├── ProxyCalld.rar ├── ProxyCalld.sln ├── ProxyCalld ├── InjectHelper.cs ├── Program.cs ├── Properties │ └── AssemblyInfo.cs ├── ProxyCalld.csproj ├── ProxyCalld.csproj.user ├── app.config ├── bin │ └── Debug │ │ ├── ProxyCalld.exe │ │ ├── ProxyCalld.exe.config │ │ ├── ProxyCalld.pdb │ │ └── dnlib.dll └── obj │ └── Debug │ ├── DesignTimeResolveAssemblyReferencesInput.cache │ ├── ProxyCalld.csproj.CopyComplete │ ├── ProxyCalld.csproj.CoreCompileInputs.cache │ ├── ProxyCalld.csproj.FileListAbsolute.txt │ ├── ProxyCalld.csprojAssemblyReference.cache │ ├── ProxyCalld.exe │ └── ProxyCalld.pdb ├── ProxyTest ├── Program.cs ├── Properties │ └── AssemblyInfo.cs ├── ProxyTest.csproj ├── bin │ └── Debug │ │ ├── ProxyTest.exe │ │ ├── ProxyTest.pdb │ │ └── ProxyTest_deobfuscated.exe └── obj │ └── Debug │ ├── DesignTimeResolveAssemblyReferencesInput.cache │ ├── ProxyTest.csproj.CoreCompileInputs.cache │ ├── ProxyTest.csproj.FileListAbsolute.txt │ ├── ProxyTest.csprojAssemblyReference.cache │ ├── ProxyTest.exe │ └── ProxyTest.pdb └── README.md /ProxyCalld.rar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XenocodeRCE/BasicProxyObfucator/5584949d70bb68231b4b2d4a8a7a2e1068f2a80e/ProxyCalld.rar -------------------------------------------------------------------------------- /ProxyCalld.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 15 4 | VisualStudioVersion = 15.0.27703.2035 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ProxyCalld", "ProxyCalld\ProxyCalld.csproj", "{460E54D6-4EB5-4323-AA58-132E69AD3A02}" 7 | EndProject 8 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ProxyTest", "ProxyTest\ProxyTest.csproj", "{90C2B6A4-D203-405B-B140-0645B39EAF7B}" 9 | EndProject 10 | Global 11 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 12 | Debug|Any CPU = Debug|Any CPU 13 | Release|Any CPU = Release|Any CPU 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {460E54D6-4EB5-4323-AA58-132E69AD3A02}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 17 | {460E54D6-4EB5-4323-AA58-132E69AD3A02}.Debug|Any CPU.Build.0 = Debug|Any CPU 18 | {460E54D6-4EB5-4323-AA58-132E69AD3A02}.Release|Any CPU.ActiveCfg = Release|Any CPU 19 | {460E54D6-4EB5-4323-AA58-132E69AD3A02}.Release|Any CPU.Build.0 = Release|Any CPU 20 | {90C2B6A4-D203-405B-B140-0645B39EAF7B}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 21 | {90C2B6A4-D203-405B-B140-0645B39EAF7B}.Debug|Any CPU.Build.0 = Debug|Any CPU 22 | {90C2B6A4-D203-405B-B140-0645B39EAF7B}.Release|Any CPU.ActiveCfg = Release|Any CPU 23 | {90C2B6A4-D203-405B-B140-0645B39EAF7B}.Release|Any CPU.Build.0 = Release|Any CPU 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {C62A0735-4703-42F6-9146-810089EEEDB3} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /ProxyCalld/InjectHelper.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using dnlib.DotNet; 5 | using dnlib.DotNet.Emit; 6 | 7 | namespace ProxyCalld 8 | { 9 | /// 10 | /// Provides methods to inject a into another module. 11 | /// 12 | public static class InjectHelper 13 | { 14 | /// 15 | /// Clones the specified origin TypeDef. 16 | /// 17 | /// The origin TypeDef. 18 | /// The cloned TypeDef. 19 | static TypeDefUser Clone(TypeDef origin) 20 | { 21 | var ret = new TypeDefUser(origin.Namespace, origin.Name); 22 | ret.Attributes = origin.Attributes; 23 | 24 | if (origin.ClassLayout != null) 25 | ret.ClassLayout = new ClassLayoutUser(origin.ClassLayout.PackingSize, origin.ClassSize); 26 | 27 | foreach (GenericParam genericParam in origin.GenericParameters) 28 | ret.GenericParameters.Add(new GenericParamUser(genericParam.Number, genericParam.Flags, "-")); 29 | 30 | return ret; 31 | } 32 | 33 | /// 34 | /// Clones the specified origin MethodDef. 35 | /// 36 | /// The origin MethodDef. 37 | /// The cloned MethodDef. 38 | public static MethodDefUser Clone(MethodDef origin) 39 | { 40 | var ret = new MethodDefUser(origin.Name, null, origin.ImplAttributes, origin.Attributes); 41 | 42 | foreach (GenericParam genericParam in origin.GenericParameters) 43 | ret.GenericParameters.Add(new GenericParamUser(genericParam.Number, genericParam.Flags, "-")); 44 | 45 | return ret; 46 | } 47 | 48 | /// 49 | /// Clones the specified origin FieldDef. 50 | /// 51 | /// The origin FieldDef. 52 | /// The cloned FieldDef. 53 | static FieldDefUser Clone(FieldDef origin) 54 | { 55 | var ret = new FieldDefUser(origin.Name, null, origin.Attributes); 56 | return ret; 57 | } 58 | 59 | /// 60 | /// Populates the context mappings. 61 | /// 62 | /// The origin TypeDef. 63 | /// The injection context. 64 | /// The new TypeDef. 