public static MethodDef findfunc(string name) { return(startUpType.FindMethod(name)); }
public static void DefType(ref ModuleDef moduleDef) { var classUser = new TypeDefUser("MadnessNET.Protector", "Deshifrator", moduleDef.CorLibTypes.Object.TypeDefOrRef); classUser.Attributes = TypeAttributes.Public | TypeAttributes.Abstract | TypeAttributes.Sealed | TypeAttributes.Class; moduleDef.Types.Add(classUser); /* * var field1 = new FieldDefUser("MyField", * new FieldSig(moduleDef.CorLibTypes.Int32), * FieldAttributes.Public | * FieldAttributes.Static); * classUser.Fields.Add(field1); */ var methodImplFlags = MethodImplAttributes.IL | MethodImplAttributes.Managed; var methodFlags = MethodAttributes.Public | MethodAttributes.Static; var decryptMethod = new MethodDefUser( "StringDecryptor", MethodSig.CreateStatic( moduleDef.CorLibTypes.String, moduleDef.CorLibTypes.String), methodImplFlags, methodFlags); classUser.Methods.Add(decryptMethod); MethodDef method = classUser.FindMethod("StringDecryptor"); method.MethodBody = new CilBody(); Importer importer = new Importer(moduleDef); ITypeDefOrRef byteArrayRef = importer.Import(typeof(System.Byte[])); Instruction instruction_Ldloc_1 = Instruction.Create(OpCodes.Ldloc_1); Instruction instruction_Ldloc_0 = Instruction.Create(OpCodes.Ldloc_0); method.Body.Variables.Locals.Add(new Local(byteArrayRef.ToTypeSig())); method.Body.Variables.Locals.Add(new Local(method.Module.CorLibTypes.Int32)); method.Body.Instructions.Add(new Instruction(OpCodes.Call, moduleDef.Import(typeof(System.Text.Encoding).GetMethod("get_ASCII", new Type[] { })))); method.Body.Instructions.Add(new Instruction(OpCodes.Ldarg_0)); method.Body.Instructions.Add(new Instruction(OpCodes.Callvirt, moduleDef.Import(typeof(System.Text.Encoding).GetMethod("GetBytes", new Type[] { typeof(string) })))); method.Body.Instructions.Add(new Instruction(OpCodes.Stloc_0)); method.Body.Instructions.Add(new Instruction(OpCodes.Ldc_I4_0)); method.Body.Instructions.Add(new Instruction(OpCodes.Stloc_1)); method.Body.Instructions.Add(new Instruction(OpCodes.Br_S, instruction_Ldloc_1)); method.Body.Instructions.Add(instruction_Ldloc_0); method.Body.Instructions.Add(new Instruction(OpCodes.Ldloc_1)); method.Body.Instructions.Add(new Instruction(OpCodes.Ldelema, moduleDef.Import(typeof(System.Byte)))); method.Body.Instructions.Add(new Instruction(OpCodes.Dup)); method.Body.Instructions.Add(new Instruction(OpCodes.Ldind_U1)); method.Body.Instructions.Add(new Instruction(OpCodes.Ldc_I4_1)); method.Body.Instructions.Add(new Instruction(OpCodes.Sub)); method.Body.Instructions.Add(new Instruction(OpCodes.Conv_U1)); method.Body.Instructions.Add(new Instruction(OpCodes.Stind_I1)); method.Body.Instructions.Add(new Instruction(OpCodes.Ldloc_1)); method.Body.Instructions.Add(new Instruction(OpCodes.Ldc_I4_1)); method.Body.Instructions.Add(new Instruction(OpCodes.Add)); method.Body.Instructions.Add(new Instruction(OpCodes.Stloc_1)); method.Body.Instructions.Add(instruction_Ldloc_1); method.Body.Instructions.Add(new Instruction(OpCodes.Ldloc_0)); method.Body.Instructions.Add(new Instruction(OpCodes.Ldlen)); method.Body.Instructions.Add(new Instruction(OpCodes.Conv_I4)); method.Body.Instructions.Add(new Instruction(OpCodes.Blt_S, instruction_Ldloc_0)); method.Body.Instructions.Add(new Instruction(OpCodes.Call, moduleDef.Import(typeof(System.Text.Encoding).GetMethod("get_ASCII", new Type[] { })))); method.Body.Instructions.Add(new Instruction(OpCodes.Ldloc_0)); method.Body.Instructions.Add(new Instruction(OpCodes.Callvirt, moduleDef.Import(typeof(System.Text.Encoding).GetMethod("GetString", new Type[] { typeof(byte[]) })))); method.Body.Instructions.Add(new Instruction(OpCodes.Ret)); method.Body.OptimizeBranches(); method.Body.SimplifyBranches(); }
