Skip to content
This repository was archived by the owner on Nov 24, 2023. It is now read-only.

Commit bf8d85b

Browse files
AnErrupTionAnErrupTion
authored
New protections
- Bump version - Added Control Flow - Improved String Encryption - Added Stripping DOS Header - Improved code efficiency (i.e. analyzers) - Added Anti-De4dot - Improved Integer Encoding
1 parent f570ae5 commit bf8d85b

25 files changed

+559
-375
lines changed

‎LoGiC.NET.csproj

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
<DefineConstants>TRACE</DefineConstants>
3232
<ErrorReport>prompt</ErrorReport>
3333
<WarningLevel>4</WarningLevel>
34+
<Prefer32Bit>false</Prefer32Bit>
3435
</PropertyGroup>
3536
<PropertyGroup>
3637
<StartupObject>LoGiC.NET.Program</StartupObject>
@@ -56,12 +57,15 @@
5657
<ItemGroup>
5758
<Compile Include="Program.cs" />
5859
<Compile Include="Properties\AssemblyInfo.cs" />
60+
<Compile Include="Protections\AntiDe4dot.cs" />
5961
<Compile Include="Protections\AntiTamper.cs" />
62+
<Compile Include="Protections\ControlFlow.cs" />
6063
<Compile Include="Protections\IntEncoding.cs" />
6164
<Compile Include="Protections\JunkMethods.cs" />
6265
<Compile Include="Protections\ProxyAdder.cs" />
6366
<Compile Include="Protections\Renamer.cs" />
6467
<Compile Include="Protections\StringEncryption.cs" />
68+
<Compile Include="Protections\StripDOSHeader.cs" />
6569
<Compile Include="Utils\Analyzer\DefAnalyzer.cs" />
6670
<Compile Include="Utils\Analyzer\EventDefAnalyzer.cs" />
6771
<Compile Include="Utils\Analyzer\FieldDefAnalyzer.cs" />

‎Program.cs

Lines changed: 23 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
using System;
22
using System.IO;
33
using dnlib.DotNet;
4-
using dnlib.DotNet.Writer;
54
using LoGiC.NET.Protections;
65
using SharpConfigParser;
76
using LoGiC.NET.Utils;
@@ -20,10 +19,12 @@ class Program
2019

2120
public static string FilePath { get; set; }
2221

22+
public static MemoryStream Stream = new MemoryStream();
23+
2324
static void Main(string[] args)
2425
{
2526
Console.WriteLine("Drag & drop your file : ");
26-
string path = Console.ReadLine();
27+
string path = Console.ReadLine().Replace("\"", string.Empty);
2728

2829
Console.WriteLine("Preparing obfuscation...");
2930
if (!File.Exists("config.txt"))
@@ -35,6 +36,8 @@ static void Main(string[] args)
3536
ForceWinForms = bool.Parse(p.Read("ForceWinFormsCompatibility").ReadResponse().ReplaceSpaces());
3637
DontRename = bool.Parse(p.Read("DontRename").ReadResponse().ReplaceSpaces());
3738

39+
Randomizer.Initialize();
40+
3841
obfuscation:
3942
Module = ModuleDefMD.Load(path);
4043
FileExtension = Path.GetExtension(path);
@@ -48,25 +51,35 @@ static void Main(string[] args)
4851
Console.WriteLine("Adding proxy calls...");
4952
ProxyAdder.Execute();
5053

51-
Console.WriteLine("Encoding ints...");
52-
IntEncoding.Execute();
53-
5454
Console.WriteLine("Encrypting strings...");
5555
StringEncryption.Execute();
5656

5757
Console.WriteLine("Injecting Anti-Tamper...");
5858
AntiTamper.Execute();
5959

60+
Console.WriteLine("Executing Anti-De4dot...");
61+
AntiDe4dot.Execute();
62+
63+
Console.WriteLine("Executing Control Flow...");
64+
ControlFlow.Execute();
65+
66+
Console.WriteLine("Encoding ints...");
67+
IntEncoding.Execute();
68+
6069
Console.WriteLine("Watermarking...");
6170
Watermark.AddAttribute();
6271