65 | static TypeDef PopulateContext(TypeDef typeDef, InjectContext ctx) 66 | { 67 | TypeDef ret; 68 | IDnlibDef existing; 69 | if (!ctx.Map.TryGetValue(typeDef, out existing)) 70 | { 71 | ret = Clone(typeDef); 72 | ctx.Map[typeDef] = ret; 73 | } 74 | else 75 | ret = (TypeDef)existing; 76 | 77 | foreach (TypeDef nestedType in typeDef.NestedTypes) 78 | ret.NestedTypes.Add(PopulateContext(nestedType, ctx)); 79 | 80 | foreach (MethodDef method in typeDef.Methods) 81 | ret.Methods.Add((MethodDef)(ctx.Map[method] = Clone(method))); 82 | 83 | foreach (FieldDef field in typeDef.Fields) 84 | ret.Fields.Add((FieldDef)(ctx.Map[field] = Clone(field))); 85 | 86 | return ret; 87 | } 88 | 89 | /// 90 | /// Copies the information from the origin type to injected type. 91 | /// 92 | /// The origin TypeDef. 93 | /// The injection context. 94 | static void CopyTypeDef(TypeDef typeDef, InjectContext ctx) 95 | { 96 | var newTypeDef = (TypeDef)ctx.Map[typeDef]; 97 | 98 | newTypeDef.BaseType = (ITypeDefOrRef)ctx.Importer.Import(typeDef.BaseType); 99 | 100 | foreach (InterfaceImpl iface in typeDef.Interfaces) 101 | newTypeDef.Interfaces.Add(new InterfaceImplUser((ITypeDefOrRef)ctx.Importer.Import(iface.Interface))); 102 | } 103 | 104 | /// 105 | /// Copies the information from the origin method to injected method. 106 | /// 107 | /// The origin MethodDef. 108 | /// The injection context. 109 | static void CopyMethodDef(MethodDef methodDef, InjectContext ctx) 110 | { 111 | var newMethodDef = (MethodDef)ctx.Map[methodDef]; 112 | 113 | newMethodDef.Signature = ctx.Importer.Import(methodDef.Signature); 114 | newMethodDef.Parameters.UpdateParameterTypes(); 115 | 116 | if (methodDef.ImplMap != null) 117 | newMethodDef.ImplMap = new ImplMapUser(new ModuleRefUser(ctx.TargetModule, methodDef.ImplMap.Module.Name), methodDef.ImplMap.Name, methodDef.ImplMap.Attributes); 118 | 119 | foreach (CustomAttribute ca in methodDef.CustomAttributes) 120 | newMethodDef.CustomAttributes.Add(new CustomAttribute((ICustomAttributeType)ctx.Importer.Import(ca.Constructor))); 121 | 122 | if (methodDef.HasBody) 123 | { 124 | newMethodDef.Body = new CilBody(methodDef.Body.InitLocals, new List(), new List(), new List()); 125 | newMethodDef.Body.MaxStack = methodDef.Body.MaxStack; 126 | 127 | var bodyMap = new Dictionary(); 128 | 129 | foreach (Local local in methodDef.Body.Variables) 130 | { 131 | var newLocal = new Local(ctx.Importer.Import(local.Type)); 132 | newMethodDef.Body.Variables.Add(newLocal); 133 | newLocal.Name = local.Name; 134 | newLocal.PdbAttributes = local.PdbAttributes; 135 | 136 | bodyMap[local] = newLocal; 137 | } 138 | 139 | foreach (Instruction instr in methodDef.Body.Instructions) 140 | { 141 | var newInstr = new Instruction(instr.OpCode, instr.Operand); 142 | newInstr.SequencePoint = instr.SequencePoint; 143 | 144 | if (newInstr.Operand is IType) 145 | newInstr.Operand = ctx.Importer.Import((IType)newInstr.Operand); 146 | 147 | else if (newInstr.Operand is IMethod) 148 | newInstr.Operand = ctx.Importer.Import((IMethod)newInstr.Operand); 149 | 150 | else if (newInstr.Operand is IField) 151 | newInstr.Operand = ctx.Importer.Import((IField)newInstr.Operand); 152 | 153 | newMethodDef.Body.Instructions.Add(newInstr); 154 | bodyMap[instr] = newInstr; 155 | } 156 | 157 | foreach (Instruction instr in newMethodDef.Body.Instructions) 158 | { 159 | if (instr.Operand != null && bodyMap.ContainsKey(instr.Operand)) 160 | instr.Operand = bodyMap[instr.Operand]; 161 | 162 | else if (instr.Operand is Instruction[]) 163 | instr.Operand = ((Instruction[])instr.Operand).Select(target => (Instruction)bodyMap[target]).ToArray(); 164 | } 165 | 166 | foreach (ExceptionHandler eh in methodDef.Body.ExceptionHandlers) 167 | newMethodDef.Body.ExceptionHandlers.Add(new ExceptionHandler(eh.HandlerType) 168 | { 169 | CatchType = eh.CatchType == null ? null : (ITypeDefOrRef)ctx.Importer.Import(eh.CatchType), 170 | TryStart = (Instruction)bodyMap[eh.TryStart], 171 | TryEnd = (Instruction)bodyMap[eh.TryEnd], 172 | HandlerStart = (Instruction)bodyMap[eh.HandlerStart], 173 | HandlerEnd = (Instruction)bodyMap[eh.HandlerEnd], 174 | FilterStart = eh.FilterStart == null ? null : (Instruction)bodyMap[eh.FilterStart] 175 | }); 176 | 177 | newMethodDef.Body.SimplifyMacros(newMethodDef.Parameters); 178 | } 179 | } 180 | 181 | /// 182 | /// Copies the information from the origin field to injected field. 183 | /// 184 | /// The origin FieldDef. 185 | /// The injection context. 