├── .vs └── Obfu_Net │ ├── FileContentIndex │ ├── read.lock │ ├── 8bc4d572-6599-4af8-9a43-35de51b7b999.vsidx │ ├── 90e4b0a2-ebf4-4b5d-aa17-4d7a34d9506b.vsidx │ ├── b04bf37f-8145-4ca5-9700-8bd5007ff10c.vsidx │ └── d3989a95-f492-4eba-99ed-b6e7f7b8aae2.vsidx │ └── v17 │ └── .suo ├── Obfu_Net ├── obj │ ├── Debug │ │ ├── Obfu_Net.csproj.CopyComplete │ │ ├── Obfu_Net.csproj.SuggestedBindingRedirects.cache │ │ ├── Obfu_Net.csproj.CoreCompileInputs.cache │ │ ├── Obfu_Net.exe │ │ ├── Obfu_Net.pdb │ │ ├── Obfu_Net.csproj.AssemblyReference.cache │ │ ├── DesignTimeResolveAssemblyReferencesInput.cache │ │ ├── .NETFramework,Version=v4.8.AssemblyAttributes.cs │ │ └── Obfu_Net.csproj.FileListAbsolute.txt │ └── Release │ │ ├── Obfu_Net.csproj.CopyComplete │ │ ├── Obfu_Net.csproj.SuggestedBindingRedirects.cache │ │ ├── Obfu_Net.csproj.CoreCompileInputs.cache │ │ ├── Obfu_Net.exe │ │ ├── Obfu_Net.pdb │ │ ├── Obfu_Net.csproj.AssemblyReference.cache │ │ ├── .NETFramework,Version=v4.8.AssemblyAttributes.cs │ │ └── Obfu_Net.csproj.FileListAbsolute.txt ├── VersionInfo1.aps ├── bin │ ├── Debug │ │ ├── dnlib.dll │ │ ├── xxxx.exe │ │ ├── Certify.exe │ │ ├── Rubeus.exe │ │ ├── Obfu_Net.exe │ │ ├── Obfu_Net.pdb │ │ ├── ProcessHacker.exe │ │ ├── Process_Hacker.exe │ │ ├── Rubeus.exe._obf.exe │ │ ├── Certify.exe._obf.exe │ │ ├── ProcessHacker.exe._obf.exe │ │ ├── Process_Hacker.exe._obf.exe │ │ ├── Obfu_Net.exe.config │ │ └── example.txt │ └── Release │ │ ├── dnlib.dll │ │ ├── Certify.exe │ │ ├── Obfu_Net.exe │ │ ├── Obfu_Net.pdb │ │ ├── Rubeus.exe │ │ ├── basdsfdsdf.exe │ │ ├── Rubeus.exe._obf.exe │ │ ├── Certify.exe._obf.exe │ │ ├── basdsfdsdf.exe._obf.exe │ │ └── Obfu_Net.exe.config ├── packages.config ├── App.config ├── Properties │ └── AssemblyInfo.cs ├── Program.cs ├── Obfu_Net.csproj ├── StringEncrypt.cs └── MethodNameChange.cs ├── packages └── dnlib.4.3.0 │ ├── .signature.p7s │ ├── dnlib.4.3.0.nupkg │ ├── lib │ ├── net35 │ │ └── dnlib.dll │ ├── net45 │ │ └── dnlib.dll │ ├── net6.0 │ │ └── dnlib.dll │ └── netstandard2.0 │ │ └── dnlib.dll │ └── LICENSE.txt ├── README.md └── Obfu_Net.sln /.vs/Obfu_Net/FileContentIndex/read.lock: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /Obfu_Net/obj/Debug/Obfu_Net.csproj.CopyComplete: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /Obfu_Net/obj/Release/Obfu_Net.csproj.CopyComplete: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /Obfu_Net/obj/Debug/Obfu_Net.csproj.SuggestedBindingRedirects.cache: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /Obfu_Net/obj/Release/Obfu_Net.csproj.SuggestedBindingRedirects.cache: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /Obfu_Net/obj/Debug/Obfu_Net.csproj.CoreCompileInputs.cache: -------------------------------------------------------------------------------- 1 | 5855d05e23496e2aa445bc2469281457bce8b065 2 | -------------------------------------------------------------------------------- /Obfu_Net/obj/Release/Obfu_Net.csproj.CoreCompileInputs.cache: -------------------------------------------------------------------------------- 1 | 0058e4898ff5fbe972aba1b652e02bc8f9c0b9e6 2 | -------------------------------------------------------------------------------- /.vs/Obfu_Net/v17/.suo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/.vs/Obfu_Net/v17/.suo -------------------------------------------------------------------------------- /Obfu_Net/VersionInfo1.aps: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/VersionInfo1.aps -------------------------------------------------------------------------------- /Obfu_Net/bin/Debug/dnlib.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Debug/dnlib.dll -------------------------------------------------------------------------------- /Obfu_Net/bin/Debug/xxxx.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Debug/xxxx.exe -------------------------------------------------------------------------------- /Obfu_Net/bin/Debug/Certify.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Debug/Certify.exe -------------------------------------------------------------------------------- /Obfu_Net/bin/Debug/Rubeus.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Debug/Rubeus.exe -------------------------------------------------------------------------------- /Obfu_Net/bin/Release/dnlib.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Release/dnlib.dll -------------------------------------------------------------------------------- /Obfu_Net/bin/Debug/Obfu_Net.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Debug/Obfu_Net.exe -------------------------------------------------------------------------------- /Obfu_Net/bin/Debug/Obfu_Net.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Debug/Obfu_Net.pdb -------------------------------------------------------------------------------- /Obfu_Net/bin/Release/Certify.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Release/Certify.exe -------------------------------------------------------------------------------- /Obfu_Net/bin/Release/Obfu_Net.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Release/Obfu_Net.exe -------------------------------------------------------------------------------- /Obfu_Net/bin/Release/Obfu_Net.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Release/Obfu_Net.pdb -------------------------------------------------------------------------------- /Obfu_Net/bin/Release/Rubeus.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Release/Rubeus.exe -------------------------------------------------------------------------------- /Obfu_Net/obj/Debug/Obfu_Net.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/obj/Debug/Obfu_Net.exe -------------------------------------------------------------------------------- /Obfu_Net/obj/Debug/Obfu_Net.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/obj/Debug/Obfu_Net.pdb -------------------------------------------------------------------------------- /Obfu_Net/obj/Release/Obfu_Net.