i2p/sheet-rat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

initial commit

Browse Source
This commit is contained in:
i2p
2026-08-27 11:23:25 -06:00
commit faef36ee57
588 changed files with 40547 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Server/MindLated/Protection/CtrlFlow/Block.cs
+25
View File
@@ -0,0 +1,25 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.CtrlFlow.Block
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet.Emit;
using System.Collections.Generic;
//#nullable disable
namespace MindLated.Protection.CtrlFlow {
public class Block
{
public Block() => this.Instructions = new List<Instruction>();
public List<Instruction> Instructions { get; set; }
public int Number { get; set; }
public int SubRand { get; set; }
public int PlusRand { get; set; }
}
}
Server/MindLated/Protection/CtrlFlow/BlockParser.cs
+54
View File
@@ -0,0 +1,54 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.CtrlFlow.BlockParser
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using System.Collections.Generic;
//#nullable disable
namespace MindLated.Protection.CtrlFlow {
public class BlockParser
{
public static List<Block> ParseMethod(MethodDef method)
{
List<Block> method1 = new List<Block>();
Block block1 = new Block();
int num1 = 0;
int num2 = 0;
block1.Number = num1;
block1.Instructions.Add(Instruction.Create(OpCodes.Nop));
method1.Add(block1);
Block block2 = new Block();
Stack<ExceptionHandler> exceptionHandlerStack = new Stack<ExceptionHandler>();
foreach (Instruction instruction in (IEnumerable<Instruction>) method.Body.Instructions)
{
foreach (ExceptionHandler exceptionHandler in (IEnumerable<ExceptionHandler>) method.Body.ExceptionHandlers)
{
if (exceptionHandler.HandlerStart == instruction || exceptionHandler.TryStart == instruction || exceptionHandler.FilterStart == instruction)
exceptionHandlerStack.Push(exceptionHandler);
}
foreach (ExceptionHandler exceptionHandler in (IEnumerable<ExceptionHandler>) method.Body.ExceptionHandlers)
{
if (exceptionHandler.HandlerEnd == instruction || exceptionHandler.TryEnd == instruction)
exceptionHandlerStack.Pop();
}
int pushes;
int pops;
instruction.CalculateStackUsage(out pushes, out pops);
block2.Instructions.Add(instruction);
num2 += pushes - pops;
if (pushes == 0 && instruction.OpCode != OpCodes.Nop && (num2 == 0 || instruction.OpCode == OpCodes.Ret) && exceptionHandlerStack.Count == 0)
{
block2.Number = ++num1;
method1.Add(block2);
block2 = new Block();
}
}
return method1;
}
}
}
Server/MindLated/Protection/CtrlFlow/ControlFlowObfuscation.cs
+180
View File
@@ -0,0 +1,180 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.CtrlFlow.ControlFlowObfuscation
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Renamer;
using System;
using System.Windows.Forms;
using System.Collections.Generic;
using System.Linq;
//#nullable disable
namespace MindLated.Protection.CtrlFlow {
internal class ControlFlowObfuscation
{
public static Random rnd = new Random();
public static void Execute(ModuleDefMD md)
{
foreach (TypeDef type in (IEnumerable<TypeDef>) md.Types)
{
if (type != md.GlobalType)
{
foreach (MethodDef method in (IEnumerable<MethodDef>) type.Methods)
{
if (!method.Name.StartsWith("get_") && !method.Name.StartsWith("set_") && method.HasBody && !method.IsConstructor)
{
method.Body.SimplifyBranches();
ControlFlowObfuscation.ExecuteMethod(method);
}
}
}
}
}
public static Instruction StLoc(Local local)
{
switch (local.Index)
{
case 0:
return Instruction.Create(OpCodes.Stloc_0);
case 1:
return Instruction.Create(OpCodes.Stloc_1);
case 2:
return Instruction.Create(OpCodes.Stloc_2);
case 3:
return Instruction.Create(OpCodes.Stloc_3);