186 | static void CopyFieldDef(FieldDef fieldDef, InjectContext ctx) 187 | { 188 | var newFieldDef = (FieldDef)ctx.Map[fieldDef]; 189 | 190 | newFieldDef.Signature = ctx.Importer.Import(fieldDef.Signature); 191 | } 192 | 193 | /// 194 | /// Copies the information to the injected definitions. 195 | /// 196 | /// The origin TypeDef. 197 | /// The injection context. 198 | /// if set to true, copy information of . 199 | static void Copy(TypeDef typeDef, InjectContext ctx, bool copySelf) 200 | { 201 | if (copySelf) 202 | CopyTypeDef(typeDef, ctx); 203 | 204 | foreach (TypeDef nestedType in typeDef.NestedTypes) 205 | Copy(nestedType, ctx, true); 206 | 207 | foreach (MethodDef method in typeDef.Methods) 208 | CopyMethodDef(method, ctx); 209 | 210 | foreach (FieldDef field in typeDef.Fields) 211 | CopyFieldDef(field, ctx); 212 | } 213 | 214 | /// 215 | /// Injects the specified TypeDef to another module. 216 | /// 217 | /// The source TypeDef. 218 | /// The target module. 219 | /// The injected TypeDef. 220 | public static TypeDef Inject(TypeDef typeDef, ModuleDef target) 221 | { 222 | var ctx = new InjectContext(typeDef.Module, target); 223 | PopulateContext(typeDef, ctx); 224 | Copy(typeDef, ctx, true); 225 | return (TypeDef)ctx.Map[typeDef]; 226 | } 227 | 228 | /// 229 | /// Injects the specified MethodDef to another module. 230 | /// 231 | /// The source MethodDef. 232 | /// The target module. 233 | /// The injected MethodDef. 234 | public static MethodDef Inject(MethodDef methodDef, ModuleDef target) 235 | { 236 | var ctx = new InjectContext(methodDef.Module, target); 237 | ctx.Map[methodDef] = Clone(methodDef); 238 | CopyMethodDef(methodDef, ctx); 239 | return (MethodDef)ctx.Map[methodDef]; 240 | } 241 | 242 | /// 243 | /// Injects the members of specified TypeDef to another module. 244 | /// 245 | /// The source TypeDef. 246 | /// The new type. 247 | /// The target module. 248 | /// Injected members. 249 | public static IEnumerable Inject(TypeDef typeDef, TypeDef newType, ModuleDef target) 250 | { 251 | var ctx = new InjectContext(typeDef.Module, target); 252 | ctx.Map[typeDef] = newType; 253 | PopulateContext(typeDef, ctx); 254 | Copy(typeDef, ctx, false); 255 | return ctx.Map.Values.Except(new[] { newType }); 256 | } 257 | 258 | /// 259 | /// Context of the injection process. 260 | /// 261 | class InjectContext : ImportResolver 262 | { 263 | /// 264 | /// The mapping of origin definitions to injected definitions. 265 | /// 266 | public readonly Dictionary Map = new Dictionary(); 267 | 268 | /// 269 | /// The module which source type originated from. 270 | /// 271 | public readonly ModuleDef OriginModule; 272 | 273 | /// 274 | /// The module which source type is being injected to. 275 | /// 276 | public readonly ModuleDef TargetModule; 277 | 278 | /// 279 | /// The importer. 280 | /// 281 | readonly Importer importer; 282 | 283 | /// 284 | /// Initializes a new instance of the class. 285 | /// 286 | /// The origin module. 287 | /// The target module. 288 | public InjectContext(ModuleDef module, ModuleDef target) 289 | { 290 | OriginModule = module; 291 | TargetModule = target; 292 | importer = new Importer(target, ImporterOptions.TryToUseTypeDefs); 293 | importer.Resolver = this; 294 | } 295 | 296 | /// 297 | /// Gets the importer. 298 | /// 299 | /// The importer. 300 | public Importer Importer 301 | { 302 | get { return importer; } 303 | } 304 | 305 | /// 306 | public override TypeDef Resolve(TypeDef typeDef) 307 | { 308 | if (Map.ContainsKey(typeDef)) 309 | return (TypeDef)Map[typeDef]; 310 | return null; 311 | } 312 | 313 | /// 314 | public override MethodDef Resolve(MethodDef methodDef) 315 | { 316 | if (Map.ContainsKey(methodDef)) 317 | return (MethodDef)Map[methodDef]; 318 | return null; 319 | } 320 | 321 | /// 322 | public override FieldDef Resolve(FieldDef fieldDef) 323 | { 324 | if (Map.ContainsKey(fieldDef)) 325 | return (FieldDef)Map[fieldDef]; 326 | return null; 327 | } 328 | } 329 | } 330 | } 331 | -------------------------------------------------------------------------------- /ProxyCalld/Program.