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/obj/Release/Obfu_Net.exe -------------------------------------------------------------------------------- /Obfu_Net/obj/Release/Obfu_Net.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/obj/Release/Obfu_Net.pdb -------------------------------------------------------------------------------- /Obfu_Net/bin/Release/basdsfdsdf.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Release/basdsfdsdf.exe -------------------------------------------------------------------------------- /packages/dnlib.4.3.0/.signature.p7s: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/packages/dnlib.4.3.0/.signature.p7s -------------------------------------------------------------------------------- /Obfu_Net/bin/Debug/ProcessHacker.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Debug/ProcessHacker.exe -------------------------------------------------------------------------------- /Obfu_Net/bin/Debug/Process_Hacker.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Debug/Process_Hacker.exe -------------------------------------------------------------------------------- /Obfu_Net/bin/Debug/Rubeus.exe._obf.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Debug/Rubeus.exe._obf.exe -------------------------------------------------------------------------------- /packages/dnlib.4.3.0/dnlib.4.3.0.nupkg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/packages/dnlib.4.3.0/dnlib.4.3.0.nupkg -------------------------------------------------------------------------------- /Obfu_Net/bin/Debug/Certify.exe._obf.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Debug/Certify.exe._obf.exe -------------------------------------------------------------------------------- /Obfu_Net/bin/Release/Rubeus.exe._obf.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Release/Rubeus.exe._obf.exe -------------------------------------------------------------------------------- /packages/dnlib.4.3.0/lib/net35/dnlib.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/packages/dnlib.4.3.0/lib/net35/dnlib.dll -------------------------------------------------------------------------------- /packages/dnlib.4.3.0/lib/net45/dnlib.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/packages/dnlib.4.3.0/lib/net45/dnlib.dll -------------------------------------------------------------------------------- /Obfu_Net/bin/Release/Certify.exe._obf.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Release/Certify.exe._obf.exe -------------------------------------------------------------------------------- /packages/dnlib.4.3.0/lib/net6.0/dnlib.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/packages/dnlib.4.3.0/lib/net6.0/dnlib.dll -------------------------------------------------------------------------------- /Obfu_Net/bin/Debug/ProcessHacker.exe._obf.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Debug/ProcessHacker.exe._obf.exe -------------------------------------------------------------------------------- /Obfu_Net/bin/Release/basdsfdsdf.exe._obf.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Release/basdsfdsdf.exe._obf.exe -------------------------------------------------------------------------------- /Obfu_Net/bin/Debug/Process_Hacker.exe._obf.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/bin/Debug/Process_Hacker.exe._obf.exe -------------------------------------------------------------------------------- /Obfu_Net/packages.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -------------------------------------------------------------------------------- /packages/dnlib.4.3.0/lib/netstandard2.0/dnlib.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/packages/dnlib.4.3.0/lib/netstandard2.0/dnlib.dll -------------------------------------------------------------------------------- /Obfu_Net/obj/Debug/Obfu_Net.csproj.AssemblyReference.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/obj/Debug/Obfu_Net.csproj.AssemblyReference.cache -------------------------------------------------------------------------------- /Obfu_Net/obj/Release/Obfu_Net.csproj.AssemblyReference.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/obj/Release/Obfu_Net.csproj.AssemblyReference.cache -------------------------------------------------------------------------------- /Obfu_Net/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/Obfu_Net/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache -------------------------------------------------------------------------------- /.vs/Obfu_Net/FileContentIndex/8bc4d572-6599-4af8-9a43-35de51b7b999.vsidx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/.vs/Obfu_Net/FileContentIndex/8bc4d572-6599-4af8-9a43-35de51b7b999.vsidx -------------------------------------------------------------------------------- /.vs/Obfu_Net/FileContentIndex/90e4b0a2-ebf4-4b5d-aa17-4d7a34d9506b.vsidx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/.vs/Obfu_Net/FileContentIndex/90e4b0a2-ebf4-4b5d-aa17-4d7a34d9506b.vsidx -------------------------------------------------------------------------------- /.vs/Obfu_Net/FileContentIndex/b04bf37f-8145-4ca5-9700-8bd5007ff10c.vsidx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/.vs/Obfu_Net/FileContentIndex/b04bf37f-8145-4ca5-9700-8bd5007ff10c.vsidx -------------------------------------------------------------------------------- /.vs/Obfu_Net/FileContentIndex/d3989a95-f492-4eba-99ed-b6e7f7b8aae2.vsidx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Quack2332/Simple-.NET-Obfuscator-PoC/HEAD/.vs/Obfu_Net/FileContentIndex/d3989a95-f492-4eba-99ed-b6e7f7b8aae2.vsidx -------------------------------------------------------------------------------- /Obfu_Net/App.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /Obfu_Net/bin/Debug/Obfu_Net.exe.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /Obfu_Net/bin/Release/Obfu_Net.exe.