public void Execute(PandaState pandaState, PandaContext pandaContext) { CFHelper cFHelper = new CFHelper(); foreach (TypeDef type in pandaContext.moduleDef.Types) { foreach (MethodDef method in type.Methods) { if (method.HasBody && method.Body.Instructions.Count > 0 && !method.IsConstructor) { if (!cFHelper.HasUnsafeInstructions(method)) { if (DnlibUtils.Simplify(method)) { Blocks blocks = cFHelper.GetBlocks(method); if (blocks.blocks.Count != 1) { switch (pandaState) { case PandaState.Basic: toDoSwitcher(cFHelper, method, blocks, pandaContext); break; case PandaState.Normal: toDoBody(cFHelper, method, blocks, pandaContext); break; } } DnlibUtils.Optimize(method); } } } } } }
public void Encoding(PandaContext pandaContext) { foreach (TypeDef type in pandaContext.moduleDef.Types) { foreach (MethodDef method in type.Methods) { if (method.Body == null) { continue; } for (int i = 0; i < method.Body.Instructions.Count(); i++) { if (method.Body.Instructions[i].OpCode == OpCodes.Ldstr) { String oldString = method.Body.Instructions[i].Operand.ToString(); String newString = Convert.ToBase64String(UTF8Encoding.UTF8.GetBytes(oldString)); method.Body.Instructions[i].OpCode = OpCodes.Nop; method.Body.Instructions.Insert(i + 1, new Instruction(OpCodes.Call, pandaContext.moduleDef.Import(typeof(System.Text.Encoding).GetMethod("get_UTF8", new Type[] { })))); method.Body.Instructions.Insert(i + 2, new Instruction(OpCodes.Ldstr, newString)); method.Body.Instructions.Insert(i + 3, new Instruction(OpCodes.Call, pandaContext.moduleDef.Import(typeof(System.Convert).GetMethod("FromBase64String", new Type[] { typeof(string) })))); method.Body.Instructions.Insert(i + 4, new Instruction(OpCodes.Callvirt, pandaContext.moduleDef.Import(typeof(System.Text.Encoding).GetMethod("GetString", new Type[] { typeof(byte[]) })))); i += 4; } } DnlibUtils.Optimize(method); } } }
public void Excute(PandaContext pandaContext) { RPHelper rPHelper = new RPHelper(); DnlibUtils.fixProxy(pandaContext.moduleDef); foreach (TypeDef type in pandaContext.moduleDef.Types.ToArray()) { foreach (MethodDef method in type.Methods.ToArray()) { if (usedMethods.Contains(method)) { continue; } if (ObfuscationUtils.ObfuscationMethodUtil.canObfuscate(method)) { foreach (Instruction instruction in method.Body.Instructions.ToArray()) { if (instruction.OpCode == OpCodes.Newobj) { IMethodDefOrRef methodDefOrRef = instruction.Operand as IMethodDefOrRef; if (methodDefOrRef.IsMethodSpec) { continue; } if (methodDefOrRef == null) { continue; } MethodDef methodDef = rPHelper.GenerateMethod(methodDefOrRef, method); if (methodDef == null) { continue; } method.DeclaringType.Methods.Add(methodDef); usedMethods.Add(methodDef); instruction.OpCode = OpCodes.Call; instruction.Operand = methodDef; usedMethods.Add(methodDef); } else if (instruction.OpCode == OpCodes.Stfld) { FieldDef targetField = instruction.Operand as FieldDef; if (targetField == null) { continue; } CilBody body = new CilBody(); body.Instructions.Add(OpCodes.Nop.ToInstruction()); body.Instructions.Add(OpCodes.Ldarg_0.ToInstruction()); body.Instructions.Add(OpCodes.Ldarg_1.ToInstruction()); body.Instructions.Add(OpCodes.Stfld.ToInstruction(targetField)); body.Instructions.Add(OpCodes.Ret.ToInstruction()); var sig = MethodSig.CreateInstance(pandaContext.moduleDef.CorLibTypes.Void, targetField.FieldSig.GetFieldType()); sig.HasThis = true; MethodDefUser methodDefUser = new MethodDefUser(generator.Generate <string>(GeneratorType.String, 10), sig) { Body = body, IsHideBySig = true }; usedMethods.Add(methodDefUser); method.DeclaringType.Methods.Add(methodDefUser); instruction.Operand = methodDefUser; instruction.OpCode = OpCodes.Call; } } } } } }