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Diagnostics; 4 | using System.IO; 5 | using System.Linq; 6 | using System.Reflection; 7 | using System.Security.Cryptography; 8 | using System.Text; 9 | using dnlib.DotNet; 10 | using dnlib.DotNet.Emit; 11 | using dnlib.DotNet.Writer; 12 | 13 | namespace ProxyCalld 14 | { 15 | class Program 16 | { 17 | /// 18 | /// A list to store proxy method to prevent infinite loop 19 | /// 20 | public static List proxyMethod = new List(); 21 | 22 | /// 23 | /// Save deobfuqcated file to disk 24 | /// 25 | static void savefile(ModuleDefMD mod) 26 | { 27 | string text2 = Path.GetDirectoryName(mod.Location); 28 | 29 | if (!text2.EndsWith("\\")) text2 += "\\"; 30 | 31 | string path = text2 + Path.GetFileNameWithoutExtension(mod.Location) + "_deobfuscated" + 32 | Path.GetExtension(mod.Location); 33 | var opts = new ModuleWriterOptions(mod); 34 | opts.Logger = DummyLogger.NoThrowInstance; 35 | mod.Write(path, opts); 36 | Console.WriteLine($"[!] File saved : {path}"); 37 | } 38 | 39 | /// 40 | /// Entry point of protector 41 | /// 42 | /// 43 | static void Main(string[] args) 44 | { 45 | //Proxy intensity 46 | int intensity = 2; 47 | 48 | if (args.Length < 0) 49 | { 50 | Console.WriteLine("Input file missing"); 51 | return; 52 | } 53 | 54 | ModuleDefMD mod = ModuleDefMD.Load(args[0]); 55 | Console.WriteLine($"[!] File loaded : {mod.Location}"); 56 | 57 | Console.WriteLine($" [+] starting CloningMethod protection with intensity {intensity}..."); 58 | CloneMethods(mod, intensity); 59 | 60 | Console.WriteLine("[!] Saving file..."); 61 | savefile(mod); 62 | 63 | Console.ReadKey(); 64 | } 65 | 66 | /// 67 | /// Proxy Call protection 68 | /// 69 | /// -Grab MethodDef 70 | /// -Copy MethodDef in MethodDef.Types 71 | /// -Replace Call to the other created Method 72 | /// 73 | static void CloneMethods(ModuleDefMD mod, int intensity = 1) 74 | { 75 | for (int o = 0; o < intensity; o++) 76 | { 77 | foreach (var t in mod.Types) 78 | { 79 | 80 | if (t.IsGlobalModuleType) continue; 81 | 82 | int mCount = t.Methods.Count; 83 | for (int i = 0; i < mCount; i++) 84 | { 85 | var m = t.Methods[i]; 86 | 87 | if (!m.HasBody) continue; 88 | var inst = m.Body.Instructions; 89 | 90 | for (int z = 0; z < inst.Count; z++) 91 | { 92 | if (inst[z].OpCode == OpCodes.Call) 93 | { 94 | 95 | try 96 | { 97 | MethodDef targetMetod = inst[z].Operand as MethodDef; 98 | 99 | /* Un comment that if you dont want to proxy methodproxy*/ 100 | 101 | //if method is a proxy method 102 | //if (proxyMethod.Contains(targetMetod)) 103 | //{ 104 | // //Console.WriteLine($" [-] Method is a proxyMethod : {inst[z]}"); 105 | // continue; 106 | //} 107 | 108 | //if method is internal 109 | if (!targetMetod.FullName.Contains(mod.Assembly.Name)) 110 | { 111 | //Console.WriteLine($" [-] Method is external : {inst[z]}"); 112 | continue; 113 | } 114 | 115 | //if param != 0 116 | if (targetMetod.Parameters.Count == 0) 117 | { 118 | //Console.WriteLine($" [-] Method has no parameters : {inst[z]}"); 119 | continue; 120 | } 121 | 122 | //if param > 4 (simple Ldarg opcode) 123 | if (targetMetod.Parameters.Count > 4) 124 | { 125 | //Console.WriteLine($" [-] Method has too many parameters : {inst[z]}"); 126 | continue; 127 | } 128 | 129 | //clone method 130 | Console.WriteLine($" [+] Found method to clone : {inst[z]}"); 131 | Console.WriteLine($" [+] Cloning method..."); 132 | MethodDef newMeth = targetMetod.copyMethod(mod); 133 | TypeDef typeOfMethod = targetMetod.DeclaringType; 134 | typeOfMethod.Methods.Add(newMeth); 135 | Console.WriteLine($" [+] Method cloned to : {newMeth.Name}"); 136 | proxyMethod.Add(newMeth); 137 | 138 | //replace method with call with param and signatures 139 | Console.WriteLine($" [+] Editing original method..."); 140 | Console.WriteLine($" [+] Import method Attributes..."); 141 | Clonesignature(targetMetod, newMeth); 142 | Console.WriteLine($" [+] Fix call conventions..."); 143 | /* 144 | nop 145 | ldarg.0 146 | ldarg.1 147 | call 148 | ret 149 | */ 150 | CilBody body = new CilBody(); 151 | body.Instructions.Add(OpCodes.Nop.ToInstruction()); 152 | for (int x = 0; x < targetMetod.Parameters.Count; x++) 153 | { 154 | //for future references, you will need it 155 | var typeofParam = targetMetod.Parameters[x]; 156 | 157 | switch (x) 158 | { 159 | case 0: 160 | body.Instructions.Add(OpCodes.Ldarg_0.ToInstruction()); 161 | break; 162 | case 1: 163 | body.Instructions.Add(OpCodes.Ldarg_1.ToInstruction()); 164 | break; 165 | case 2: 166 | body.Instructions.Add(OpCodes.Ldarg_2.ToInstruction()); 167 | break; 168 | case 3: 169 | body.Instructions.Add(OpCodes.Ldarg_3.ToInstruction()); 170 | break; 171 | } 172 | } 173 | body.Instructions.Add(Instruction.Create(OpCodes.Call, newMeth)); 174 | body.Instructions.Add(OpCodes.Ret.ToInstruction()); 175 | 176 | targetMetod.Body = body; 177 | Console.WriteLine($" [+] Original method edited !"); 178 | 179 | 180 | 181 | } 182 | catch (Exception ex) 183 | { 184 | //Console.WriteLine($" [-] Operand is not a MethodDef : {inst[z]}"); 185 | //Console.WriteLine(ex.ToString()); 186 | continue; 187 | } 188 | 189 | } 190 | } 191 | 192 | } 193 | 194 | } 195 | } 196 | 197 | } 198 | 199 | public static MethodDef Clonesignature(MethodDef from, MethodDef to) 200 | { 201 | to.Attributes = from.Attributes; 202 | 203 | if (from.IsHideBySig) 204 | to.IsHideBySig = true; 205 | 206 | return to; 207 | } 208 | 209 | 210 | } 211 | 212 | static class extension 213 | { 214 | /// 215 | /// Context of the injection process. 