protected MethodDef createProxy(ModuleDef moduleDef, MethodDef target) { MethodSig proxy_signature = createProxySig(moduleDef, target); TypeDefUser new_type = new TypeDefUser("DEFAULT_TYPE_DEF" + target.FullName); new_type.Attributes |= TypeAttributes.Public | TypeAttributes.AutoClass; // Creating delegate type. // TODO: Add caching system. // TODO: Add string parameter support to make string parameter "Obfuscated by Wisser Tg" TypeDefUser new_delegate = new TypeDefUser("Delegate_" + target.FullName, moduleDef.CorLibTypes.GetTypeRef("System", "MulticastDelegate")); new_delegate.Attributes = target.ResolveMethodDefThrow().DeclaringType.Attributes; { MethodDefUser ctor = new MethodDefUser(".ctor", MethodSig.CreateInstance(moduleDef.CorLibTypes.Void, moduleDef.CorLibTypes.Object, moduleDef.CorLibTypes.IntPtr)); ctor.Attributes = MethodAttributes.Assembly | MethodAttributes.HideBySig | MethodAttributes.RTSpecialName | MethodAttributes.SpecialName; ctor.ImplAttributes = MethodImplAttributes.Runtime; MethodDefUser invoke = new MethodDefUser("Invoke", proxy_signature.Clone()); invoke.MethodSig.HasThis = true; invoke.ImplAttributes = MethodImplAttributes.Runtime; invoke.Attributes = MethodAttributes.Assembly | MethodAttributes.HideBySig | MethodAttributes.Virtual | MethodAttributes.NewSlot | MethodAttributes.Public; new_delegate.Methods.Add(invoke); new_delegate.Methods.Add(ctor); moduleDef.Types.Add(new_delegate); } FieldDefUser field = new FieldDefUser("Delegate_holder_", new FieldSig(new ClassSig(new_delegate)), FieldAttributes.Private | FieldAttributes.Static); { ModuleDefMD mscorlib = ModuleDefMD.Load(typeof(void).Assembly.Modules.First()); MethodDef cctor = target.DeclaringType.FindOrCreateStaticConstructor(); if (cctor.Body.Instructions.Last().OpCode == OpCodes.Ret) { cctor.Body.Instructions.Remove(cctor.Body.Instructions.Last()); } cctor.Body.Instructions.Add(OpCodes.Nop.ToInstruction()); cctor.Body.Instructions.Add(OpCodes.Ldtoken.ToInstruction(new_delegate)); cctor.Body.Instructions.Add(OpCodes.Call.ToInstruction(mscorlib.Find("System.Type", true).FindMethod("GetTypeFromHandle"))); cctor.Body.Instructions.Add(OpCodes.Ldtoken.ToInstruction(moduleDef.Import(target.DeclaringType))); cctor.Body.Instructions.Add(OpCodes.Call.ToInstruction(mscorlib.Find("System.Type", true).FindMethod("GetTypeFromHandle"))); cctor.Body.Instructions.Add(OpCodes.Callvirt.ToInstruction(mscorlib.Import(mscorlib.Find("System.Reflection.Module", true).FindMethod("get_Module")))); cctor.Body.Instructions.Add(OpCodes.Ldc_I4.ToInstruction((int)target.MDToken.Raw)); cctor.Body.Instructions.Add(OpCodes.Callvirt.ToInstruction(mscorlib.Import(mscorlib.Find("System.Reflection.Module", true).FindMethod("ResolveMethod")))); cctor.Body.Instructions.Add(OpCodes.Isinst.ToInstruction(mscorlib.Import(mscorlib.Find("System.Reflection.MethodInfo", true)))); var b = mscorlib.Find("System.Delegate", true).FindMethod("CreateDelegate", MethodSig.CreateStatic(mscorlib.Find("System.Delegate", true).ToTypeSig(), mscorlib.Find("System.Type", true).ToTypeSig(), mscorlib.Find("System.Reflection.MethodInfo", true).ToTypeSig())); cctor.Body.Instructions.Add(OpCodes.Call.ToInstruction(mscorlib.Find("System.Delegate", true).FindMethod("CreateDelegate", MethodSig.CreateStatic(mscorlib.Find("System.Delegate", true).ToTypeSig(), mscorlib.Find("System.Type", true).ToTypeSig(), mscorlib.Find("System.Reflection.MethodInfo", true).ToTypeSig())))); cctor.Body.Instructions.Add(OpCodes.Castclass.ToInstruction(new_delegate)); cctor.Body.Instructions.Add(OpCodes.Stsfld.ToInstruction(field)); cctor.Body.Instructions.Add(OpCodes.Ret.ToInstruction()); // TODO: Check for Ret instruction existance. } MethodDefUser proxy_methodDef = new MethodDefUser("Proxy_method__" + target.FullName, proxy_signature); proxy_methodDef.Attributes = MethodAttributes.PrivateScope | MethodAttributes.Static; proxy_methodDef.ImplAttributes = MethodImplAttributes.Managed | MethodImplAttributes.IL; proxy_methodDef.Body = new CilBody(); proxy_methodDef.Body.Instructions.Add(OpCodes.Ldsfld.ToInstruction(field)); for (int i = 0; i < target.Parameters.Count; i++) { proxy_methodDef.Body.Instructions.Add(OpCodes.Ldarg.ToInstruction(proxy_methodDef.Parameters[i])); } proxy_methodDef.Body.Instructions.Add(OpCodes.Callvirt.ToInstruction(new_delegate.FindMethod("Invoke"))); proxy_methodDef.Body.Instructions.Add(OpCodes.Ret.ToInstruction()); target.DeclaringType.Methods.Add(proxy_methodDef); return(proxy_methodDef); }