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /Obfu_Net/obj/Debug/.NETFramework,Version=v4.8.AssemblyAttributes.cs: -------------------------------------------------------------------------------- 1 | // 2 | using System; 3 | using System.Reflection; 4 | [assembly: global::System.Runtime.Versioning.TargetFrameworkAttribute(".NETFramework,Version=v4.8", FrameworkDisplayName = ".NET Framework 4.8")] 5 | -------------------------------------------------------------------------------- /Obfu_Net/obj/Release/.NETFramework,Version=v4.8.AssemblyAttributes.cs: -------------------------------------------------------------------------------- 1 | // 2 | using System; 3 | using System.Reflection; 4 | [assembly: global::System.Runtime.Versioning.TargetFrameworkAttribute(".NETFramework,Version=v4.8", FrameworkDisplayName = ".NET Framework 4.8")] 5 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Simple .NET Obfuscator 2 | 3 | Just a simple .NET Obfuscator using string encryption and changing the method names. 4 | 5 | More information can be found on the corresponding blog post https://www.ribbiting-sec.info/posts/2024-06-05_csharp_obfuscator/ 6 | 7 | ## Usage 8 | 9 | `Obfu_Net.exe ` 10 | 11 | 12 | -------------------------------------------------------------------------------- /Obfu_Net/obj/Debug/Obfu_Net.csproj.FileListAbsolute.txt: -------------------------------------------------------------------------------- 1 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\bin\Debug\Obfu_Net.exe.config 2 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\bin\Debug\Obfu_Net.exe 3 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\bin\Debug\Obfu_Net.pdb 4 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\bin\Debug\dnlib.dll 5 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\bin\Debug\dnlib.xml 6 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\obj\Debug\Obfu_Net.csproj.AssemblyReference.cache 7 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\obj\Debug\Obfu_Net.csproj.SuggestedBindingRedirects.cache 8 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\obj\Debug\Obfu_Net.csproj.CoreCompileInputs.cache 9 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\obj\Debug\Obfu_Net.csproj.CopyComplete 10 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\obj\Debug\Obfu_Net.exe 11 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\obj\Debug\Obfu_Net.pdb 12 | -------------------------------------------------------------------------------- /Obfu_Net/obj/Release/Obfu_Net.csproj.FileListAbsolute.txt: -------------------------------------------------------------------------------- 1 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\bin\Release\Obfu_Net.exe.config 2 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\bin\Release\Obfu_Net.exe 3 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\bin\Release\Obfu_Net.pdb 4 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\bin\Release\dnlib.dll 5 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\bin\Release\dnlib.xml 6 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\obj\Release\Obfu_Net.csproj.AssemblyReference.cache 7 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\obj\Release\Obfu_Net.csproj.SuggestedBindingRedirects.cache 8 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\obj\Release\Obfu_Net.csproj.CoreCompileInputs.cache 9 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\obj\Release\Obfu_Net.csproj.CopyComplete 10 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\obj\Release\Obfu_Net.exe 11 | C:\Users\dev\source\repos\Obfu_Net\Obfu_Net\obj\Release\Obfu_Net.pdb 12 | -------------------------------------------------------------------------------- /packages/dnlib.4.3.0/LICENSE.txt: -------------------------------------------------------------------------------- 1 | Copyright (C) 2012-2019 de4dot@gmail.com 2 | 3 | Permission is hereby granted, free of charge, to any person obtaining 4 | a copy of this software and associated documentation files (the 5 | "Software"), to deal in the Software without restriction, including 6 | without limitation the rights to use, copy, modify, merge, publish, 7 | distribute, sublicense, and/or sell copies of the Software, and to 8 | permit persons to whom the Software is furnished to do so, subject to 9 | the following conditions: 10 | 11 | The above copyright notice and this permission notice shall be 12 | included in all copies or substantial portions of the Software. 13 | 14 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 15 | EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 16 | MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. 17 | IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY 18 | CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, 19 | TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE 20 | SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 21 | -------------------------------------------------------------------------------- /Obfu_Net.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 17 4 | VisualStudioVersion = 17.6.33829.357 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Obfu_Net", "Obfu_Net\Obfu_Net.csproj", "{8DBFE632-57F6-44C7-9276-449F21E16BAA}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|Any CPU = Debug|Any CPU 11 | Release|Any CPU = Release|Any CPU 12 | EndGlobalSection 13 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 14 | {8DBFE632-57F6-44C7-9276-449F21E16BAA}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 15 | {8DBFE632-57F6-44C7-9276-449F21E16BAA}.Debug|Any CPU.Build.0 = Debug|Any CPU 16 | {8DBFE632-57F6-44C7-9276-449F21E16BAA}.Release|Any CPU.ActiveCfg = Release|Any CPU 17 | {8DBFE632-57F6-44C7-9276-449F21E16BAA}.Release|Any CPU.Build.0 = Release|Any CPU 18 | EndGlobalSection 19 | GlobalSection(SolutionProperties) = preSolution 20 | HideSolutionNode = FALSE 21 | EndGlobalSection 22 | GlobalSection(ExtensibilityGlobals) = postSolution 23 | SolutionGuid = {71EA8360-E829-4DAD-A9CF-EE78C2C0DE89} 24 | EndGlobalSection 25 | EndGlobal 26 | -------------------------------------------------------------------------------- /Obfu_Net/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection; 2 | using System.Runtime.CompilerServices; 3 | using System.Runtime.InteropServices; 4 | 5 | // General Information about an assembly is controlled through the following 6 | // set of attributes. Change these attribute values to modify the information 7 | // associated with an assembly. 