216 | /// 217 | class InjectContext : ImportResolver 218 | { 219 | /// 220 | /// The mapping of origin definitions to injected definitions. 221 | /// 222 | public readonly Dictionary Map = new Dictionary(); 223 | 224 | /// 225 | /// The module which source type originated from. 226 | /// 227 | public readonly ModuleDef OriginModule; 228 | 229 | /// 230 | /// The module which source type is being injected to. 231 | /// 232 | public readonly ModuleDef TargetModule; 233 | 234 | /// 235 | /// The importer. 236 | /// 237 | readonly Importer importer; 238 | 239 | /// 240 | /// Initializes a new instance of the class. 241 | /// 242 | /// The origin module. 243 | /// The target module. 244 | public InjectContext(ModuleDef module, ModuleDef target) 245 | { 246 | OriginModule = module; 247 | TargetModule = target; 248 | importer = new Importer(target, ImporterOptions.TryToUseTypeDefs); 249 | importer.Resolver = this; 250 | } 251 | 252 | /// 253 | /// Gets the importer. 254 | /// 255 | /// The importer. 256 | public Importer Importer 257 | { 258 | get { return importer; } 259 | } 260 | 261 | /// 262 | public override TypeDef Resolve(TypeDef typeDef) 263 | { 264 | if (Map.ContainsKey(typeDef)) 265 | return (TypeDef)Map[typeDef]; 266 | return null; 267 | } 268 | 269 | /// 270 | public override MethodDef Resolve(MethodDef methodDef) 271 | { 272 | if (Map.ContainsKey(methodDef)) 273 | return (MethodDef)Map[methodDef]; 274 | return null; 275 | } 276 | 277 | /// 278 | public override FieldDef Resolve(FieldDef fieldDef) 279 | { 280 | if (Map.ContainsKey(fieldDef)) 281 | return (FieldDef)Map[fieldDef]; 282 | return null; 283 | } 284 | } 285 | 286 | public static MethodDef copyMethod(this MethodDef originMethod, ModuleDefMD mod) 287 | { 288 | InjectContext ctx = new InjectContext(mod, mod); 289 | 290 | MethodDefUser newMethodDef = new MethodDefUser 291 | { 292 | Signature = ctx.Importer.Import(originMethod.Signature) 293 | }; 294 | 295 | newMethodDef.Name = Guid.NewGuid().ToString().Replace("-", string.Empty); 296 | 297 | newMethodDef.Parameters.UpdateParameterTypes(); 298 | 299 | if (originMethod.ImplMap != null) 300 | newMethodDef.ImplMap = new ImplMapUser(new ModuleRefUser(ctx.TargetModule, originMethod.ImplMap.Module.Name), originMethod.ImplMap.Name, originMethod.ImplMap.Attributes); 301 | 302 | foreach (CustomAttribute ca in originMethod.CustomAttributes) 303 | newMethodDef.CustomAttributes.Add(new CustomAttribute((ICustomAttributeType)ctx.Importer.Import(ca.Constructor))); 304 | 305 | if (originMethod.HasBody) 306 | { 307 | newMethodDef.Body = new CilBody(originMethod.Body.InitLocals, new List(), new List(), new List()); 308 | newMethodDef.Body.MaxStack = originMethod.Body.MaxStack; 309 | 310 | var bodyMap = new Dictionary(); 311 | 312 | foreach (Local local in originMethod.Body.Variables) 313 | { 314 | var newLocal = new Local(ctx.Importer.Import(local.Type)); 315 | newMethodDef.Body.Variables.Add(newLocal); 316 | newLocal.Name = local.Name; 317 | newLocal.PdbAttributes = local.PdbAttributes; 318 | 319 | bodyMap[local] = newLocal; 320 | } 321 | 322 | foreach (Instruction instr in originMethod.Body.Instructions) 323 | { 324 | var newInstr = new Instruction(instr.OpCode, instr.Operand); 325 | newInstr.SequencePoint = instr.SequencePoint; 326 | 327 | if (newInstr.Operand is IType) 328 | newInstr.Operand = ctx.Importer.Import((IType)newInstr.Operand); 329 | 330 | else if (newInstr.Operand is IMethod) 331 | newInstr.Operand = ctx.Importer.Import((IMethod)newInstr.Operand); 332 | 333 | else if (newInstr.Operand is IField) 334 | newInstr.Operand = ctx.Importer.Import((IField)newInstr.Operand); 335 | 336 | newMethodDef.Body.Instructions.Add(newInstr); 337 | bodyMap[instr] = newInstr; 338 | } 339 | 340 | foreach (Instruction instr in newMethodDef.Body.Instructions) 341 | { 342 | if (instr.Operand != null && bodyMap.ContainsKey(instr.Operand)) 343 | instr.Operand = bodyMap[instr.Operand]; 344 | 345 | else if (instr.Operand is Instruction[]) 346 | instr.Operand = ((Instruction[])instr.Operand).Select(target => (Instruction)bodyMap[target]).ToArray(); 347 | } 348 | 349 | foreach (ExceptionHandler eh in