6372
Console.WriteLine("Saving file...");
64-
FilePath = @"C:\Users\" + Environment.UserName + @"\Desktop\" + Path.GetFileNameWithoutExtension(path) + "_protected" +
65-
FileExtension;
66-
ModuleWriterOptions opts = new ModuleWriterOptions(Module) { Logger = DummyLogger.NoThrowInstance };
67-
Module.Write(FilePath, opts);
73+
FilePath = @"C:\Users\" + Environment.UserName + @"\Desktop\" + Path.GetFileNameWithoutExtension(path) + "_protected" + FileExtension;
74+
Module.Write(Stream, new dnlib.DotNet.Writer.ModuleWriterOptions(Module) { Logger = DummyLogger.NoThrowInstance });
75+
76+
StripDOSHeader.Execute();
77+
78+
// Save stream to file
79+
File.WriteAllBytes(FilePath, Stream.ToArray());
6880

69-
if (AntiTamper.HasBeenTampered) AntiTamper.InjectMd5(FilePath);
81+
if (AntiTamper.Tampered)
82+
AntiTamper.Inject(FilePath);
7083

7184
Console.WriteLine("Done! Press any key to exit...");
7285
Console.ReadKey();

‎Properties/AssemblyInfo.cs

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,12 @@
77
// l'ensemble d'attributs suivant. Changez les valeurs de ces attributs pour modifier les informations
88
// associées à un assembly.
99
[assembly: AssemblyTitle("LoGiC.NET")]
10-
[assembly: AssemblyDescription("A free and open-source complex .NET obfuscator using dnlib.")]
10+
[assembly: AssemblyDescription("A free, open-source and complex .NET obfuscator using dnlib.")]
1111
[assembly: AssemblyConfiguration("")]
12-
[assembly: AssemblyCompany("B3RAP Softwares")]
12+
[assembly: AssemblyCompany("Sartox Free Software")]
1313
[assembly: AssemblyProduct("LoGiC.NET")]
14-
[assembly: AssemblyCopyright("© AnErrupTion 2020")]
15-
[assembly: AssemblyTrademark("B3RAP Softwares")]
14+
[assembly: AssemblyCopyright("© AnErrupTion 2021")]
15+
[assembly: AssemblyTrademark("Sartox Free Software")]
1616
[assembly: AssemblyCulture("")]
1717

1818
// L'affectation de la valeur false à ComVisible rend les types invisibles dans cet assembly
@@ -33,6 +33,6 @@
3333
// Vous pouvez spécifier toutes les valeurs ou indiquer les numéros de build et de révision par défaut
3434
// en utilisant '*', comme indiqué ci-dessous :
3535
// [assembly: AssemblyVersion("1.0.*")]
36-
[assembly: AssemblyVersion("1.4.0.0")]
37-
[assembly: AssemblyFileVersion("1.4.0.0")]
36+
[assembly: AssemblyVersion("1.5.0.0")]
37+
[assembly: AssemblyFileVersion("1.5.0.0")]
3838
[assembly: NeutralResourcesLanguage("en-US")]

‎Protections/AntiDe4dot.cs

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
using dnlib.DotNet;
2+
3+
namespace LoGiC.NET.Protections
4+
{
5+
public class AntiDe4dot
6+
{
7+
public static void Execute()
8+
{
9+
foreach (ModuleDef module in Program.Module.Assembly.Modules)
10+
{
11+
InterfaceImplUser int1 = new InterfaceImplUser(module.GlobalType);
12+
for (int i = 0; i < 1; i++)
13+
{
14+
TypeDefUser typeDef1 = new TypeDefUser(string.Empty, $"Form{i}", module.CorLibTypes.GetTypeRef("System", "Attribute"));
15+
InterfaceImplUser int2 = new InterfaceImplUser(typeDef1);
16+
17+
module.Types.Add(typeDef1);
18+
19+
typeDef1.Interfaces.Add(int2);
20+
typeDef1.Interfaces.Add(int1);
21+
}
22+
}
23+
}
24+
}
25+
}

‎Protections/AntiTamper.cs

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -12,22 +12,24 @@ public class AntiTamper : Randomizer
1212
{
1313
// Thanks to the EOF Anti-Tamper project by Xenocode on GitHub!
1414

15-
public static bool HasBeenTampered { get; set; }
15+
public static bool Tampered { get; set; }
1616

17-
public static void InjectMd5(string filePath)
17+
public static void Inject(string filePath)
1818
{
19-
byte[] md5bytes = MD5.Create().ComputeHash(File.ReadAllBytes(filePath));
20-
FileStream fs = new FileStream(filePath, FileMode.Append);
21-
fs.Write(md5bytes, 0, md5bytes.Length);
22-
fs.Close();
19+
byte[] bytes;
20+
21+
using (MD5 hash = MD5.Create())
22+
bytes = hash.ComputeHash(File.ReadAllBytes(filePath));
23+
24+
using (FileStream fs = new FileStream(filePath, FileMode.Append))
25+
fs.Write(bytes, 0, bytes.Length);
2326
}
2427