8 | [assembly: AssemblyTitle("Obfu_Net")] 9 | [assembly: AssemblyDescription("")] 10 | [assembly: AssemblyConfiguration("")] 11 | [assembly: AssemblyCompany("")] 12 | [assembly: AssemblyProduct("Obfu_Net")] 13 | [assembly: AssemblyCopyright("Copyright © 2023")] 14 | [assembly: AssemblyTrademark("")] 15 | [assembly: AssemblyCulture("")] 16 | 17 | // Setting ComVisible to false makes the types in this assembly not visible 18 | // to COM components. If you need to access a type in this assembly from 19 | // COM, set the ComVisible attribute to true on that type. 20 | [assembly: ComVisible(false)] 21 | 22 | // The following GUID is for the ID of the typelib if this project is exposed to COM 23 | [assembly: Guid("8dbfe632-57f6-44c7-9276-449f21e16baa")] 24 | 25 | // Version information for an assembly consists of the following four values: 26 | // 27 | // Major Version 28 | // Minor Version 29 | // Build Number 30 | // Revision 31 | // 32 | // You can specify all the values or you can default the Build and Revision Numbers 33 | // by using the '*' as shown below: 34 | // [assembly: AssemblyVersion("1.0.*")] 35 | [assembly: AssemblyVersion("1.0.0.0")] 36 | [assembly: AssemblyFileVersion("1.0.0.0")] 37 | -------------------------------------------------------------------------------- /Obfu_Net/Program.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using dnlib.DotNet; 3 | using System.Reflection; 4 | using System.Runtime.CompilerServices; 5 | using dnlib.DotNet.Writer; 6 | using Obfu_Net; 7 | 8 | 9 | namespace SimpleObfuscatorCSharp 10 | { 11 | class Program 12 | { 13 | static void Main(string[] args) 14 | { 15 | if (args.Length != 1) 16 | { 17 | Console.WriteLine("Usage: Obfu_Net.exe "); 18 | return; 19 | } 20 | 21 | string filePath = args[0].ToString(); 22 | string obfPath = filePath + "._obf.exe"; 23 | 24 | try 25 | { 26 | ModuleDefMD moduleDef = ModuleDefMD.Load(filePath); 27 | Assembly Default_Assembly; 28 | Default_Assembly = System.Reflection.Assembly.UnsafeLoadFrom(filePath); 29 | AssemblyDef Assembly = moduleDef.Assembly; 30 | Console.WriteLine("[+] Loaded " + filePath); 31 | StringEncrypt.EncryptStrings(moduleDef); 32 | MethodNameChange.ChangeMethodNames(moduleDef, Default_Assembly); 33 | 34 | 35 | SaveToFile(moduleDef, obfPath); 36 | 37 | } 38 | catch (Exception ex) 39 | { 40 | Console.WriteLine(ex.ToString()); 41 | } 42 | } 43 | 44 | static void SaveToFile(ModuleDefMD moduleDef, string path) 45 | { 46 | ModuleWriterOptions moduleWriterOption = new ModuleWriterOptions(moduleDef); 47 | moduleWriterOption.MetadataOptions.Flags = moduleWriterOption.MetadataOptions.Flags | MetadataFlags.KeepOldMaxStack; 48 | moduleWriterOption.Logger = DummyLogger.NoThrowInstance; 49 | moduleDef.Write(path, moduleWriterOption); 50 | } 51 | } 52 | } -------------------------------------------------------------------------------- /Obfu_Net/Obfu_Net.csproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | AnyCPU 7 | {8DBFE632-57F6-44C7-9276-449F21E16BAA} 8 | Exe 9 | Obfu_Net 10 | Obfu_Net 11 | v4.8 12 | 512 13 | true 14 | true 15 | 16 | 17 | AnyCPU 18 | true 19 | full 20 | false 21 | bin\Debug\ 22 | DEBUG;TRACE 23 | prompt 24 | 4 25 | 26 | 27 | AnyCPU 28 | pdbonly 29 | true 30 | bin\Release\ 31 | TRACE 32 | prompt 33 | 4 34 | 35 | 36 | 37 | ..\packages\dnlib.4.3.0\lib\net45\dnlib.dll 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | -------------------------------------------------------------------------------- /Obfu_Net/StringEncrypt.cs: -------------------------------------------------------------------------------- 1 | using dnlib.DotNet; 2 | using System; 3 | using System.IO; 4 | using System.Collections.Generic; 5 | using System.Linq; 6 | using System.Text; 7 | using System.Threading.Tasks; 8 | using System.Security.Cryptography; 9 | using dnlib.DotNet.Emit; 10 | 11 | namespace SimpleObfuscatorCSharp 12 | { 13 | public class StringEncrypt 14 | { 15 | 16 | public static void EncryptStrings(ModuleDefMD module) 17 | { 18 | // Load the module containing the StringEncrypt class 19 | ModuleDef typeModule = ModuleDefMD.Load(typeof(StringEncrypt).Module); 20 | 21 | Console.WriteLine("[+] Injecting decryption method"); 22 | 23 | MethodDef decryptMethod = FindAndPrepareDecryptMethod(typeModule); 24 | 25 | if (decryptMethod != null) 26 | { 27 | module.GlobalType.Methods.Add(decryptMethod); 28 | 29 | UpdateDecryptMethodBody(decryptMethod); 30 | 31 | Console.WriteLine("[+] Encrypting all strings"); 32 | 33 | EncryptAllStrings(module, decryptMethod); 34 | } 35 | } 36 | 37 | // Find and prepare the decryption method for injection 38 | private static MethodDef FindAndPrepareDecryptMethod(ModuleDef typeModule) 39 | { 40 | foreach (TypeDef type in typeModule.Types) 41 | { 42 | foreach (MethodDef method in type.Methods) 43 | { 44 | if (method.Name == "DecryptString") 45 | { 46 | method.DeclaringType = null; 47 | method.Name = "Example123"; // Rename the method 48 | method.Parameters[0].Name = "\u0011"; // Obfuscate the parameter name 49 | 50 | Console.WriteLine("[+] DecryptString found"); 51 | return method; 52 | } 53 | } 54 | } 55 | return null; 56 | } 57 | 58 | // Update the method's body instructions with encryption keys 59 | private static void UpdateDecryptMethodBody(MethodDef method) 60 | { 61 | foreach (Instruction i in method.Body.Instructions) 62 | { 63 | if (i.ToString().Contains("DEFAULT_KEY")) 64 | { 65 | i.Operand = "K34VFiiu1qar95eRRZJ36EqMBxUrfhUWKK8Spqv3l5E="; 66 | } 67 | if (i.ToString().Contains("DEFAULT_IV")) 68 | { 69 | i.Operand = "GvcTmDfSETQlYktniF88Kg=="; 70 | } 71 | } 72 | } 73 | 74 | // Encrypt