originMethod.Body.ExceptionHandlers) 350 | newMethodDef.Body.ExceptionHandlers.Add(new ExceptionHandler(eh.HandlerType) 351 | { 352 | CatchType = eh.CatchType == null ? null : (ITypeDefOrRef)ctx.Importer.Import(eh.CatchType), 353 | TryStart = (Instruction)bodyMap[eh.TryStart], 354 | TryEnd = (Instruction)bodyMap[eh.TryEnd], 355 | HandlerStart = (Instruction)bodyMap[eh.HandlerStart], 356 | HandlerEnd = (Instruction)bodyMap[eh.HandlerEnd], 357 | FilterStart = eh.FilterStart == null ? null : (Instruction)bodyMap[eh.FilterStart] 358 | }); 359 | 360 | newMethodDef.Body.SimplifyMacros(newMethodDef.Parameters); 361 | } 362 | 363 | return newMethodDef; 364 | } 365 | } 366 | } 367 | -------------------------------------------------------------------------------- /ProxyCalld/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection; 2 | using System.Runtime.CompilerServices; 3 | using System.Runtime.InteropServices; 4 | 5 | // Les informations générales relatives à un assembly dépendent de 6 | // l'ensemble d'attributs suivant. Changez les valeurs de ces attributs pour modifier les informations 7 | // associées à un assembly. 8 | [assembly: AssemblyTitle("ProxyCalld")] 9 | [assembly: AssemblyDescription("")] 10 | [assembly: AssemblyConfiguration("")] 11 | [assembly: AssemblyCompany("")] 12 | [assembly: AssemblyProduct("ProxyCalld")] 13 | [assembly: AssemblyCopyright("Copyright © 2018")] 14 | [assembly: AssemblyTrademark("")] 15 | [assembly: AssemblyCulture("")] 16 | 17 | // L'affectation de la valeur false à ComVisible rend les types invisibles dans cet assembly 18 | // aux composants COM. Si vous devez accéder à un type dans cet assembly à partir de 19 | // COM, affectez la valeur true à l'attribut ComVisible sur ce type. 20 | [assembly: ComVisible(false)] 21 | 22 | // Le GUID suivant est pour l'ID de la typelib si ce projet est exposé à COM 23 | [assembly: Guid("460e54d6-4eb5-4323-aa58-132e69ad3a02")] 24 | 25 | // Les informations de version pour un assembly se composent des quatre valeurs suivantes : 26 | // 27 | // Version principale 28 | // Version secondaire 29 | // Numéro de build 30 | // Révision 31 | // 32 | // Vous pouvez spécifier toutes les valeurs ou indiquer les numéros de build et de révision par défaut 33 | // en utilisant '*', comme indiqué ci-dessous : 34 | // [assembly: AssemblyVersion("1.0.*")] 35 | [assembly: AssemblyVersion("1.0.0.0")] 36 | [assembly: AssemblyFileVersion("1.0.0.0")] 37 | -------------------------------------------------------------------------------- /ProxyCalld/ProxyCalld.csproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | AnyCPU 7 | {460E54D6-4EB5-4323-AA58-132E69AD3A02} 8 | Exe 9 | ProxyCalld 10 | ProxyCalld 11 | v4.0 12 | 512 13 | 14 | 15 | 16 | AnyCPU 17 | true 18 | full 19 | false 20 | bin\Debug\ 21 | DEBUG;TRACE 22 | prompt 23 | 4 24 | 25 | 26 | AnyCPU 27 | pdbonly 28 | true 29 | bin\Release\ 30 | TRACE 31 | prompt 32 | 4 33 | 34 | 35 | 36 | ..\..\..\..\Desktop\dnlib.dll 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | -------------------------------------------------------------------------------- /ProxyCalld/ProxyCalld.csproj.user: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | C:\Users\xenocode\source\repos\ProxyCalld\ProxyTest\bin\Debug\ProxyTest.exe 5 | 6 | -------------------------------------------------------------------------------- /ProxyCalld/app.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -------------------------------------------------------------------------------- /ProxyCalld/bin/Debug/ProxyCalld.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XenocodeRCE/BasicProxyObfucator/5584949d70bb68231b4b2d4a8a7a2e1068f2a80e/ProxyCalld/bin/Debug/ProxyCalld.exe -------------------------------------------------------------------------------- /ProxyCalld/bin/Debug/ProxyCalld.exe.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -------------------------------------------------------------------------------- /ProxyCalld/bin/Debug/ProxyCalld.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XenocodeRCE/BasicProxyObfucator/5584949d70bb68231b4b2d4a8a7a2e1068f2a80e/ProxyCalld/bin/Debug/ProxyCalld.pdb -------------------------------------------------------------------------------- /ProxyCalld/bin/Debug/dnlib.