private static void Main(string[] args) { if (args.Length == 0) { Extensions.WriteLineFormatted("Please {0} your file.", FailedLightColor, "drag and drop".ToColor(FailedDarkColor)); Console.ReadKey(); return; } var module = ModuleDefMD.Load(args[0]); var runtimePath = Path.Combine(Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location), "Nasha.dll"); var runtime = ModuleDefMD.Load(runtimePath); IMethod runMethod = Injection.InjectRuntimeMethod(runtime, module, "Main", "Execute"); IMethod runCtor = Injection.InjectRuntimeMethod(runtime, module, "Main", ".ctor"); IMethod configCtor = Injection.InjectRuntimeMethod(runtime, module, "Config", ".ctor"); IMethod configSetup = Injection.InjectRuntimeMethod(runtime, module, "Config", "SetupReferences"); IMethod configDiscover = Injection.InjectRuntimeMethod(runtime, module, "Config", "SetupDiscover"); IMethod configVmBytes = Injection.InjectRuntimeMethod(runtime, module, "Config", "SetupBody"); var configField = new FieldDefUser("cfg", new FieldSig(configCtor.DeclaringType.ToTypeSig()), dnlib.DotNet.FieldAttributes.Public | dnlib.DotNet.FieldAttributes.Static); module.GlobalType.Fields.Add(configField); var globalConstructor = module.GlobalType.FindOrCreateStaticConstructor(); Console.WriteLine("Do you want bypass ObfuscationAttributes? y/n (default y) "); bool bypass = Console.ReadKey().Key != ConsoleKey.N; foreach (var type in module.Types) { if (type.IsGlobalModuleType) { continue; } foreach (var method in type.Methods) { if (bypass) { goto virt; } foreach (var attr in method.CustomAttributes) { if (attr.AttributeType.TypeName == method.Module.Import(typeof(System.Reflection.ObfuscationAttribute)).TypeName) { if (attr.Properties.FirstOrDefault(x => x.Name == "Feature" && x.Value.ToString() == "virt") != null) { // If StripAfterObfuscation is set to true Nasha will remove the attribute from the output assembly. if (attr.Properties.FirstOrDefault(x => x.Name == "StripAfterObfuscation") is var stripAfterObfuscation && stripAfterObfuscation != null) { var stripObf = (bool)stripAfterObfuscation.Value; Extensions.WriteLineFormatted("{0}\n{1}: {2}\n\n", "StripAfterObfuscation".ToColor(stripObf ? SuccessDarkColor : FailedDarkColor), "Method".ToColor(stripObf ? SuccessDarkColor : FailedDarkColor), method.Name.ToString().ToColor(stripObf ? SuccessLightColor : FailedLightColor)); if (stripObf) { method.CustomAttributes.Remove(attr); } } else { Extensions.WriteLineFormatted("{0}\n{1}: {2}\n\n", "StripAfterObfuscation".ToColor(SuccessDarkColor), "Method".ToColor(SuccessDarkColor), method.Name.ToString().ToColor(SuccessLightColor)); method.CustomAttributes.Remove(attr); } // If ApplyToMembers is set to true Nasha will apply the virtualization to the method itself. if (attr.Properties.FirstOrDefault(x => x.Name == "ApplyToMembers") is var applyToMembers && applyToMembers != null) { var applyMembers = (bool)applyToMembers.Value; Extensions.WriteLineFormatted("{0}\n{1}: {2}\n\n", "ApplyToMembers".ToColor(applyMembers ? SuccessDarkColor : FailedDarkColor), "Method".ToColor(applyMembers ? SuccessDarkColor : FailedDarkColor), method.Name.ToString().ToColor(applyMembers ? SuccessLightColor : FailedLightColor)); if (!applyMembers) { continue; } } goto virt; } } } continue; virt: var nashaInstructions = Translator.Translate(Settings, method) ?? null; var hasInstruction = nashaInstructions != null; if (hasInstruction) { Settings.Translated.Add(new Translated(method, nashaInstructions)); } if (hasInstruction) { Extensions.WriteLineFormatted("{0}\n{1}: {2}\n{3}: {4}\n\n", "Virtualized".ToColor(SuccessDarkColor), $"Method".ToColor(SuccessDarkColor), method.Name.ToString().ToColor(SuccessLightColor), "Instructions".ToColor(SuccessDarkColor), nashaInstructions.Count.ToString().ToColor(SuccessLightColor)); } else { Extensions.WriteLineFormatted("{0}\n{1}: {2}\n\n", "Failed Virtualizing".ToColor(FailedDarkColor), $"Method".ToColor(FailedDarkColor), method.Name.ToString().ToColor(FailedLightColor)); } } }