all string literals in the module 75 | private static void EncryptAllStrings(ModuleDefMD module, MethodDef decryptMethod) 76 | { 77 | foreach (TypeDef typedef in module.GetTypes().ToList()) 78 | { 79 | if (!typedef.HasMethods) 80 | continue; 81 | 82 | foreach (MethodDef typeMethod in typedef.Methods) 83 | { 84 | if (typeMethod.Body == null || typeMethod.Name == decryptMethod.Name) 85 | continue; 86 | 87 | EncryptMethodStrings(typeMethod, decryptMethod); 88 | } 89 | } 90 | } 91 | 92 | // Encrypt string literals in a single method 93 | private static void EncryptMethodStrings(MethodDef typeMethod, MethodDef decryptMethod) 94 | { 95 | foreach (Instruction instr in typeMethod.Body.Instructions.ToList()) 96 | { 97 | if (instr.OpCode == OpCodes.Ldstr) 98 | { 99 | int instrIndex = typeMethod.Body.Instructions.IndexOf(instr); 100 | 101 | // Replace the string operand with the encrypted string 102 | typeMethod.Body.Instructions[instrIndex].Operand = EncryptString(typeMethod.Body.Instructions[instrIndex].Operand.ToString()); 103 | 104 | // Insert a call to the decryption method after the encrypted string 105 | typeMethod.Body.Instructions.Insert(instrIndex + 1, new Instruction(OpCodes.Call, decryptMethod)); 106 | } 107 | } 108 | 109 | // Update and optimize the method's body 110 | typeMethod.Body.UpdateInstructionOffsets(); 111 | typeMethod.Body.OptimizeBranches(); 112 | typeMethod.Body.SimplifyBranches(); 113 | } 114 | 115 | 116 | public static string EncryptString(string plaintext) 117 | { 118 | byte[] encryptionKey = new byte[] 119 | { 120 | 0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd6, 0xa6, 121 | 0xab, 0xf7, 0x97, 0x91, 0x45, 0x92, 0x77, 0xe8, 122 | 0x4a, 0x8c, 0x07, 0x15, 0x2b, 0x7e, 0x15, 0x16, 123 | 0x28, 0xaf, 0x12, 0xa6, 0xab, 0xf7, 0x97 ,0x91 124 | }; 125 | 126 | // Hardcoded AES initialization vector (IV) (128 bits = 16 bytes) 127 | byte[] iv = new byte[] 128 | { 129 | 0x1a, 0xf7, 0x13, 0x98, 0x37, 0xd2, 0x11, 0x34, 130 | 0x25, 0x62, 0x4b, 0x67, 0x88, 0x5f, 0x3c, 0x2a 131 | }; 132 | 133 | byte[] encrypted; 134 | string base64_encrypted; 135 | using (Aes aesAlg = Aes.Create()) 136 | { 137 | 138 | aesAlg.Key = encryptionKey; 139 | aesAlg.IV = iv; 140 | aesAlg.Mode = CipherMode.CBC; 141 | 142 | 143 | ICryptoTransform encryptor = aesAlg.CreateEncryptor(aesAlg.Key, aesAlg.IV); 144 | 145 | using (var msEncrypt = new System.IO.MemoryStream()) 146 | { 147 | using (var csEncrypt = new CryptoStream(msEncrypt, encryptor, CryptoStreamMode.Write)) 148 | { 149 | using(StreamWriter sw = new StreamWriter(csEncrypt)) 150 | sw.Write(plaintext); 151 | encrypted = msEncrypt.ToArray(); 152 | 153 | //csEncrypt.Write(plaintextBytes, 0, plaintextBytes.Length); 154 | //csEncrypt.FlushFinalBlock(); 155 | } 156 | 157 | //return ToBase64String(encrypted); 158 | } 159 | } 160 | using (RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider()) 161 | { 162 | base64_encrypted = Convert.ToBase64String(encrypted); 163 | } 164 | return base64_encrypted; 165 | } 166 | 167 | 168 | 169 | public static string DecryptString(string ciphertext_b64) 170 | { 171 | string encryptionKey = "DEFAULT_KEY"; 172 | string iv = "DEFAULT_IV"; 173 | byte[] ciphertext; 174 | byte[] new_encryptionKey, new_iv; 175 | using (RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider()) 176 | { 177 | ciphertext = Convert.FromBase64String(ciphertext_b64); 178 | new_encryptionKey = Convert.FromBase64String(encryptionKey); 179 | new_iv = Convert.FromBase64String(iv); 180 | } 181 | string plaintext; 182 | using (Aes aesAlg = Aes.Create()) 183 | { 184 | aesAlg.Key = new_encryptionKey; 185 | aesAlg.IV = new_iv; 186 | aesAlg.Mode = CipherMode.CBC; 187 | //aesAlg.Padding = PaddingMode.PKCS7; 188 | 189 | ICryptoTransform decryptor = aesAlg.CreateDecryptor(aesAlg.Key, aesAlg.IV); 190 | 191 | byte[] decryptedBytes; 192 | using (var msDecrypt = new System.IO.MemoryStream(ciphertext)) 193 | { 194 | using (var csDecrypt = new CryptoStream(msDecrypt, decryptor, CryptoStreamMode.Read)) 195 | { 196 | using (StreamReader reader = new StreamReader(csDecrypt)) 197 | { 198 | plaintext = reader.ReadToEnd(); 199 | //csDecrypt.CopyTo(msPlain); 200 | //decryptedBytes = msPlain.ToArray(); 201 | } 202 | } 203 | } 204 | 205 | return plaintext; 206 | } 207 | } 208 | 209 | } 210 | } 211 | -------------------------------------------------------------------------------- /Obfu_Net/bin/Debug/example.txt: -------------------------------------------------------------------------------- 1 | [+] Loaded Certify.exe 2 | [+] Injecting the decryption method 3 | Main 4 | SaveToFile 5 | .ctor 6 | EncryptStrings 7 | EncryptString 8 | DecryptString 9 | [+] DecryptString found 10 | [+] Encrypting all strings) 11 | Fire 12 | GetEncodedMethodName 13 | .ctor 14 | .cctor 15 | [+] Changing classes names 16 | Parse 17 | get_ParsedOk 18 | get_Arguments 19 | Success 20 | Failure 21 | ExecuteCommand 22 | ShowLogo 23 | ShowUsage 24 | .cctor 25 | CreateCertRequestMessage 26 | CreatePrivateKey 27 | CreateCertRequestOnBehalfMessage 28 | SendCertificateRequest 29 | DownloadCert 30 | DownloadAndInstallCert 31 | RequestCert 32 | RequestCertOnBehalf 33 | ConvertToPEM 34 | ExportPrivateKey 35 | EncodeLength 36 | EncodeIntegerBigEndian 37 | GetCurrentUserDN 38 | GetCurrentComputerDN 39 | get_Request 40 | set_Request 41 | get_PrivateKeyPem 42 | set_PrivateKeyPem 43 | OpenProcessToken 44 | DuplicateToken 45 | ImpersonateLoggedOnUser 46 | CloseHandle 47 | RevertToSelf 48 | FileExecute 49 | MainExecute 50 | MainString 51 | CryptEncodeObjectEx 52 | EncodeSidExtension 53 | UrlExists 54 | get_Domain 55 | set_Domain 56 | get_LdapServer 57 | set_LdapServer 58 | PrintEnterpriseCaInfo 59 | PrintPKIObjectControllers 60 | PrintCertificateInfo 61 | GetUserSidString 62 | GetUserNameFromSid 63 | GetSanString 64 | IsAdminSid 65 | IsLowPrivSid 66 | GetDomainFromDN 67 | IsHighIntegrity 68 | ImpersonateWinlogon 69 | GetSystem 70 | get_ConfigurationPath 71 | set_ConfigurationPath 72 | get_LdapServer 73 | set_LdapServer 74 | GetConfigurationPath 75 | GetPKIObjects 76 | GetEnterpriseCAs 77 | GetNtAuthCertificates 78 | GetCertificateTemplates 79 | GetRootCAs 80 | ParsePkiCertificateAuthorityFlags 81 | ParseDnsHostname 82 | ParseSecurityDescriptor 83 | ParseCaCertificate 84 | ParseCertificateTemplate 85 | ParsePkiCertificateNameFlag 86 | ParsePkiEnrollmentFlag 87 | ParseDisplayName 88 | ParseName 89 | ParseSamAccountName 90 | ParseDomainName 91 | ParseDistinguishedName 92 | ParseGuid 93 | ParseSchemaVersion 94 | ParsePkiCertTemplateOid 95 | ParsePkiOverlapPeriod 96 | ParsePkiExpirationPeriod 97 | ParseExtendedKeyUsages 98 | ParseAuthorizedSignatures 99 | ParseRaApplicationPolicies 100 | ParseIssuancePolicies 101 | ParseCertificateApplicationPolicies 102 | ParseUIntToEnum 103 | ParseIntToEnum 104 | ConvertPKIPeriod 105 | get_DistinguishedName 106 | set_DistinguishedName 107 | get_SecurityDescriptor 108 | set_SecurityDescriptor 109 | get_LegacyAspEnrollmentUrls 110 | set_LegacyAspEnrollmentUrls 111 | get_EnrollmentWebServiceUrls 112 | set_EnrollmentWebServiceUrls 113 | get_EnrollmentPolicyWebServiceUrls 114 | set_EnrollmentPolicyWebServiceUrls 115 | get_NetworkDeviceEnrollmentServiceUrls 116 | set_NetworkDeviceEnrollmentServiceUrls 117 | .cctor 118 | get_Type 119 | get_Rights 120 | get_ObjectType 121 | get_Principal 122 | get_Owner 123 | get_ACEs 124 | get_Name 125 | get_DomainName 126 | get_DisplayName 127 | get_Guid 128 | get_SchemaVersion 129 | get_ValidityPeriod 130 | get_RenewalPeriod 131 | get_Oid 132 | get_CertificateNameFlag 133 | get_EnrollmentFlag 134 | get_ExtendedKeyUsage 135 | get_AuthorizedSignatures 136 | get_ApplicationPolicies 137 | get_IssuancePolicies 138 | get_CertificateApplicationPolicies 139 | get_RequiresManagerApproval 140 | get_EnrolleeSuppliesSubject 141 | get_ACL 142 | get_Name 143 | get_DomainName 144 | get_Guid 145 | get_SchemaVersion 146 | get_DisplayName 147 | get_ValidityPeriod 148 | get_RenewalPeriod 149 | get_Oid 150 | get_CertificateNameFlag 151 | get_EnrollmentFlag 152 | get_ExtendedKeyUsage 153 | get_AuthorizedSignatures 154 | get_RaApplicationPolicies 155 | get_IssuancePolicies 156 | get_ApplicationPolicies 157 | get_Name 158 | get_DomainName 159 | get_Guid 160 | get_Flags 161 | get_Certificates 162 | set_Certificates 163 | Finalize 164 | Dispose 165 | Dispose 166 | get_Agent 167 | get_Template 168 | get_Targets 169 | get_SubjectName 170 | get_Thumbprint 171 | get_Serial 172 | get_StartDate 173 | get_EndDate 174 | get_CertChain 175 | get_Type 176 | get_Rights 177 | get_Principal 178 | get_Owner 179 | get_ACEs 180 | get_Name 181 | get_DnsHostname 182 | get_DomainName 183 | get_Guid 184 | get_Flags 185 | get_Certificates 186 | get_Templates 187 | get_EDITF_ATTRIBUTESUBJECTALTNAME2 188 | get_ACL 189 | get_EnrollmentAgentRestrictions 190 | get_Templates 191 | get_DnsHostname 192 | get_FullName 193 | GetServerSecurityFromRegistry 194 | GetEnrollmentAgentSecurity 195 | IsUserSpecifiesSanEnabled 196 | GetWebServices 197 | get_Type 198 | get_Rights 199 | get_ObjectType 200 | get_Principal 201 | get_Name 202 | get_DomainName 203 | get_CommandName 204 | Execute 205 | DisplayRootCAs 206 | DisplayNtAuthCertificates 207 | DisplayEnterpriseCAs 208 | PrintCAWebServices 209 | get_CommandName 210 | Execute 211 | get_Meta 212 | get_CertificateAuthorities 213 | get_CertificateTemplates 214 | get_CommandName 215 | Execute 216 | FindTemplates 217 | PrintCertTemplate 218 | PrintAllowPermissions 219 | PrintAllPermissions 220 | ConvertGuidToName 221 | ConvertSidToName 222 | ShowTemplatesWithEnrolleeSuppliesSubject 223 | ShowTemplatesAllowingClientAuth 224 | ShowAllTemplates 225 | ShowVulnerableTemplates 226 | IsCertificateTemplateVulnerable 227 | Execute 228 | get_CommandName 229 | Execute 230 | DisplayPKIObjectControllers 231 | get_CommandName 232 | Execute 233 | Submit 234 | RetrievePending 235 | GetLastStatus 236 | GetRequestId 237 | GetDispositionMessage 238 | _VtblGap1_1 239 | GetCertificate 240 | Attach 241 | CultureToString 242 | ReadExistingAssembly 243 | ReadAssemblyFromResource 244 | CurrentDomain_AssemblyResolve 245 | .cctor 246 | Init 247 | UpdateByte 248 | Update 249 | GetDigest 250 | CalculateDigest 251 | VerifyDigest 252 | .cctor 253 | SetProgress 254 | Code 255 | SetCoderProperties 256 | WriteCoderProperties 257 | SetDecoderProperties 258 | SetStream 259 | ReleaseStream 260 | Init 261 | FlushData 262 | FlushStream 263 | CloseStream 264 | Encode 265 | ShiftLow 266 | EncodeDirectBits 267 | EncodeBit 268 | GetProcessedSizeAdd 269 | Init 270 | ReleaseStream 271 | CloseStream 272 | Normalize 273 | Normalize2 274 | GetThreshold 275 | Decode 276 | DecodeDirectBits 277 | DecodeBit 278 | Init 279 | UpdateModel 280 | Encode 281 | .cctor 282 | GetPrice 283 | GetPrice0 284 | GetPrice1 285 | UpdateModel 286 | Init 287 | Decode 288 | Init 289 | Encode 290 | ReverseEncode 291 | GetPrice 292 | ReverseGetPrice 293 | ReverseGetPrice 294 | ReverseEncode 295 | Init 296 | Decode 297 | ReverseDecode 298 | ReverseDecode 299 | SetStream 300 | Init 301 | ReleaseStream 302 | GetIndexByte 303 | GetMatchLen 304 | GetNumAvailableBytes 305 | Create 306 | GetMatches 307 | Skip 308 | SetType 309 | SetStream 310 | ReleaseStream 311 | Init 312 | MovePos 313 | GetIndexByte 314 | GetMatchLen 315 | GetNumAvailableBytes 316 | Create 317 | GetMatches 318 | Skip 319 | NormalizeLinks 320 | Normalize 321 | SetCutValue 322 | MoveBlock 323 | ReadBlock 324 | Free 325 | Create 326 | SetStream 327 | ReleaseStream 328 | Init 329 | MovePos 330 | GetIndexByte 331 | GetMatchLen 332 | GetNumAvailableBytes 333 | ReduceOffsets 334 | Create 335 | Init 336 | Train 337 | ReleaseStream 338 | Flush 339 | CopyBlock 340 | PutByte 341 | GetByte 342 | GetLenToPosState 343 | Init 344 | UpdateChar 345 | UpdateMatch 346 | UpdateRep 347 | UpdateShortRep 348 | IsCharState 349 | SetDictionarySize 350 | SetLiteralProperties 351 | SetPosBitsProperties 352 | Init 353 | Code 354 | SetDecoderProperties 