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XenocodeRCE/BasicProxyObfucator/5584949d70bb68231b4b2d4a8a7a2e1068f2a80e/ProxyCalld/bin/Debug/dnlib.dll -------------------------------------------------------------------------------- /ProxyCalld/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XenocodeRCE/BasicProxyObfucator/5584949d70bb68231b4b2d4a8a7a2e1068f2a80e/ProxyCalld/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache -------------------------------------------------------------------------------- /ProxyCalld/obj/Debug/ProxyCalld.csproj.CopyComplete: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XenocodeRCE/BasicProxyObfucator/5584949d70bb68231b4b2d4a8a7a2e1068f2a80e/ProxyCalld/obj/Debug/ProxyCalld.csproj.CopyComplete -------------------------------------------------------------------------------- /ProxyCalld/obj/Debug/ProxyCalld.csproj.CoreCompileInputs.cache: -------------------------------------------------------------------------------- 1 | 37a2add9dd6cee0cb4106159690ac3b6b8d97763 2 | -------------------------------------------------------------------------------- /ProxyCalld/obj/Debug/ProxyCalld.csproj.FileListAbsolute.txt: -------------------------------------------------------------------------------- 1 | C:\Users\xenocode\source\repos\ProxyCalld\ProxyCalld\bin\Debug\ProxyCalld.exe.config 2 | C:\Users\xenocode\source\repos\ProxyCalld\ProxyCalld\bin\Debug\ProxyCalld.exe 3 | C:\Users\xenocode\source\repos\ProxyCalld\ProxyCalld\bin\Debug\ProxyCalld.pdb 4 | C:\Users\xenocode\source\repos\ProxyCalld\ProxyCalld\bin\Debug\dnlib.dll 5 | C:\Users\xenocode\source\repos\ProxyCalld\ProxyCalld\obj\Debug\ProxyCalld.csprojAssemblyReference.cache 6 | C:\Users\xenocode\source\repos\ProxyCalld\ProxyCalld\obj\Debug\ProxyCalld.csproj.CoreCompileInputs.cache 7 | C:\Users\xenocode\source\repos\ProxyCalld\ProxyCalld\obj\Debug\ProxyCalld.csproj.CopyComplete 8 | C:\Users\xenocode\source\repos\ProxyCalld\ProxyCalld\obj\Debug\ProxyCalld.exe 9 | C:\Users\xenocode\source\repos\ProxyCalld\ProxyCalld\obj\Debug\ProxyCalld.pdb 10 | -------------------------------------------------------------------------------- /ProxyCalld/obj/Debug/ProxyCalld.csprojAssemblyReference.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XenocodeRCE/BasicProxyObfucator/5584949d70bb68231b4b2d4a8a7a2e1068f2a80e/ProxyCalld/obj/Debug/ProxyCalld.csprojAssemblyReference.cache -------------------------------------------------------------------------------- /ProxyCalld/obj/Debug/ProxyCalld.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XenocodeRCE/BasicProxyObfucator/5584949d70bb68231b4b2d4a8a7a2e1068f2a80e/ProxyCalld/obj/Debug/ProxyCalld.exe -------------------------------------------------------------------------------- /ProxyCalld/obj/Debug/ProxyCalld.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XenocodeRCE/BasicProxyObfucator/5584949d70bb68231b4b2d4a8a7a2e1068f2a80e/ProxyCalld/obj/Debug/ProxyCalld.pdb -------------------------------------------------------------------------------- /ProxyTest/Program.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Diagnostics; 3 | using System.IO; 4 | using System.Reflection; 5 | using System.Security.Cryptography; 6 | using System.Text; 7 | 8 | 9 | namespace ProxyTest 10 | { 11 | class Program 12 | { 13 | static void Main(string[] args) 14 | { 15 | Console.WriteLine("Hello world. Proxy method test o/"); 16 | Console.WriteLine(Add(1336, 1) + Sub(123456, 1234) + cout("all")); 17 | 18 | Console.ReadKey(); 19 | } 20 | 21 | static int Add(int a, int b) 22 | { 23 | return a + b; 24 | } 25 | 26 | static int Sub(int a, int b) 27 | { 28 | return a + b; 29 | } 30 | 31 | static string cout(string str) 32 | { 33 | return "world" + str + "hello"; 34 | } 35 | } 36 | } 37 | -------------------------------------------------------------------------------- /ProxyTest/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection; 2 | using System.Runtime.CompilerServices; 3 | using System.Runtime.InteropServices; 4 | 5 | // Les informations générales relatives à un assembly dépendent de 6 | // l'ensemble d'attributs suivant. Changez les valeurs de ces attributs pour modifier les informations 7 | // associées à un assembly. 8 | [assembly: AssemblyTitle("ProxyTest")] 9 | [assembly: AssemblyDescription("")] 10 | [assembly: AssemblyConfiguration("")] 11 | [assembly: AssemblyCompany("")] 12 | [assembly: AssemblyProduct("ProxyTest")] 13 | [assembly: AssemblyCopyright("Copyright © 2018")] 14 | [assembly: AssemblyTrademark("")] 15 | [assembly: AssemblyCulture("")] 16 | 17 | // L'affectation de la valeur false à ComVisible rend les types invisibles dans cet assembly 18 | // aux composants COM. Si vous devez accéder à un type dans cet assembly à partir de 19 | // COM, affectez la valeur true à l'attribut ComVisible sur ce type. 20 | [assembly: ComVisible(false)] 21 | 22 | // Le GUID suivant est pour l'ID de la typelib si ce projet est exposé à COM 23 | [assembly: Guid("90c2b6a4-d203-405b-b140-0645b39eaf7b")] 24 | 25 | // Les informations de version pour un assembly se composent des quatre valeurs suivantes : 26 | // 27 | // Version principale 28 | // Version secondaire 29 | // Numéro de build 30 | // Révision 31 | // 32 | // Vous pouvez spécifier toutes les valeurs ou indiquer les numéros de build et de révision par défaut 33 | // en utilisant '*', comme indiqué ci-dessous : 34 | // [assembly: AssemblyVersion("1.0.