public void MutateCode(Random rand, MethodBody body) { bool modified = false; int i = 10; do { int idx = rand.Next(0, body.Instructions.Count); Instruction inst = body.Instructions[idx]; switch (inst.OpCode.Code) { case Code.Beq: CecilHelper.Replace(body, inst, new Instruction[] { Instruction.Create(OpCodes.Ceq), Instruction.Create(OpCodes.Brtrue, (Instruction)inst.Operand) }); modified = true; break; case Code.Bgt: CecilHelper.Replace(body, inst, new Instruction[] { Instruction.Create(OpCodes.Cgt), Instruction.Create(OpCodes.Brtrue, (Instruction)inst.Operand) }); modified = true; break; case Code.Bgt_Un: CecilHelper.Replace(body, inst, new Instruction[] { Instruction.Create(OpCodes.Cgt_Un), Instruction.Create(OpCodes.Brtrue, (Instruction)inst.Operand) }); modified = true; break; case Code.Blt: CecilHelper.Replace(body, inst, new Instruction[] { Instruction.Create(OpCodes.Clt), Instruction.Create(OpCodes.Brtrue, (Instruction)inst.Operand) }); modified = true; break; case Code.Blt_Un: CecilHelper.Replace(body, inst, new Instruction[] { Instruction.Create(OpCodes.Clt_Un), Instruction.Create(OpCodes.Brtrue, (Instruction)inst.Operand) }); modified = true; break; case Code.Ldc_I4: { int x = (int)inst.Operand; if (x > 0x10) { int y = rand.Next(); switch (rand.Next(0, 3)) { case 0: x = x - y; CecilHelper.Replace(body, inst, new Instruction[] { Instruction.Create(OpCodes.Ldc_I4, x), Instruction.Create(OpCodes.Ldc_I4, y), Instruction.Create(OpCodes.Add) }); break; case 1: x = x + y; CecilHelper.Replace(body, inst, new Instruction[] { Instruction.Create(OpCodes.Ldc_I4, x), Instruction.Create(OpCodes.Ldc_I4, y), Instruction.Create(OpCodes.Sub) }); break; case 2: x = x ^ y; CecilHelper.Replace(body, inst, new Instruction[] { Instruction.Create(OpCodes.Ldc_I4, x), Instruction.Create(OpCodes.Ldc_I4, y), Instruction.Create(OpCodes.Xor) }); break; } modified = true; } } break; case Code.Ldc_I8: { long x = (long)inst.Operand; if (x > 0x10) { long y = rand.Next() * rand.Next(); switch (rand.Next(0, 3)) { case 0: x = x - y; CecilHelper.Replace(body, inst, new Instruction[] { Instruction.Create(OpCodes.Ldc_I8, x), Instruction.Create(OpCodes.Ldc_I8, y), Instruction.Create(OpCodes.Add) }); break; case 1: x = x + y; CecilHelper.Replace(body, inst, new Instruction[] { Instruction.Create(OpCodes.Ldc_I8, x), Instruction.Create(OpCodes.Ldc_I8, y), Instruction.Create(OpCodes.Sub) }); break; case 2: x = x ^ y; CecilHelper.Replace(body, inst, new Instruction[] { Instruction.Create(OpCodes.Ldc_I8, x), Instruction.Create(OpCodes.Ldc_I8, y), Instruction.Create(OpCodes.Xor) }); break; } modified = true; } } break; } i--; } while (!modified && i > 0); }
public override string[] Pack(ConfuserParameter crParam, PackerParameter param) { ModuleDefinition originMain = param.Assemblies.Single(_ => _.IsMain).Assembly.MainModule; int originIndex = Array.IndexOf(param.Modules, originMain); var asm = AssemblyDefinition.CreateAssembly(originMain.Assembly.Name, modName, new ModuleParameters() { Architecture = originMain.Architecture, Kind = oKind, Runtime = originMain.Runtime }); ModuleDefinition mod = asm.MainModule; mod.Attributes |= (originMain.Attributes & ModuleAttributes.Required32Bit); // added -- christallire - to prevent BadImageFormatException, Stub assembly need to set ModuleAttribute.Required32Bit if oringinMain has one. hash = new ByteBuffer(SHA1Managed.Create().ComputeHash(param.PEs[originIndex])); int key0 = Random.Next(0, 0xff); int key1 = Random.Next(0, 0xff); int key2 = Random.Next(0, 0xff); Database.AddEntry("Compressor", "Key0", key0); Database.AddEntry("Compressor", "Key1", key1); Database.AddEntry("Compressor", "Key2", key2); ulong e = 0x47; ulong p = (ulong)Random.Next(0x1000, 0x10000); while (!isPrime(p) || (p - 1) % e == 0) { p = (ulong)Random.Next(0x1000, 0x10000); } ulong q = (ulong)Random.Next(0x1000, 0x10000); while (!isPrime(q) || (q - 1) % e == 0) { q = (ulong)Random.Next(0x1000, 0x10000); } ulong n = p * q; ulong n_ = (p - 1) * (q - 1); ulong d = modInv(e, n_); Database.AddEntry("Compressor", "p", p); Database.AddEntry("Compressor", "q", q); Database.AddEntry("Compressor", "n", n); Database.AddEntry("Compressor", "d", d); EmbeddedResource res = new EmbeddedResource(ObfuscationHelper.GetRandomName(), ManifestResourceAttributes.Private, Encrypt(param.PEs[originIndex], key0)); mod.Resources.Add(res); for (int i = 1; i < param.Modules.Length; i++) { if (param.Modules[i].IsMain) { mod.Resources.Add(new EmbeddedResource(GetNewName(param.Modules[i].Assembly.Name.FullName, key2), ManifestResourceAttributes.Private, Encrypt(param.PEs[i], key0))); } else { mod.Resources.Add(new EmbeddedResource(GetNewName(param.Modules[i].Name, key2), ManifestResourceAttributes.Private, Encrypt(param.PEs[i], key1))); //TODO: Support for multi-module asssembly } } AssemblyDefinition ldrC = AssemblyDefinition.ReadAssembly(typeof(Iid).Assembly.Location); ldrC.MainModule.ReadSymbols(); TypeDefinition t = CecilHelper.Inject(mod, ldrC.MainModule.GetType("CompressShell")); Mutator mutator = new Mutator(); mutator.IntKeys = new int[] { key0, key1, key2 }; mutator.LongKeys = new long[] { (long)modPow(entryPoint, d, n), (long)n }; mutator.StringKeys = new string[] { res.Name }; mutator.Mutate(Random, t, mod); t.Namespace = ""; t.DeclaringType = null; t.IsNestedPrivate = false; t.IsNotPublic = true; mod.Types.Add(t); //MethodDefinition cctor = new MethodDefinition(".cctor", MethodAttributes.Private | MethodAttributes.HideBySig | // MethodAttributes.SpecialName | MethodAttributes.RTSpecialName | // MethodAttributes.Static, mod.TypeSystem.Void); //mod.GetType("<Module>").Methods.Add(cctor); //MethodBody bdy = cctor.Body = new MethodBody(cctor); //ILProcessor psr = bdy.GetILProcessor(); //psr.Emit(OpCodes.Call, mod.Import(typeof(AppDomain).GetProperty("CurrentDomain").GetGetMethod())); //psr.Emit(OpCodes.Ldnull); //psr.Emit(OpCodes.Ldftn, t.Methods.FirstOrDefault(mtd => mtd.Name == "DecryptAsm")); //psr.Emit(OpCodes.Newobj, mod.Import(typeof(ResolveEventHandler).GetConstructor(new Type[] { typeof(object), typeof(IntPtr) }))); //psr.Emit(OpCodes.Callvirt, mod.Import(typeof(AppDomain).GetEvent("AssemblyResolve").GetAddMethod())); //psr.Emit(OpCodes.Ret); MethodDefinition main = t.Methods.FirstOrDefault(mtd => mtd.Name == "Main"); mod.EntryPoint = main; return(ProtectStub(asm)); }