public override void Mangle(CilBody body, ScopeBlock root, CFContext ctx) { body.MaxStack++; foreach (InstrBlock block in GetAllBlocks(root)) { LinkedList<Instruction[]> fragments = SpiltFragments(block, ctx); if (fragments.Count < 4) continue; LinkedListNode<Instruction[]> current = fragments.First; while (current.Next != null) { var newFragment = new List<Instruction>(current.Value); ctx.AddJump(newFragment, current.Next.Value[0]); ctx.AddJunk(newFragment); current.Value = newFragment.ToArray(); current = current.Next; } Instruction[] first = fragments.First.Value; fragments.RemoveFirst(); Instruction[] last = fragments.Last.Value; fragments.RemoveLast(); List<Instruction[]> newFragments = fragments.ToList(); ctx.Random.Shuffle(newFragments); block.Instructions = first .Concat(newFragments.SelectMany(fragment => fragment)) .Concat(last).ToList(); } }
public override void Mangle(CilBody body, ScopeBlock root, CFContext ctx) { body.MaxStack++; foreach (InstrBlock block in GetAllBlocks(root)) { LinkedList <Instruction[]> fragments = SpiltFragments(block, ctx); if (fragments.Count < 4) { continue; } LinkedListNode <Instruction[]> current = fragments.First; while (current.Next != null) { var newFragment = new List <Instruction>(current.Value); ctx.AddJump(newFragment, current.Next.Value[0]); ctx.AddJunk(newFragment); current.Value = newFragment.ToArray(); current = current.Next; } Instruction[] first = fragments.First.Value; fragments.RemoveFirst(); Instruction[] last = fragments.Last.Value; fragments.RemoveLast(); List <Instruction[]> newFragments = fragments.ToList(); ctx.Random.Shuffle(newFragments); block.Instructions = first .Concat(newFragments.SelectMany(fragment => fragment)) .Concat(last).ToList(); } }
void ProcessMethod(CilBody body, CFContext ctx) { uint maxStack; if (!MaxStackCalculator.GetMaxStack(body.Instructions, body.ExceptionHandlers, out maxStack)) { ctx.Context.Logger.Error("Failed to calcuate maxstack."); throw new ConfuserException(null); } body.MaxStack = (ushort)maxStack; ScopeBlock root = BlockParser.ParseBody(body); GetMangler(ctx.Type).Mangle(body, root, ctx); body.Instructions.Clear(); root.ToBody(body); foreach (ExceptionHandler eh in body.ExceptionHandlers) { var index = body.Instructions.IndexOf(eh.TryEnd) + 1; eh.TryEnd = index < body.Instructions.Count ? body.Instructions[index] : null; index = body.Instructions.IndexOf(eh.HandlerEnd) + 1; eh.HandlerEnd = index < body.Instructions.Count ? body.Instructions[index] : null; } body.KeepOldMaxStack = true; }
protected static IEnumerable<InstrBlock> GetAllBlocks(ScopeBlock scope) { foreach (BlockBase child in scope.Children) { if (child is InstrBlock) yield return (InstrBlock)child; else { foreach (InstrBlock block in GetAllBlocks((ScopeBlock)child)) yield return block; } } }
protected static IEnumerable <InstrBlock> GetAllBlocks(ScopeBlock scope) { foreach (var child in scope.Children) { if (child is InstrBlock) { yield return((InstrBlock)child); } else { foreach (var block in GetAllBlocks((ScopeBlock)child)) { yield return(block); } } } }
public override void Mangle(CilBody body, ScopeBlock root, CFContext ctx) { Trace trace = new Trace(body, ctx.Method.ReturnType.RemoveModifiers().ElementType != ElementType.Void); var local = new Local(ctx.Method.Module.CorLibTypes.UInt32); body.Variables.Add(local); body.InitLocals = true; body.MaxStack += 2; IPredicate predicate = null; if (ctx.Predicate == PredicateType.Normal) { predicate = new NormalPredicate(ctx); } else if (ctx.Predicate == PredicateType.Expression) { predicate = new ExpressionPredicate(ctx); } else if (ctx.Predicate == PredicateType.x86) { predicate = new x86Predicate(ctx); } foreach (InstrBlock block in GetAllBlocks(root)) { LinkedList <Instruction[]> statements = SpiltStatements(block, trace, ctx); // Make sure .ctor is executed before switch if (ctx.Method.IsInstanceConstructor) { var newStatement = new List <Instruction>(); while (statements.First != null) { newStatement.AddRange(statements.First.Value); Instruction lastInstr = statements.First.Value.Last(); statements.RemoveFirst(); if (lastInstr.OpCode == OpCodes.Call && ((IMethod)lastInstr.Operand).Name == ".ctor") { break; } } statements.AddFirst(newStatement.ToArray()); } if (statements.Count < 3) { continue; } int i; var keyId = Enumerable.Range(0, statements.Count).ToArray(); ctx.Random.Shuffle(keyId); var key = new int[keyId.Length]; for (i = 0; i < key.Length; i++) { var q = ctx.Random.NextInt32() & 0x7fffffff; key[i] = q - q % statements.Count + keyId[i]; } var statementKeys = new Dictionary <Instruction, int>(); LinkedListNode <Instruction[]> current = statements.First; i = 0; while (current != null) { if (i != 0) { statementKeys[current.Value[0]] = key[i]; } i++; current = current.Next; } var statementLast = new HashSet <Instruction>(statements.Select(st => st.Last())); Func <IList <Instruction>, bool> hasUnknownSource; hasUnknownSource = instrs => instrs.Any(instr => { if (trace.HasMultipleSources(instr.Offset)) { return(true); } List <Instruction> srcs; if (trace.BrRefs.TryGetValue(instr.Offset, out srcs)) { // Target of switch => assume unknown if (srcs.Any(src => src.Operand is Instruction[])) { return(true); } // Not within current instruction block / targeted in first statement if (srcs.Any(src => src.Offset <= statements.First.Value.Last().Offset || src.Offset >= block.Instructions.Last().Offset)) { return(true); } // Not targeted by the last of statements if (srcs.Any(src => statementLast.Contains(src))) { return(true); } } return(false); }); var switchInstr = new Instruction(OpCodes.Switch); var switchHdr = new List <Instruction>(); if (predicate != null) { predicate.Init(body); switchHdr.Add(Instruction.CreateLdcI4(predicate.GetSwitchKey(key[1]))); predicate.EmitSwitchLoad(switchHdr); } else { switchHdr.Add(Instruction.CreateLdcI4(key[1])); } switchHdr.Add(Instruction.Create(OpCodes.Dup)); switchHdr.Add(Instruction.Create(OpCodes.Stloc, local)); switchHdr.Add(Instruction.Create(OpCodes.Ldc_I4, statements.Count)); switchHdr.Add(Instruction.Create(OpCodes.Rem_Un)); switchHdr.Add(switchInstr); ctx.AddJump(switchHdr, statements.Last.Value[0]); ctx.AddJunk(switchHdr); var operands = new Instruction[statements.Count]; current = statements.First; i = 0; while (current.Next != null) { var newStatement = new List <Instruction>(current.Value); if (i != 0) { // Convert to switch bool converted = false; if (newStatement.Last().IsBr()) { // Unconditional var target = (Instruction)newStatement.Last().Operand; int brKey; if (!trace.IsBranchTarget(newStatement.Last().Offset) && statementKeys.TryGetValue(target, out brKey)) { var targetKey = predicate != null?predicate.GetSwitchKey(brKey) : brKey; var unkSrc = hasUnknownSource(newStatement); newStatement.RemoveAt(newStatement.Count - 1); if (unkSrc) { newStatement.Add(Instruction.Create(OpCodes.Ldc_I4, targetKey)); } else { var thisKey = key[i]; var r = ctx.Random.NextInt32(); newStatement.Add(Instruction.Create(OpCodes.Ldloc, local)); newStatement.Add(Instruction.CreateLdcI4(r)); newStatement.Add(Instruction.Create(OpCodes.Mul)); newStatement.Add(Instruction.Create(OpCodes.Ldc_I4, (thisKey * r) ^ targetKey)); newStatement.Add(Instruction.Create(OpCodes.Xor)); } ctx.AddJump(newStatement, switchHdr[1]); ctx.AddJunk(newStatement); operands[keyId[i]] = newStatement[0]; converted = true; } } else if (newStatement.Last().IsConditionalBranch()) { // Conditional var target = (Instruction)newStatement.Last().Operand; int brKey; if (!trace.IsBranchTarget(newStatement.Last().Offset) && statementKeys.TryGetValue(target, out brKey)) { bool unkSrc = hasUnknownSource(newStatement); int nextKey = key[i + 1]; OpCode condBr = newStatement.Last().OpCode; newStatement.RemoveAt(newStatement.Count - 1); if (ctx.Random.NextBoolean()) { condBr = InverseBranch(condBr); int tmp = brKey; brKey = nextKey; nextKey = tmp; } var thisKey = key[i]; int r = 0, xorKey = 0; if (!unkSrc) { r = ctx.Random.NextInt32(); xorKey = thisKey * r; } Instruction brKeyInstr = Instruction.CreateLdcI4(xorKey ^ (predicate != null ? predicate.GetSwitchKey(brKey) : brKey)); Instruction