*")] 35 | [assembly: AssemblyVersion("1.0.0.0")] 36 | [assembly: AssemblyFileVersion("1.0.0.0")] 37 | -------------------------------------------------------------------------------- /ProxyTest/ProxyTest.csproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | AnyCPU 7 | {90C2B6A4-D203-405B-B140-0645B39EAF7B} 8 | Exe 9 | ProxyTest 10 | ProxyTest 11 | v2.0 12 | 512 13 | 14 | 15 | AnyCPU 16 | true 17 | full 18 | false 19 | bin\Debug\ 20 | DEBUG;TRACE 21 | prompt 22 | 4 23 | 24 | 25 | AnyCPU 26 | pdbonly 27 | true 28 | bin\Release\ 29 | TRACE 30 | prompt 31 | 4 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | -------------------------------------------------------------------------------- /ProxyTest/bin/Debug/ProxyTest.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XenocodeRCE/BasicProxyObfucator/5584949d70bb68231b4b2d4a8a7a2e1068f2a80e/ProxyTest/bin/Debug/ProxyTest.exe -------------------------------------------------------------------------------- /ProxyTest/bin/Debug/ProxyTest.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XenocodeRCE/BasicProxyObfucator/5584949d70bb68231b4b2d4a8a7a2e1068f2a80e/ProxyTest/bin/Debug/ProxyTest.pdb -------------------------------------------------------------------------------- /ProxyTest/bin/Debug/ProxyTest_deobfuscated.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XenocodeRCE/BasicProxyObfucator/5584949d70bb68231b4b2d4a8a7a2e1068f2a80e/ProxyTest/bin/Debug/ProxyTest_deobfuscated.exe -------------------------------------------------------------------------------- /ProxyTest/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XenocodeRCE/BasicProxyObfucator/5584949d70bb68231b4b2d4a8a7a2e1068f2a80e/ProxyTest/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache -------------------------------------------------------------------------------- /ProxyTest/obj/Debug/ProxyTest.csproj.CoreCompileInputs.cache: -------------------------------------------------------------------------------- 1 | 4d8c2363a3bb8ebb9f499894921f41e7b206e3f4 2 | -------------------------------------------------------------------------------- /ProxyTest/obj/Debug/ProxyTest.csproj.FileListAbsolute.txt: -------------------------------------------------------------------------------- 1 | C:\Users\xenocode\source\repos\ProxyCalld\ProxyTest\bin\Debug\ProxyTest.exe 2 | C:\Users\xenocode\source\repos\ProxyCalld\ProxyTest\bin\Debug\ProxyTest.pdb 3 | C:\Users\xenocode\source\repos\ProxyCalld\ProxyTest\obj\Debug\ProxyTest.csprojAssemblyReference.cache 4 | C:\Users\xenocode\source\repos\ProxyCalld\ProxyTest\obj\Debug\ProxyTest.csproj.CoreCompileInputs.cache 5 | C:\Users\xenocode\source\repos\ProxyCalld\ProxyTest\obj\Debug\ProxyTest.exe 6 | C:\Users\xenocode\source\repos\ProxyCalld\ProxyTest\obj\Debug\ProxyTest.pdb 7 | -------------------------------------------------------------------------------- /ProxyTest/obj/Debug/ProxyTest.csprojAssemblyReference.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XenocodeRCE/BasicProxyObfucator/5584949d70bb68231b4b2d4a8a7a2e1068f2a80e/ProxyTest/obj/Debug/ProxyTest.csprojAssemblyReference.cache -------------------------------------------------------------------------------- /ProxyTest/obj/Debug/ProxyTest.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XenocodeRCE/BasicProxyObfucator/5584949d70bb68231b4b2d4a8a7a2e1068f2a80e/ProxyTest/obj/Debug/ProxyTest.exe -------------------------------------------------------------------------------- /ProxyTest/obj/Debug/ProxyTest.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XenocodeRCE/BasicProxyObfucator/5584949d70bb68231b4b2d4a8a7a2e1068f2a80e/ProxyTest/obj/Debug/ProxyTest.pdb -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # BasicProxyObfucator 2 | a very basic proxy obfuscator based on dnlib 3 | 4 | ![](https://i.imgur.com/h3vHlEe.png) 5 | 6 | ![](https://i.imgur.com/p9Q0z9N.png) 7 | 8 | Basic. Do not cover some exception with virtual method and so on. 9 | 10 | --------------------------------------------------------------------------------