355 | Train 356 | Create 357 | Init 358 | Decode 359 | Create 360 | Init 361 | GetState 362 | DecodeNormal 363 | DecodeWithMatchByte 364 | Create 365 | Init 366 | DecodeNormal 367 | DecodeWithMatchByte 368 | .cctor 369 | GetPosSlot 370 | GetPosSlot2 371 | BaseInit 372 | Create 373 | SetWriteEndMarkerMode 374 | Init 375 | ReadMatchDistances 376 | MovePos 377 | GetRepLen1Price 378 | GetPureRepPrice 379 | GetRepPrice 380 | GetPosLenPrice 381 | Backward 382 | GetOptimum 383 | ChangePair 384 | WriteEndMarker 385 | Flush 386 | CodeOneBlock 387 | ReleaseMFStream 388 | SetOutStream 389 | ReleaseOutStream 390 | ReleaseStreams 391 | SetStreams 392 | Code 393 | WriteCoderProperties 394 | FillDistancesPrices 395 | FillAlignPrices 396 | FindMatchFinder 397 | SetCoderProperties 398 | SetTrainSize 399 | Create 400 | Init 401 | GetSubCoder 402 | Create 403 | Init 404 | Encode 405 | EncodeMatched 406 | GetPrice 407 | Init 408 | Encode 409 | SetPrices 410 | SetTableSize 411 | GetPrice 412 | UpdateTable 413 | UpdateTables 414 | Encode 415 | MakeAsChar 416 | MakeAsShortRep 417 | IsShortRep 418 | Compress 419 | Decompress 420 | .cctor 421 | Init 422 | ReadBlock 423 | ReleaseStream 424 | ReadByte 425 | ReadByte 426 | GetProcessedSize 427 | SetStream 428 | FlushStream 429 | CloseStream 430 | ReleaseStream 431 | Init 432 | WriteByte 433 | FlushData 434 | GetProcessedSize 435 | -------------------------------------------------------------------------------- /Obfu_Net/MethodNameChange.cs: -------------------------------------------------------------------------------- 1 | using dnlib.DotNet; 2 | using System; 3 | using System.Collections.Generic; 4 | using System.Linq; 5 | using System.Reflection; 6 | 7 | namespace Obfu_Net 8 | { 9 | class MethodNameChange 10 | { 11 | private static readonly List commonWords = new List 12 | { 13 | "method", "class", "object", "variable", "function", "parameter", "instance", "property", "value", "attribute","ab-", 14 | "ABA", 15 | "Ababa", 16 | "Ababdeh", 17 | "Ababua", 18 | "abac", 19 | "abaca", 20 | "abacay", 21 | "abacas", 22 | "abacate", 23 | "abacaxi", 24 | "abaci", 25 | "abacinate", 26 | "abacination", 27 | "abacisci", 28 | "abaciscus", 29 | "abacist", 30 | "aback", 31 | "abacli", 32 | "Abaco", 33 | "abacot", 34 | "abacterial", 35 | "abactinal", 36 | "abactinally", 37 | "abaction", 38 | "abactor", 39 | "abaculi", 40 | "abaculus", 41 | "abacus", 42 | "abacuses", 43 | "Abad", 44 | "abada", 45 | "Abadan", 46 | "Abaddon", 47 | "abadejo", 48 | "abadengo", 49 | "abadia", 50 | "Abadite", 51 | "abaff", 52 | "abaft", 53 | "Abagael", 54 | "Abagail", 55 | "Abagtha", 56 | "abay", 57 | "abayah", 58 | "Abailard", 59 | "abaisance", 60 | "abaised", 61 | "abaiser", 62 | "abaisse", 63 | "abaissed", 64 | "abaka", 65 | "Abakan", 66 | "abakas", 67 | "Abakumov", 68 | "abalation", 69 | "abalienate", 70 | "abalienated", 71 | "abalienating", 72 | "abalienation", 73 | "abalone", 74 | "abalones", 75 | "Abama", 76 | "abamp", 77 | "abampere", 78 | "abamperes", 79 | "abamps", 80 | "Abana", 81 | "aband", 82 | "abandon", 83 | "abandonable", 84 | "abandoned", 85 | "abandonedly", 86 | "abandonee", 87 | "abandoner", 88 | "abandoners", 89 | "abandoning", 90 | "abandonment", 91 | "abandonments", 92 | "abandons", 93 | "abandum", 94 | "abanet", 95 | "abanga", 96 | "Abanic", 97 | "abannition", 98 | "Abantes", 99 | "abapical", 100 | "abaptiston", 101 | "abaptistum", 102 | "Abarambo", 103 | "Abarbarea", 104 | "Abaris", 105 | "abarthrosis", 106 | "abarticular", 107 | "abarticulation", 108 | "Abas", 109 | "abase", 110 | "abased", 111 | "abasedly", 112 | "abasedness", 113 | "abasement", 114 | "abasements", 115 | "abaser", 116 | "abasers", 117 | "abases", 118 | "Abasgi", 119 | "abash", 120 | "abashed", 121 | "abashedly", 122 | "abashedness", 123 | "abashes", 124 | "abashing", 125 | "abashless", 126 | "abashlessly", 127 | "abashment", 128 | "abashments", 129 | "abasia", 130 | "abasias", 131 | "abasic", 132 | "abasing", 133 | "abasio", 134 | "abask", 135 | "abassi", 136 | "Abassieh", 137 | "Abassin", 138 | "abastard", 139 | "abastardize", 140 | "abastral", 141 | "abatable", 142 | "abatage", 143 | "Abate", 144 | "abated", 145 | "abatement", 146 | "abatements", 147 | "abater", 148 | "abaters", 149 | "abates", 150 | "abatic", 151 | "abating", 152 | "abatis", 153 | "abatised", 154 | "abatises", 155 | "abatjour", 156 | "abatjours", 157 | "abaton", 158 | "abator", 159 | "abators", 160 | "ABATS", 161 | "abattage", 162 | "abattis", 163 | "abattised", 164 | "abattises", 165 | "abattoir", 166 | "abattoirs", 167 | "abattu", 168 | "abattue", 169 | "Abatua", 170 | "abature", 171 | "abaue", 172 | "abave", 173 | "abaxial", 174 | "abaxile", 175 | "abaze", 176 | "abb", 177 | "Abba", 178 | "abbacy", 179 | "abbacies", 180 | "abbacomes", 181 | "Abbadide", 182 | "Abbai", 183 | "abbaye", 184 | "abbandono", 185 | "abbas", 186 | "abbasi", 187 | "Abbasid", 188 | "abbassi", 189 | "Abbassid", 190 | "Abbasside", 191 | "Abbate", 192 | "abbatial", 193 | "abbatical", 194 | "abbatie", 195 | "Abbe", 196 | "Abbey", 197 | "abbeys", 198 | "abbey's", 199 | "abbeystead", 200 | "abbeystede", 201 | "abbes", 202 | "abbess", 203 | "abbesses", 204 | "abbest", 205 | "Abbevilean", 206 | "Abbeville", 207 | "Abbevillian", 208 | "Abbi", 209 | "Abby", 210 | "Abbie", 211 | "Abbye", 212 | "Abbyville", 213 | "abboccato", 214 | "abbogada", 215 | "Abbot", 216 | "abbotcy", 217 | "abbotcies", 218 | "abbotnullius", 219 | "abbotric", 220 | "abbots", 221 | "abbot's", 222 | "Abbotsen", 223 | "Abbotsford", 224 | "abbotship", 225 | "abbotships", 226 | "Abbotson", 227 | "Abbotsun", 228 | "Abbott", 229 | "Abbottson", 230 | "Abbottstown", 231 | "Abboud", 232 | "abbozzo", 233 | "ABBR", 234 | "abbrev", 235 | "abbreviatable", 236 | "abbreviate", 237 | "abbreviated", 238 | "abbreviately", 239 | "abbreviates", 240 | "abbreviating", 241 | "abbreviation", 242 | "abbreviations", 243 | "abbreviator", 244 | "abbreviatory", 245 | "abbreviators", 246 | "abbreviature", 