2528
public static void Execute()
2629
{
2730
ModuleDefMD typeModule = ModuleDefMD.Load(typeof(TamperClass).Module);
2831
TypeDef typeDef = typeModule.ResolveTypeDef(MDToken.ToRID(typeof(TamperClass).MetadataToken));
29-
IEnumerable<IDnlibDef> members = InjectHelper.Inject(typeDef, Program.Module.GlobalType,
30-
Program.Module);
32+
IEnumerable<IDnlibDef> members = InjectHelper.Inject(typeDef, Program.Module.GlobalType, Program.Module);
3133
MethodDef init = (MethodDef)members.Single(method => method.Name == "NoTampering");
3234
init.GetRenamed();
3335

@@ -41,7 +43,7 @@ public static void Execute()
4143
break;
4244
}
4345

44-
HasBeenTampered = true;
46+
Tampered = true;
4547
}
4648
}
4749
}

‎Protections/ControlFlow.cs

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
using dnlib.DotNet;
2+
using dnlib.DotNet.Emit;
3+
using LoGiC.NET.Utils;
4+
using System;
5+
6+
namespace LoGiC.NET.Protections
7+
{
8+
public class ControlFlow
9+
{
10+
public static void Execute()
11+
{
12+
int amount = 0;
13+
14+
for (int x = 0; x < Program.Module.Types.Count; x++)
15+
{
16+
TypeDef tDef = Program.Module.Types[x];
17+
18+
for (int i = 0; i < tDef.Methods.Count; i++)
19+
{
20+
MethodDef mDef = tDef.Methods[i];
21+
22+
if (!mDef.Name.StartsWith("get_") && !mDef.Name.StartsWith("set_"))
23+
{
24+
if (!mDef.HasBody || mDef.IsConstructor) continue;
25+
26+
mDef.Body.SimplifyBranches();
27+
ExecuteMethod(mDef);
28+
29+
amount++;
30+
}
31+
}
32+
}
33+
}
34+
35+
private static void ExecuteMethod(MethodDef method)
36+
{
37+
for (int i = 0; i < method.Body.Instructions.Count; i++)
38+
if (method.Body.Instructions[i].IsLdcI4())
39+
{
40+
int numorig = Randomizer.Next();
41+
int div = Randomizer.Next();
42+
43+
int num = numorig ^ div;
44+
45+
Instruction nop = OpCodes.Nop.ToInstruction();
46+
Local local = new Local(method.Module.ImportAsTypeSig(typeof(InsufficientMemoryException)));
47+
Instruction localCode = OpCodes.Stloc.ToInstruction(local);
48+
49+
method.Body.Variables.Add(local);
50+
51+
method.Body.Instructions.Insert(i + 1, localCode);
52+
method.Body.Instructions.Insert(i + 2, Instruction.Create(OpCodes.Ldc_I4, method.Body.Instructions[i].GetLdcI4Value() - sizeof(uint)));
53+
method.Body.Instructions.Insert(i + 3, Instruction.Create(OpCodes.Ldc_I4, num));
54+
method.Body.Instructions.Insert(i + 4, Instruction.Create(OpCodes.Ldc_I4, div));
55+
method.Body.Instructions.Insert(i + 5, Instruction.Create(OpCodes.Xor));
56+
method.Body.Instructions.Insert(i + 6, Instruction.Create(OpCodes.Ldc_I4, numorig));
57+
method.Body.Instructions.Insert(i + 7, Instruction.Create(OpCodes.Bne_Un, nop));
58+
method.Body.Instructions.Insert(i + 8, Instruction.Create(OpCodes.Ldc_I4, 2));
59+
method.Body.Instructions.Insert(i + 9, localCode);
60+
method.Body.Instructions.Insert(i + 10, Instruction.Create(OpCodes.Sizeof, method.Module.Import(typeof(InsufficientMemoryException))));
61+
method.Body.Instructions.Insert(i + 11, Instruction.Create(OpCodes.Add));
62+
method.Body.Instructions.Insert(i + 12, nop);
63+
64+
i += method.Body.Instructions.Count - i;
65+
}
66+
}
67+
}
68+
}

