.GlobalType.Remove(decryptionMethod);
Write("Removed the decryption method", Type.Success);
}
Write(decrypted == 0 ? "No constants protection found !" :
decrypted == 1 ? $"Decrypted {decrypted} constant !" :
decrypted > 1 ? $"Decrypted {decrypted} constants !" : "", Type.Success);
}
public static void Execute(ModuleDefMD module)
{
Write("Removing the Fake Obfuscators...");
RemoveNops.Execute(module);
var removed = 0;
foreach (TypeDef type in module.Types.ToList().Where(t => FakeObfuscators.Contains(t.Name)))
{
module.Types.Remove(type);
removed++;
Write($"Removed the fake obfuscator type: {type.Name}", Type.Debug);
}
Write(removed == 0 ? "No Fake Obfscators found !" :
removed == 1 ? $"Removed {removed} fake obfuscator type !" :
removed > 1 ? $"Removed {removed} fake obfuscator types !" : "", Type.Success);
}
public static void Execute(ModuleDefMD module)
{
Write("Decrypting the strings..");
RemoveNops.Execute(module);
var decrypted = 0;
foreach (TypeDef type in module.GetTypes().Where(t => t.HasMethods))
{
foreach (MethodDef method in type.Methods.Where(m => m.HasBody && m.Body.HasInstructions))
{
IList <Instruction> instr = method.Body.Instructions;
for (var i = 0; i < instr.Count; i++)
{
if (instr[i].OpCode != OpCodes.Call || !instr[i].Operand.ToString().Contains("get_UTF8") ||
instr[i + 1].OpCode != OpCodes.Ldstr || instr[i + 2].OpCode != OpCodes.Call ||
!instr[i + 2].Operand.ToString().Contains("FromBase64String") ||
instr[i + 3].OpCode != OpCodes.Callvirt ||
!instr[i + 3].Operand.ToString().Contains("GetString"))
{
continue;
}
string decryptedString = Encoding.UTF8.GetString(Convert.FromBase64String((string)instr[i + 1].Operand));
instr[i].OpCode = OpCodes.Nop;
instr[i + 1].OpCode = OpCodes.Nop;
instr[i + 2].OpCode = OpCodes.Nop;
instr[i + 3] = Instruction.Create(OpCodes.Ldstr, decryptedString);
decrypted++;
Write($"Decrypted: {decryptedString} in method: {method.Name} at offset: {instr[i + 3].Offset}", Type.Debug);
}
}
}
Write(decrypted == 0 ? "No String Protection found !" :
decrypted == 1 ? $"Decrypted {decrypted} string !" :
decrypted > 1 ? $"Decrypted {decrypted} strings !" : "", Type.Success);
}
public static void Execute(ModuleDefMD module)
{
Write("Removing the Double.Parse..");
RemoveNops.Execute(module);
var mutationsFixed = 0;
foreach (TypeDef type in module.GetTypes().Where(t => t.HasMethods))
{
foreach (MethodDef method in type.Methods.Where(m => m.HasBody && m.Body.HasInstructions))
{
IList <Instruction> instr = method.Body.Instructions;
for (var i = 0; i < instr.Count; i++)
{
if (instr[i].OpCode != OpCodes.Ldstr || !instr[i].Operand.ToString().Contains(",") ||
instr[i + 1].OpCode != OpCodes.Call ||
!instr[i + 1].Operand.ToString().Contains("System.Double::Parse") ||
instr[i + 2].OpCode != OpCodes.Conv_I4)
{
continue;
}
var result = (int)double.Parse(instr[i].Operand.ToString());
instr[i] = Instruction.CreateLdcI4(result);
instr[i + 1].OpCode = OpCodes.Nop;
instr[i + 2].OpCode = OpCodes.Nop;
mutationsFixed++;
Write($"Removed a Double.Parse in method: {method.Name} at offset: {instr[i].Offset}", Type.Debug);
}
}
}
Write(mutationsFixed == 0 ? "No Double.Parse found !" :
mutationsFixed == 1 ? $"Fixed {mutationsFixed} Double.Parse !" :