247 | "abbroachment", 248 | "ABC", 249 | "abcess", 250 | "abcissa", 251 | "abcoulomb", 252 | "ABCs", 253 | "abd", 254 | "abdal", 255 | "abdali", 256 | "abdaria", 257 | "abdat", 258 | "Abdel", 259 | "Abd-el-Kadir", 260 | "Abd-el-Krim", 261 | "Abdella", 262 | "Abderhalden", 263 | "Abderian", 264 | "Abderite", 265 | "Abderus", 266 | "abdest", 267 | "Abdias", 268 | "abdicable", 269 | "abdicant", 270 | "abdicate", 271 | "abdicated", 272 | "abdicates", 273 | "abdicating", 274 | "abdication", 275 | "abdications", 276 | "abdicative", 277 | "abdicator", 278 | "Abdiel", 279 | "abditive", 280 | "abditory", 281 | "abdom", 282 | "abdomen", 283 | "abdomens", 284 | "abdomen's", 285 | "abdomina", 286 | "abdominal", 287 | "Abdominales", 288 | "abdominalia", 289 | "abdominalian", 290 | "abdominally", 291 | "abdominals", 292 | "abdominoanterior", 293 | "abdominocardiac", 294 | "abdominocentesis", 295 | "abdominocystic", 296 | "abdominogenital", 297 | "abdominohysterectomy", 298 | "abdominohysterotomy", 299 | "abdominoposterior", 300 | "abdominoscope", 301 | "abdominoscopy", 302 | "abdominothoracic", 303 | "abdominous", 304 | "abdomino-uterotomy", 305 | "abdominovaginal", 306 | "abdominovesical", 307 | "Abdon", 308 | "Abdu", 309 | "abduce", 310 | "abduced", 311 | "abducens", 312 | "abducent", 313 | "abducentes", 314 | "abduces", 315 | "abducing", 316 | "abduct", 317 | "abducted", 318 | "abducting", 319 | "abduction", 320 | "abductions", 321 | "abduction's", 322 | "abductor", 323 | "abductores", 324 | "abductors", 325 | "abductor's", 326 | "abducts", 327 | "Abdul", 328 | "Abdul-Aziz", 329 | "Abdul-baha", 330 | "Abdulla", 331 | "Abe", 332 | "a-be", 333 | "abeam", 334 | "abear", 335 | "abearance", 336 | "Abebi", 337 | "abecedaire", 338 | "abecedary", 339 | "abecedaria", 340 | "abecedarian", 341 | "abecedarians", 342 | "abecedaries", 343 | "abecedarium", 344 | "abecedarius", 345 | "abed", 346 | "abede", 347 | "abedge", 348 | "Abednego", 349 | "abegge", 350 | "Abey", 351 | "abeyance", 352 | "abeyances", 353 | "abeyancy", 354 | "abeyancies", 355 | "abeyant", 356 | "abeigh", 357 | "ABEL", 358 | "Abelard", 359 | "abele", 360 | "abeles", 361 | "Abelia", 362 | "Abelian", 363 | "Abelicea", 364 | "Abelite", 365 | "Abell", 366 | "Abelmoschus", 367 | "abelmosk", 368 | "abelmosks", 369 | "abelmusk", 370 | "Abelonian", 371 | "Abelson", 372 | "abeltree", 373 | "Abencerrages", 374 | "abend", 375 | "abends", 376 | "Abenezra", 377 | "abenteric", 378 | "Abeokuta", 379 | "abepithymia", 380 | "ABEPP", 381 | "Abercromby", 382 | "Abercrombie", 383 | "Aberdare", 384 | "aberdavine", 385 | "Aberdeen", 386 | "Aberdeenshire", 387 | "aberdevine", 388 | "Aberdonian", 389 | "aberduvine", 390 | "Aberfan", 391 | "Aberglaube", 392 | "Aberia", 393 | "Aberystwyth", 394 | "Abernant", 395 | "Abernathy", 396 | "abernethy", 397 | "Abernon", 398 | "aberr", 399 | "aberrance", 400 | "aberrancy", 401 | "aberrancies", 402 | "aberrant", 403 | "aberrantly", 404 | "aberrants", 405 | "aberrate", 406 | "aberrated", 407 | "aberrating", 408 | "aberration", 409 | "aberrational", 410 | "aberrations", 411 | "aberrative", 412 | "aberrator", 413 | "aberrometer", 414 | "aberroscope", 415 | "Abert", 416 | "aberuncate", 417 | "aberuncator", 418 | "abesse", 419 | "abessive", 420 | "abet", 421 | "abetment", 422 | "abetments", 423 | "abets", 424 | "abettal", 425 | "abettals", 426 | "abetted", 427 | "abetter", 428 | "abetters", 429 | "abetting", 430 | "abettor", 431 | "abettors", 432 | "Abeu", 433 | "abevacuation", 434 | "abfarad", 435 | "abfarads", 436 | "ABFM", 437 | "Abgatha", 438 | "ABHC", 439 | "abhenry", 440 | "abhenries", 441 | "abhenrys", 442 | "abhinaya", 443 | "abhiseka", 444 | "abhominable", 445 | "abhor", 446 | "abhorred", 447 | "abhorrence", 448 | "abhorrences", 449 | "abhorrency", 450 | "abhorrent", 451 | "abhorrently", 452 | "abhorrer", 453 | "abhorrers", 454 | "abhorrible", 455 | "abhorring", 456 | "abhors", 457 | "Abhorson", 458 | "ABI", 459 | "aby", 460 | "Abia", 461 | "Abiathar", 462 | "Abib", 463 | "abichite", 464 | "abidal", 465 | "abidance", 466 | "abidances", 467 | "abidden", 468 | "abide", 469 | "abided", 470 | "abider", 471 | "abiders", 472 | "abides", 473 | "abidi", 474 | "abiding", 475 | "abidingly", 476 | "abidingness", 477 | "Abidjan", 478 | "Abydos", 479 | "Abie", 480 | "abye", 481 | "abied", 482 | "abyed", 483 | "abiegh", 484 | "abience", 485 | "abient", 486 | "Abies", 487 | "abyes", 488 | }; 489 | private static Random random = new Random(); 490 | 491 | public static void ChangeMethodNames(ModuleDefMD moduleDef, Assembly assembly) 492 | { 493 | Console.WriteLine("[+] Changing method names"); 494 | 495 | IEnumerable types = moduleDef.GetTypes(); 496 | int iteration = 0; 497 | 498 | foreach (var type in types.ToList()) 499 | { 500 | Dictionary org_names = new Dictionary(); 501 | string typeRandom = GetEncodedMethodName(); 502 | typeRandom = typeRandom + iteration; 503 | org_names[typeRandom] = type.Name; 504 | 505 | 506 | if (!type.Name.StartsWith("<")) 507 | type.Name = typeRandom; 508 | else 509 | { 510 | continue; 511 | } 512 | 513 | foreach (var method in type.Methods) 514 | { 515 | if (method.Name == "Main") 516 | continue; 517 | if (method.Name == ".ctor") 518 | { 519 | continue; 520 | } 521 | if (method.Name.Length < 9) 522 | { 523 | continue; 524 | } 525 | //Console.WriteLine(method.Name); 526 | string encodedStr = GetEncodedMethodName(); 527 | method.Name = encodedStr + iteration.ToString(); 528 | } 529 | 530 | iteration++; 531 | } 532 | } 533 | 534 | private static string GetEncodedMethodName() 535 | { 536 | // Choose 3 words from the list and concatenate them 537 | List selectedWords = new List(); 538 | 539 | for (int i = 0; i < 3; i++) 540 | { 541 | int index = random.Next(commonWords.Count); 542 | selectedWords.Add(commonWords[index]); 543 | } 544 | 545 | return string.Join("", selectedWords); 546 | } 547 | } 548 | } 549 | --------------------------------------------------------------------------------