‎Protections/IntEncoding.cs

Lines changed: 25 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,4 @@
11
using System;
2-
using System.Collections.Generic;
3-
using System.Linq;
4-
using System.Text;
5-
using System.Threading.Tasks;
62
using dnlib.DotNet;
73
using dnlib.DotNet.Emit;
84
using LoGiC.NET.Utils;
@@ -26,13 +22,17 @@ public static void Execute()
2622
foreach (TypeDef type in Program.Module.Types)
2723
foreach (MethodDef method in type.Methods)
2824
{
29-
if (!method.HasBody) continue;
25+
if (!method.HasBody)
26+
continue;
27+
3028
for (int i = 0; i < method.Body.Instructions.Count; i++)
3129
if (method.Body.Instructions[i].IsLdcI4())
3230
{
33-
// The Absolute method.
3431
int operand = method.Body.Instructions[i].GetLdcI4Value();
35-
if (operand <= 0) continue; // Prevents errors.
32+
if (operand <= 0) // Prevents errors.
33+
continue;
34+
35+
// The Absolute method.
3636
method.Body.Instructions.Insert(i + 1, OpCodes.Call.ToInstruction(
3737
Program.Module.Import(typeof(Math).GetMethod("Abs", new Type[] { typeof(int) }))));
3838

@@ -43,6 +43,24 @@ public static void Execute()
4343
method.Body.Instructions.Insert(i + 1, OpCodes.Call.ToInstruction(
4444
Program.Module.Import(typeof(string).GetMethod("get_Length"))));*/
4545

46+
// The Negative method.
47+
for (var j = 0; j < 8; j++)
48+
method.Body.Instructions.Insert(i + j + 1, Instruction.Create(OpCodes.Neg));
49+
50+
// The Max method.
51+
/*if (operand > 1)
52+
{
53+
method.Body.Instructions.Insert(i + 1, OpCodes.Ldc_I4.ToInstruction(1));
54+
method.Body.Instructions.Insert(i + 2, OpCodes.Call.ToInstruction(Program.Module.Import(typeof(Math).GetMethod("Max", new Type[] { typeof(int), typeof(int) }))));
55+
}*/
56+
57+
// The Min method.
58+
if (operand < int.MaxValue)
59+
{
60+
method.Body.Instructions.Insert(i + 1, OpCodes.Ldc_I4.ToInstruction(int.MaxValue));
61+
method.Body.Instructions.Insert(i + 2, OpCodes.Call.ToInstruction(Program.Module.Import(typeof(Math).GetMethod("Min", new Type[] { typeof(int), typeof(int) }))));
62+
}
63+
4664
++Amount;
4765
}
4866
}

‎Protections/JunkMethods.cs

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,5 @@
11
using System;
2-
using System.Collections.Generic;
32
using System.Linq;
4-
using System.Text;
5-
using System.Threading.Tasks;
63
using LoGiC.NET.Utils;
74
using dnlib.DotNet;
85
using dnlib.DotNet.Emit;
@@ -26,8 +23,7 @@ public static void Execute()
2623
if (type.IsGlobalModuleType) continue;
2724
foreach (MethodDef _ in type.Methods.ToArray())
2825
{
29-
MethodDef strings = CreateReturnMethodDef(GenerateRandomString(MemberRenamer
30-
.StringLength()), Program.Module);
26+
MethodDef strings = CreateReturnMethodDef(Generated, Program.Module);
3127
MethodDef ints = CreateReturnMethodDef(MemberRenamer.StringLength(), Program.Module);
3228
type.Methods.Add(strings);
3329
++Amount;
@@ -47,8 +43,7 @@ private static MethodDef CreateReturnMethodDef(object value, ModuleDefMD module)
4743
if (value is int) corlib = module.CorLibTypes.Int32;
4844
else if (value is string) corlib = module.CorLibTypes.String;
4945

50-
MethodDef newMethod = new MethodDefUser(GenerateRandomString(MemberRenamer.StringLength()),
51-
MethodSig.CreateStatic(corlib, corlib),
46+
MethodDef newMethod = new MethodDefUser(Generated, MethodSig.CreateStatic(corlib, corlib),
5247
MethodImplAttributes.IL | MethodImplAttributes.Managed,
5348
MethodAttributes.Public | MethodAttributes.Static | MethodAttributes.HideBySig)
5449
{

0 commit comments

Comments
 (0)