Noisette-Obfuscator icon indicating copy to clipboard operation
Noisette-Obfuscator copied to clipboard

Really really close to creating control flow graph/integrity

Open ghost opened this issue 5 years ago • 8 comments

Hey, I've come really really close to creating CFG/Integrity, where an integer in the app will increase or decrease to prevent anti tamper.

Here's what I've got so far, and the only problem I have is after it runs the protection for Main() the number wont be right for the next method.

https://pastebin.com/AL38M37t Image Image

ghost avatar Nov 18 '18 17:11 ghost

@XenocodeRCE

ghost avatar Nov 18 '18 17:11 ghost

Okay, fixed the code now ( I was accidentally processing the same method twice). Now the only problem I'm aware of is that we can't know the execution order of all the methods, and so we don't know which order to process the methods in. Or am I wrong??

ghost avatar Nov 18 '18 17:11 ghost

@gigajew You are not wrong : we cannot know 99% of the call order in a file. However :

• We know that Initializecomponent() is called by the .ctor for every Form class type • We know that Dispose() is called by the .ctor for every Form class type • We know that constructor (.ctor / .cctor) are called every time you initialize a Class • Main in program is always executed after the <Module> .ctor

XenocodeRCE avatar Nov 18 '18 18:11 XenocodeRCE

This could easily be implemented as long as you keep a separate int variable for each method though. So it's pretty neat.

ghost avatar Nov 18 '18 18:11 ghost

Can you create a new pull request ? https://github.com/XenocodeRCE/Noisette-Obfuscator/pulls

Maybe this way I can help you to improve it

XenocodeRCE avatar Nov 18 '18 20:11 XenocodeRCE

Done

ghost avatar Nov 18 '18 21:11 ghost

It seems it can mess up branches.. needs a lot of work

ghost avatar Nov 20 '18 01:11 ghost

I see one problem that I am sure of. It messes up Booleans because they are stored as integers in the IL. (Ldc_I4_1 and Ldc_I4_0) so they have to be skipped. I found another problem that I am investigating right now.

ghost avatar Nov 21 '18 01:11 ghost