nextKeyInstr = Instruction.CreateLdcI4(xorKey ^ (predicate != null ? predicate.GetSwitchKey(nextKey) : nextKey)); Instruction pop = Instruction.Create(OpCodes.Pop); newStatement.Add(Instruction.Create(condBr, brKeyInstr)); newStatement.Add(nextKeyInstr); newStatement.Add(Instruction.Create(OpCodes.Dup)); newStatement.Add(Instruction.Create(OpCodes.Br, pop)); newStatement.Add(brKeyInstr); newStatement.Add(Instruction.Create(OpCodes.Dup)); newStatement.Add(pop); if (!unkSrc) { newStatement.Add(Instruction.Create(OpCodes.Ldloc, local)); newStatement.Add(Instruction.CreateLdcI4(r)); newStatement.Add(Instruction.Create(OpCodes.Mul)); newStatement.Add(Instruction.Create(OpCodes.Xor)); } ctx.AddJump(newStatement, switchHdr[1]); ctx.AddJunk(newStatement); operands[keyId[i]] = newStatement[0]; converted = true; } } if (!converted) { // Normal var targetKey = predicate != null?predicate.GetSwitchKey(key[i + 1]) : key[i + 1]; if (!hasUnknownSource(newStatement)) { var thisKey = key[i]; var r = ctx.Random.NextInt32(); newStatement.Add(Instruction.Create(OpCodes.Ldloc, local)); newStatement.Add(Instruction.CreateLdcI4(r)); newStatement.Add(Instruction.Create(OpCodes.Mul)); newStatement.Add(Instruction.Create(OpCodes.Ldc_I4, (thisKey * r) ^ targetKey)); newStatement.Add(Instruction.Create(OpCodes.Xor)); } else { newStatement.Add(Instruction.Create(OpCodes.Ldc_I4, targetKey)); } ctx.AddJump(newStatement, switchHdr[1]); ctx.AddJunk(newStatement); operands[keyId[i]] = newStatement[0]; } } else { operands[keyId[i]] = switchHdr[0]; } current.Value = newStatement.ToArray(); current = current.Next; i++; } operands[keyId[i]] = current.Value[0]; switchInstr.Operand = operands; Instruction[] first = statements.First.Value; statements.RemoveFirst(); Instruction[] last = statements.Last.Value; statements.RemoveLast(); List <Instruction[]> newStatements = statements.ToList(); ctx.Random.Shuffle(newStatements); block.Instructions.Clear(); block.Instructions.AddRange(first); block.Instructions.AddRange(switchHdr); foreach (var statement in newStatements) { block.Instructions.AddRange(statement); } block.Instructions.AddRange(last); } }
public abstract void Mangle(CilBody body, ScopeBlock root, CFContext ctx);
public override void Mangle(CilBody body, ScopeBlock root, CFContext ctx) { Trace trace = new Trace(body, ctx.Method.ReturnType.RemoveModifiers().ElementType != ElementType.Void); var local = new Local(ctx.Method.Module.CorLibTypes.UInt32); body.Variables.Add(local); body.InitLocals = true; body.MaxStack += 2; IPredicate predicate = null; if (ctx.Predicate == PredicateType.Normal) { predicate = new NormalPredicate(ctx); } else if (ctx.Predicate == PredicateType.Expression) { predicate = new ExpressionPredicate(ctx); } else if (ctx.Predicate == PredicateType.x86) { predicate = new x86Predicate(ctx); } foreach (InstrBlock block in GetAllBlocks(root)) { LinkedList<Instruction[]> statements = SpiltStatements(block, trace, ctx); // Make sure .ctor is executed before switch if (ctx.Method.IsInstanceConstructor) { var newStatement = new List<Instruction>(); while (statements.First != null) { newStatement.AddRange(statements.First.Value); Instruction lastInstr = statements.First.Value.Last(); statements.RemoveFirst(); if (lastInstr.OpCode == OpCodes.Call && ((IMethod)lastInstr.Operand).Name == ".ctor") break; } statements.AddFirst(newStatement.ToArray()); } if (statements.Count < 3) continue; int i; var keyId = Enumerable.Range(0, statements.Count).ToArray(); ctx.Random.Shuffle(keyId); var key = new int[keyId.Length]; for (i = 0; i < key.Length; i++) { var q = ctx.Random.NextInt32() & 0x7fffffff; key[i] = q - q % statements.Count + keyId[i]; } var statementKeys = new Dictionary<Instruction, int>(); LinkedListNode<Instruction[]> current = statements.First; i = 0; while (current != null) { if (i != 0) statementKeys[current.Value[0]] = key[i]; i++; current = current.Next; } var statementLast = new HashSet<Instruction>(statements.Select(st => st.Last())); Func<IList<Instruction>, bool> hasUnknownSource; hasUnknownSource = instrs => instrs.Any(instr => { if (trace.HasMultipleSources(instr.Offset)) return true; List<Instruction> srcs; if (trace.BrRefs.TryGetValue(instr.Offset, out srcs)) { // Target of switch => assume unknown if (srcs.Any(src => src.Operand is Instruction[])) return true; // Not within current instruction block / targeted in first statement if (srcs.Any(src => src.Offset <= statements.First.Value.Last().Offset || src.Offset >= block.Instructions.Last().Offset)) return true; // Not targeted by the last of statements if (srcs.Any(src => statementLast.Contains(src))) return true; } return false; }); var switchInstr = new Instruction(OpCodes.Switch); var switchHdr = new List<Instruction>(); if (predicate != null) { predicate.Init(body); switchHdr.Add(Instruction.CreateLdcI4(predicate.GetSwitchKey(key[1]))); predicate.EmitSwitchLoad(switchHdr); } else { switchHdr.Add(Instruction.CreateLdcI4(key[1])); } switchHdr.Add(Instruction.Create(OpCodes.Dup)); switchHdr.Add(Instruction.Create(OpCodes.Stloc, local)); switchHdr.Add(Instruction.Create(OpCodes.Ldc_I4, statements.Count)); switchHdr.Add(Instruction.Create(OpCodes.Rem_Un)); switchHdr.Add(switchInstr); if (trace.BeforeStack[statements.Last.Value[0].Offset] == 0) { ctx.AddJump(switchHdr, statements.Last.Value[0]); } else { ctx.AddJump(switchHdr, switchHdr[0]); } ctx.AddJunk(switchHdr); var operands = new Instruction[statements.Count]; current = statements.First; i = 0; while (current.Next != null) { var newStatement = new List<Instruction>(current.Value); if (i != 0) { // Convert to switch bool converted = false; if (newStatement.Last().IsBr()) { // Unconditional var target = (Instruction)newStatement.Last().Operand; int brKey; if (!trace.IsBranchTarget(newStatement.Last().Offset) && statementKeys.TryGetValue(target, out brKey)) { if (trace.BeforeStack[target.Offset] == 0) { var targetKey = predicate != null ? predicate.GetSwitchKey(brKey) : brKey; var unkSrc = hasUnknownSource(newStatement); var initialBeforeStack = trace.BeforeStack[newStatement[0].Offset]; newStatement.RemoveAt(newStatement.Count - 1); if (unkSrc || initialBeforeStack != 0) { newStatement.Add(Instruction.Create(OpCodes.Ldc_I4, targetKey)); } else { var thisKey = key[i]; var r = ctx.Random.NextInt32(); newStatement.Add(Instruction.Create(OpCodes.Ldloc, local)); newStatement.Add(Instruction.CreateLdcI4(r)); newStatement.Add(Instruction.Create(OpCodes.Mul)); newStatement.Add(Instruction.Create(OpCodes.Ldc_I4, (thisKey * r) ^ targetKey)); newStatement.Add(Instruction.Create(OpCodes.Xor)); } ctx.AddJump(newStatement, switchHdr[1]); ctx.AddJunk(newStatement); } if (trace.BeforeStack[newStatement[0].Offset] == 0) { operands[keyId[i]] = newStatement[0]; } converted = true; } } else if (newStatement.Last().IsConditionalBranch()) { // Conditional var target = (Instruction)newStatement.Last().Operand; int brKey; if (!trace.IsBranchTarget(newStatement.Last().Offset) && statementKeys.TryGetValue(target, out brKey)) { if (trace.BeforeStack[target.Offset] == 0) { bool unkSrc = hasUnknownSource(newStatement); int nextKey = key[i + 1]; OpCode condBr = newStatement.Last().OpCode; newStatement.RemoveAt(newStatement.Count - 1); if (ctx.Random.NextBoolean()) { condBr = InverseBranch(condBr); int tmp = brKey; brKey = nextKey; nextKey = tmp; } var thisKey = key[i]; int r = 0, xorKey = 0; if (!unkSrc) { r = ctx.Random.NextInt32(); xorKey = thisKey * r; } Instruction brKeyInstr = Instruction.CreateLdcI4(xorKey ^ (predicate != null ? predicate.GetSwitchKey(brKey) : brKey)); Instruction nextKeyInstr = Instruction.CreateLdcI4(xorKey ^ (predicate != null ? predicate.GetSwitchKey(nextKey) : nextKey)); Instruction pop = Instruction.Create(OpCodes.Pop); newStatement.Add(Instruction.Create(condBr, brKeyInstr)); newStatement.Add(nextKeyInstr); newStatement.Add(Instruction.Create(OpCodes.Dup)); newStatement.Add(Instruction.Create(OpCodes.Br, pop)); newStatement.Add(brKeyInstr); newStatement.Add(Instruction.Create(OpCodes.Dup)); newStatement.Add(pop); if (!unkSrc) { newStatement.Add(Instruction.Create(OpCodes.Ldloc, local)); newStatement.Add(Instruction.CreateLdcI4(r)); newStatement.Add(Instruction.Create(OpCodes.Mul)); newStatement.Add(Instruction.Create(OpCodes.Xor)); } ctx.AddJump(newStatement, switchHdr[1]); ctx.AddJunk(newStatement); converted = true; } if (trace.BeforeStack[newStatement[0].Offset] == 0) { operands[keyId[i]] = newStatement[0]; } } } if (!converted) { // Normal if (newStatement[newStatement.Count - 1].OpCode != OpCodes.Ret) { var nextStatement = current.Next; if (trace.BeforeStack[nextStatement.Value[0].Offset] == 0) { var targetKey = predicate != null ? predicate.GetSwitchKey(key[i + 1]) : key[i + 1]; if (!hasUnknownSource(newStatement) && trace.BeforeStack[newStatement[0].Offset] == 0) { var thisKey = key[i]; var r = ctx.Random.NextInt32(); newStatement.Add(Instruction.Create(OpCodes.Ldloc, local)); newStatement.Add(Instruction.CreateLdcI4(r)); newStatement.Add(Instruction.Create(OpCodes.Mul)); newStatement.Add(Instruction.Create(OpCodes.Ldc_I4, (thisKey*r) ^ targetKey)); newStatement.Add(Instruction.Create(OpCodes.Xor)); } else { newStatement.Add(Instruction.Create(OpCodes.Ldc_I4, targetKey)); } ctx.AddJump(newStatement, switchHdr[1]); ctx.AddJunk(newStatement); } else { newStatement.Add(Instruction.Create(OpCodes.Br, nextStatement.Value[0])); } } if (trace.BeforeStack[newStatement[0].Offset] == 0) { operands[keyId[i]] = newStatement[0]; } } } else operands[keyId[i]] = switchHdr[0]; current.Value = newStatement.ToArray(); current = current.Next; i++; } if (trace.BeforeStack[current.Value[0].Offset] == 0) { operands[keyId[i]] = current.Value[0]; } for (i = 0; i < operands.Length; i++) { if (operands[i] == null) { operands[i] = switchHdr[0]; } } switchInstr.Operand = operands; Instruction[] first = statements.First.Value; statements.RemoveFirst(); Instruction[] last = statements.Last.Value; statements.RemoveLast(); List<Instruction[]> newStatements = statements.Where(s => trace.BeforeStack[s[0].Offset] == 0).ToList(); ctx.Random.Shuffle(newStatements); List<Instruction[]> newOrderedStatements = statements.Where(s => trace.BeforeStack[s[0].Offset] != 0).ToList(); block.Instructions.Clear(); block.Instructions.AddRange(first); block.Instructions.AddRange(switchHdr); foreach (var statement in newStatements) block.Instructions.AddRange(statement); foreach (var statement in newOrderedStatements) block.Instructions.AddRange(statement); block.Instructions.AddRange(last); } }
public override void Mangle(CilBody body, ScopeBlock root, CFContext ctx) { MethodTrace trace = ctx.Context.Registry.GetService <ITraceService>().Trace(ctx.Method); body.MaxStack += 2; IPredicate predicate = null; if (ctx.Predicate == PredicateType.Normal) { predicate = new NormalPredicate(ctx); } else if (ctx.Predicate == PredicateType.Expression) { predicate = new ExpressionPredicate(ctx); } else if (ctx.Predicate == PredicateType.x86) { predicate = new x86Predicate(ctx); } foreach (InstrBlock block in GetAllBlocks(root)) { LinkedList <Instruction[]> statements = SpiltStatements(block, trace, ctx); // Make sure .ctor is executed before switch if (ctx.Method.IsInstanceConstructor) { var newStatement = new List <Instruction>(); while (statements.First != null) { newStatement.AddRange(statements.First.Value); Instruction lastInstr = statements.First.Value.Last(); statements.RemoveFirst(); if (lastInstr.OpCode == OpCodes.Call && ((IMethod)lastInstr.Operand).Name == ".ctor") { break; } } statements.AddFirst(newStatement.ToArray()); } if (statements.Count < 3) { continue; } int[] key = Enumerable.Range(0, statements.Count).ToArray(); ctx.Random.Shuffle(key); var statementKeys = new Dictionary <Instruction, int>(); LinkedListNode <Instruction[]> current = statements.First; int i = 0; while (current != null) { if (i != 0) { statementKeys[current.Value[0]] = key[i]; } i++; current = current.Next; } var switchInstr = new Instruction(OpCodes.Switch); var switchHdr = new List <Instruction>(); if (predicate != null) { predicate.Init(body); switchHdr.Add(Instruction.CreateLdcI4(predicate.GetSwitchKey(key[1]))); predicate.EmitSwitchLoad(switchHdr); } else { switchHdr.Add(Instruction.CreateLdcI4(key[1])); } switchHdr.Add(switchInstr); ctx.AddJump(switchHdr, statements.Last.Value[0]); ctx.AddJunk(switchHdr); var operands = new Instruction[statements.Count]; current = statements.First; i = 0; while (current.Next != null) { var newStatement = new List <Instruction>(current.Value); if (i != 0) { // Convert to switch bool converted = false; if (newStatement.Last().IsBr()) { // Unconditional var target = (Instruction)newStatement.Last().Operand; int brKey; if (!trace.IsBranchTarget(trace.OffsetToIndexMap(newStatement.Last().Offset)) && statementKeys.TryGetValue(target, out brKey)) { newStatement.RemoveAt(newStatement.Count - 1); newStatement.Add(Instruction.CreateLdcI4(predicate != null ? predicate.GetSwitchKey(brKey) : brKey)); ctx.AddJump(newStatement, switchHdr[1]); ctx.AddJunk(newStatement); operands[key[i]] = newStatement[0]; converted = true; } } else if (newStatement.Last().IsConditionalBranch()) { // Conditional var target = (Instruction)newStatement.Last().Operand; int brKey; if (!trace.IsBranchTarget(trace.OffsetToIndexMap(newStatement.Last().Offset)) && statementKeys.TryGetValue(target, out brKey)) { int nextKey = key[i + 1]; OpCode condBr = newStatement.Last().OpCode; newStatement.RemoveAt(newStatement.Count - 1); if (ctx.Random.NextBoolean()) { condBr = InverseBranch(condBr); int tmp = brKey; brKey = nextKey; nextKey = tmp; } Instruction brKeyInstr = Instruction.CreateLdcI4(predicate != null ? predicate.GetSwitchKey(brKey) : brKey); Instruction nextKeyInstr = Instruction.CreateLdcI4(predicate != null ? predicate.GetSwitchKey(nextKey) : nextKey); Instruction pop = Instruction.Create(OpCodes.Pop); newStatement.Add(Instruction.Create(condBr, brKeyInstr)); newStatement.Add(nextKeyInstr); newStatement.Add(Instruction.Create(OpCodes.Dup)); newStatement.Add(Instruction.Create(OpCodes.Br, pop)); newStatement.Add(brKeyInstr); newStatement.Add(Instruction.Create(OpCodes.Dup)); newStatement.Add(pop); ctx.AddJump(newStatement, switchHdr[1]); ctx.AddJunk(newStatement); operands[key[i]] = newStatement[0]; converted = true; } } if (!converted) { // Normal newStatement.Add(Instruction.CreateLdcI4(predicate != null ? predicate.GetSwitchKey(key[i + 1]) : key[i + 1])); ctx.AddJump(newStatement, switchHdr[1]); ctx.AddJunk(newStatement); operands[key[i]] = newStatement[0]; } } else { operands[key[i]] = switchHdr[0]; } current.Value = newStatement.ToArray(); current = current.Next; i++; } operands[key[i]] = current.Value[0]; switchInstr.Operand = operands; Instruction[] first = statements.First.Value; statements.RemoveFirst(); Instruction[] last = statements.Last.Value; statements.RemoveLast(); List <Instruction[]> newStatements = statements.ToList(); ctx.Random.Shuffle(newStatements); block.Instructions.Clear(); block.Instructions.AddRange(first); block.Instructions.AddRange(switchHdr); foreach (var statement in newStatements) { block.Instructions.AddRange(statement); } block.Instructions.AddRange(last); } }
public static ScopeBlock ParseBody(CilBody body) { var ehScopes = new Dictionary <ExceptionHandler, Tuple <ScopeBlock, ScopeBlock, ScopeBlock> >(); foreach (ExceptionHandler eh in body.ExceptionHandlers) { var tryBlock = new ScopeBlock(BlockType.Try, eh); var handlerType = BlockType.Handler; if (eh.HandlerType == ExceptionHandlerType.Finally) { handlerType = BlockType.Finally; } else if (eh.HandlerType == ExceptionHandlerType.Fault) { handlerType = BlockType.Fault; } var handlerBlock = new ScopeBlock(handlerType, eh); if (eh.FilterStart != null) { var filterBlock = new ScopeBlock(BlockType.Filter, eh); ehScopes[eh] = Tuple.Create(tryBlock, handlerBlock, filterBlock); } else { ehScopes[eh] = Tuple.Create(tryBlock, handlerBlock, (ScopeBlock)null); } } var root = new ScopeBlock(BlockType.Normal, null); var scopeStack = new Stack <ScopeBlock>(); scopeStack.Push(root); foreach (Instruction instr in body.Instructions) { foreach (ExceptionHandler eh in body.ExceptionHandlers) { Tuple <ScopeBlock, ScopeBlock, ScopeBlock> ehScope = ehScopes[eh]; if (instr == eh.TryEnd) { scopeStack.Pop(); } if (instr == eh.HandlerEnd) { scopeStack.Pop(); } if (eh.FilterStart != null && instr == eh.HandlerStart) { // Filter must precede handler immediately Debug.Assert(scopeStack.Peek().Type == BlockType.Filter); scopeStack.Pop(); } } foreach (ExceptionHandler eh in body.ExceptionHandlers.Reverse()) { Tuple <ScopeBlock, ScopeBlock, ScopeBlock> ehScope = ehScopes[eh]; ScopeBlock parent = scopeStack.Count > 0 ? scopeStack.Peek() : null; if (instr == eh.TryStart) { parent?.Children.Add(ehScope.Item1); scopeStack.Push(ehScope.Item1); } if (instr == eh.HandlerStart) { parent?.Children.Add(ehScope.Item2); scopeStack.Push(ehScope.Item2); } if (instr == eh.FilterStart) { parent?.Children.Add(ehScope.Item3); scopeStack.Push(ehScope.Item3); } } ScopeBlock scope = scopeStack.Peek(); if (!(scope.Children.LastOrDefault() is InstrBlock block)) { scope.Children.Add(block = new InstrBlock()); } block.Instructions.Add(instr); } foreach (ExceptionHandler eh in body.ExceptionHandlers) { if (eh.TryEnd == null) { scopeStack.Pop(); } if (eh.HandlerEnd == null) { scopeStack.Pop(); } } Debug.Assert(scopeStack.Count == 1); return(root); }
public override void Mangle(CilBody body, ScopeBlock root, CFContext ctx) { MethodTrace trace = ctx.Context.Registry.GetService<ITraceService>().Trace(ctx.Method); body.MaxStack += 2; IPredicate predicate = null; if (ctx.Predicate == PredicateType.Normal) { predicate = new NormalPredicate(ctx); } else if (ctx.Predicate == PredicateType.Expression) { predicate = new ExpressionPredicate(ctx); } else if (ctx.Predicate == PredicateType.x86) { predicate = new x86Predicate(ctx); } foreach (InstrBlock block in GetAllBlocks(root)) { LinkedList<Instruction[]> statements = SpiltStatements(block, trace, ctx); // Make sure .ctor is executed before switch if (ctx.Method.IsInstanceConstructor) { var newStatement = new List<Instruction>(); while (statements.First != null) { newStatement.AddRange(statements.First.Value); Instruction lastInstr = statements.First.Value.Last(); statements.RemoveFirst(); if (lastInstr.OpCode == OpCodes.Call && ((IMethod)lastInstr.Operand).Name == ".ctor") break; } statements.AddFirst(newStatement.ToArray()); } if (statements.Count < 3) continue; int[] key = Enumerable.Range(0, statements.Count).ToArray(); ctx.Random.Shuffle(key); var statementKeys = new Dictionary<Instruction, int>(); LinkedListNode<Instruction[]> current = statements.First; int i = 0; while (current != null) { if (i != 0) statementKeys[current.Value[0]] = key[i]; i++; current = current.Next; } var switchInstr = new Instruction(OpCodes.Switch); var switchHdr = new List<Instruction>(); if (predicate != null) { predicate.Init(body); switchHdr.Add(Instruction.CreateLdcI4(predicate.GetSwitchKey(key[1]))); predicate.EmitSwitchLoad(switchHdr); } else { switchHdr.Add(Instruction.CreateLdcI4(key[1])); } switchHdr.Add(switchInstr); ctx.AddJump(switchHdr, statements.Last.Value[0]); ctx.AddJunk(switchHdr); var operands = new Instruction[statements.Count]; current = statements.First; i = 0; while (current.Next != null) { var newStatement = new List<Instruction>(current.Value); if (i != 0) { // Convert to switch bool converted = false; if (newStatement.Last().IsBr()) { // Unconditional var target = (Instruction)newStatement.Last().Operand; int brKey; if (!trace.IsBranchTarget(trace.OffsetToIndexMap(newStatement.Last().Offset)) && statementKeys.TryGetValue(target, out brKey)) { newStatement.RemoveAt(newStatement.Count - 1); newStatement.Add(Instruction.CreateLdcI4(predicate != null ? predicate.GetSwitchKey(brKey) : brKey)); ctx.AddJump(newStatement, switchHdr[1]); ctx.AddJunk(newStatement); operands[key[i]] = newStatement[0]; converted = true; } } else if (newStatement.Last().IsConditionalBranch()) { // Conditional var target = (Instruction)newStatement.Last().Operand; int brKey; if (!trace.IsBranchTarget(trace.OffsetToIndexMap(newStatement.Last().Offset)) && statementKeys.TryGetValue(target, out brKey)) { int nextKey = key[i + 1]; OpCode condBr = newStatement.Last().OpCode; newStatement.RemoveAt(newStatement.Count - 1); if (ctx.Random.NextBoolean()) { condBr = InverseBranch(condBr); int tmp = brKey; brKey = nextKey; nextKey = tmp; } Instruction brKeyInstr = Instruction.CreateLdcI4(predicate != null ? predicate.GetSwitchKey(brKey) : brKey); Instruction nextKeyInstr = Instruction.CreateLdcI4(predicate != null ? predicate.GetSwitchKey(nextKey) : nextKey); Instruction pop = Instruction.Create(OpCodes.Pop); newStatement.Add(Instruction.Create(condBr, brKeyInstr)); newStatement.Add(nextKeyInstr); newStatement.Add(Instruction.Create(OpCodes.Dup)); newStatement.Add(Instruction.Create(OpCodes.Br, pop)); newStatement.Add(brKeyInstr); newStatement.Add(Instruction.Create(OpCodes.Dup)); newStatement.Add(pop); ctx.AddJump(newStatement, switchHdr[1]); ctx.AddJunk(newStatement); operands[key[i]] = newStatement[0]; converted = true; } } if (!converted) { // Normal newStatement.Add(Instruction.CreateLdcI4(predicate != null ? predicate.GetSwitchKey(key[i + 1]) : key[i + 1])); ctx.AddJump(newStatement, switchHdr[1]); ctx.AddJunk(newStatement); operands[key[i]] = newStatement[0]; } } else operands[key[i]] = switchHdr[0]; current.Value = newStatement.ToArray(); current = current.Next; i++; } operands[key[i]] = current.Value[0]; switchInstr.Operand = operands; Instruction[] first = statements.First.Value; statements.RemoveFirst(); Instruction[] last = statements.Last.Value; statements.RemoveLast(); List<Instruction[]> newStatements = statements.ToList(); ctx.Random.Shuffle(newStatements); block.Instructions.Clear(); block.Instructions.AddRange(first); block.Instructions.AddRange(switchHdr); foreach (var statement in newStatements) block.Instructions.AddRange(statement); block.Instructions.AddRange(last); } }
public static ScopeBlock ParseBody(CilBody body) { var ehScopes = new Dictionary<ExceptionHandler, Tuple<ScopeBlock, ScopeBlock, ScopeBlock>>(); foreach (ExceptionHandler eh in body.ExceptionHandlers) { var tryBlock = new ScopeBlock(BlockType.Try, eh); var handlerType = BlockType.Handler; if (eh.HandlerType == ExceptionHandlerType.Finally) handlerType = BlockType.Finally; else if (eh.HandlerType == ExceptionHandlerType.Fault) handlerType = BlockType.Fault; var handlerBlock = new ScopeBlock(handlerType, eh); if (eh.FilterStart != null) { var filterBlock = new ScopeBlock(BlockType.Filter, eh); ehScopes[eh] = Tuple.Create(tryBlock, handlerBlock, filterBlock); } else ehScopes[eh] = Tuple.Create(tryBlock, handlerBlock, (ScopeBlock)null); } var root = new ScopeBlock(BlockType.Normal, null); var scopeStack = new Stack<ScopeBlock>(); scopeStack.Push(root); foreach (Instruction instr in body.Instructions) { foreach (ExceptionHandler eh in body.ExceptionHandlers) { Tuple<ScopeBlock, ScopeBlock, ScopeBlock> ehScope = ehScopes[eh]; if (instr == eh.TryEnd) scopeStack.Pop(); if (instr == eh.HandlerEnd) scopeStack.Pop(); if (eh.FilterStart != null && instr == eh.HandlerStart) { // Filter must precede handler immediately Debug.Assert(scopeStack.Peek().Type == BlockType.Filter); scopeStack.Pop(); } } foreach (ExceptionHandler eh in body.ExceptionHandlers.Reverse()) { Tuple<ScopeBlock, ScopeBlock, ScopeBlock> ehScope = ehScopes[eh]; ScopeBlock parent = scopeStack.Count > 0 ? scopeStack.Peek() : null; if (instr == eh.TryStart) { if (parent != null) parent.Children.Add(ehScope.Item1); scopeStack.Push(ehScope.Item1); } if (instr == eh.HandlerStart) { if (parent != null) parent.Children.Add(ehScope.Item2); scopeStack.Push(ehScope.Item2); } if (instr == eh.FilterStart) { if (parent != null) parent.Children.Add(ehScope.Item3); scopeStack.Push(ehScope.Item3); } } ScopeBlock scope = scopeStack.Peek(); var block = scope.Children.LastOrDefault() as InstrBlock; if (block == null) scope.Children.Add(block = new InstrBlock()); block.Instructions.Add(instr); } foreach (ExceptionHandler eh in body.ExceptionHandlers) { if (eh.TryEnd == null) scopeStack.Pop(); if (eh.HandlerEnd == null) scopeStack.Pop(); } Debug.Assert(scopeStack.Count == 1); return root; }