mutationsFixed > 1 ? $"Fixed {mutationsFixed} Double.Parse !" : "", Type.Success);
}
public static void Execute(ModuleDefMD module)
{
Write("Fixing the Hide Methods..");
RemoveNops.Execute(module);
var methodsFixed = 0;
if (module.EntryPoint.HasBody && module.EntryPoint.Body.HasInstructions)
{
IList <Instruction> instr = module.EntryPoint.Body.Instructions;
for (var i = 0; i < instr.Count; i++)
{
if (!instr[0].IsLdcI4() || !instr[1].IsStloc() || !instr[2].IsBr() || !instr[3].IsLdloc() ||
!instr[4].IsLdcI4() || instr[5].OpCode != OpCodes.Ceq || !instr[6].IsLdcI4() ||
instr[7].OpCode != OpCodes.Ceq || !instr[8].IsStloc() || !instr[9].IsLdloc() ||
!instr[10].IsBrtrue() || instr[11].OpCode != OpCodes.Ret || instr[12].OpCode != OpCodes.Calli ||
instr[13].OpCode != OpCodes.Sizeof)
{
continue;
}
for (var j = 0; j < 4; j++)
{
instr.RemoveAt(instr.Count - 1);
}
for (var j = 0; j < 13; j++)
{
instr.RemoveAt(0);
}
methodsFixed++;
}
}
Write(methodsFixed == 1 ? "Fixed Hide Method !" : "No Hide Methods found !", Type.Success);
}
public static void Execute(ModuleDefMD module)
{
Write("Removing the Constants Mutate...");
RemoveNops.Execute(module);
var removed = 0;
foreach (TypeDef type in module.Types.Where(t => t.HasMethods))
{
foreach (MethodDef method in type.Methods.Where(m => m.HasBody && m.Body.HasInstructions))
{
IList <Instruction> instr = method.Body.Instructions;
for (var i = 0; i < instr.Count; ++i)
{
if (instr[i].OpCode == OpCodes.Add && instr[i - 1].IsLdcI4() && instr[i - 2].IsLdcI4())
{
int num = instr[i - 2].GetLdcI4Value() + instr[i - 1].GetLdcI4Value();
instr[i] = Instruction.CreateLdcI4(num);
instr[i - 2].OpCode = OpCodes.Nop;
instr[i - 1].OpCode = OpCodes.Nop;
removed++;
Write($"Removed a constant mutate [ADD] in method: {method.Name} at offset: {instr[i].Offset}", Type.Debug);
}
else if (instr[i].OpCode == OpCodes.Sub && instr[i - 1].IsLdcI4() && instr[i - 2].IsLdcI4())
{
int num = instr[i - 2].GetLdcI4Value() - instr[i - 1].GetLdcI4Value();
instr[i] = Instruction.CreateLdcI4(num);
instr[i - 2].OpCode = OpCodes.Nop;
instr[i - 1].OpCode = OpCodes.Nop;
removed++;
Write($"Removed a constant mutate [SUB] in method: {method.Name} at offset: {instr[i].Offset}", Type.Debug);
}
else if (instr[i].OpCode == OpCodes.Mul && instr[i - 1].IsLdcI4() && instr[i - 2].IsLdcI4())
{
int num = instr[i - 2].GetLdcI4Value() * instr[i - 1].GetLdcI4Value();
instr[i] = Instruction.CreateLdcI4(num);
instr[i - 2].OpCode = OpCodes.Nop;
instr[i - 1].OpCode = OpCodes.Nop;
removed++;
Write($"Removed a constant mutate [MUL] in method: {method.Name} at offset: {instr[i].Offset}", Type.Debug);
}
else if (instr[i].OpCode == OpCodes.Div && instr[i - 1].IsLdcI4() && instr[i - 2].IsLdcI4())
{
int num = instr[i - 2].GetLdcI4Value() / instr[i - 1].GetLdcI4Value();
instr[i].OpCode = OpCodes.Ldc_I4;
instr[i].Operand = num;
instr[i - 2].OpCode = OpCodes.Nop;
instr[i - 1].OpCode = OpCodes.Nop;
removed++;
Write($"Removed a constant mutate [DIV] in method: {method.Name} at offset: {instr[i].Offset}", Type.Debug);
}
}
}
}
Write(removed == 0 ? "No Constants Mutate found !" :
removed == 1 ? $"Removed {removed} constant mutate" :
removed > 1 ? $"Removed {removed} constants mutate !" : "", Type.Success);
}