default:
return Instruction.Create(OpCodes.Stloc, local);
}
}
public static Instruction Ldloc(Local local)
{
switch (local.Index)
{
case 0:
return Instruction.Create(OpCodes.Ldloc_0);
case 1:
return Instruction.Create(OpCodes.Ldloc_1);
case 2:
return Instruction.Create(OpCodes.Ldloc_2);
case 3:
return Instruction.Create(OpCodes.Ldloc_3);
default:
return Instruction.Create(OpCodes.Ldloc, local);
}
}
public static TypeSig RandomSig(MethodDef method)
{
switch (ControlFlowObfuscation.rnd.Next(0, 3))
{
case 0:
return (TypeSig) method.Module.CorLibTypes.Int32;
case 1:
return (TypeSig) method.Module.CorLibTypes.Int64;
case 2:
return (TypeSig) method.Module.CorLibTypes.Double;
default:
return (TypeSig) method.Module.CorLibTypes.Int32;
}
}
public static void ExecuteMethod(MethodDef method)
{
method.Body.SimplifyMacros((IList<Parameter>) method.Parameters);
List<Block> blocks = BlockParser.ParseMethod(method);
int num1 = ControlFlowObfuscation.rnd.Next(1, 10);
int num2 = 0;
foreach (Block block in blocks)
{
block.SubRand = num1;
num1 = ControlFlowObfuscation.rnd.Next(num1 + 1, num1 + 10);
block.PlusRand = num1;
if (blocks.Count - 2 == block.Number)
num2 = num1;
}
blocks = ControlFlowObfuscation.Randomize(blocks);
method.Body.Instructions.Clear();
Local local = new Local(ControlFlowObfuscation.RandomSig(method));
method.Body.Variables.Add(local);
local.Name = RenamerPhase.GenerateString(RenamerPhase.RenameMode.Ascii);
Instruction target1 = Instruction.Create(OpCodes.Nop);
Instruction target2 = Instruction.Create(OpCodes.Br, target1);
int num3 = ControlFlowObfuscation.rnd.Next(0, 10000);
foreach (Instruction instruction in ControlFlowObfuscation.Calc(num3, local.Type))
method.Body.Instructions.Add(instruction);
method.Body.Instructions.Add(ControlFlowObfuscation.StLoc(local));
method.Body.Instructions.Add(Instruction.Create(OpCodes.Br, target2));
method.Body.Instructions.Add(target1);
foreach (Block block in blocks.Where<Block>((Func<Block, bool>) (block => block != blocks.Single<Block>((Func<Block, bool>) (x => x.Number == blocks.Count - 1)))))
{
method.Body.Instructions.Add(ControlFlowObfuscation.Ldloc(local));
if (block.Number == 0)
{
foreach (Instruction instruction in ControlFlowObfuscation.Calc(num3, local.Type))
method.Body.Instructions.Add(instruction);
}
else
{
foreach (Instruction instruction in ControlFlowObfuscation.Calc(block.SubRand + num3, local.Type))
method.Body.Instructions.Add(instruction);
}
method.Body.Instructions.Add(Instruction.Create(OpCodes.Ceq));
Instruction target3 = Instruction.Create(OpCodes.Nop);
method.Body.Instructions.Add(Instruction.Create(OpCodes.Brfalse, target3));
foreach (Instruction instruction in block.Instructions)
method.Body.Instructions.Add(instruction);
foreach (Instruction instruction in ControlFlowObfuscation.Calc(block.PlusRand + num3, local.Type))
method.Body.Instructions.Add(instruction);
method.Body.Instructions.Add(ControlFlowObfuscation.StLoc(local));
method.Body.Instructions.Add(target3);
}
method.Body.Instructions.Add(ControlFlowObfuscation.Ldloc(local));
foreach (Instruction instruction in ControlFlowObfuscation.Calc(num2 + num3, local.Type))
method.Body.Instructions.Add(instruction);
method.Body.Instructions.Add(Instruction.Create(OpCodes.Ceq));
method.Body.Instructions.Add(Instruction.Create(OpCodes.Brfalse, target2));
method.Body.Instructions.Add(Instruction.Create(OpCodes.Br, blocks.Single<Block>((Func<Block, bool>) (x => x.Number == blocks.Count - 1)).Instructions[0]));
method.Body.Instructions.Add(target2);
foreach (Instruction instruction in blocks.Single<Block>((Func<Block, bool>) (x => x.Number == blocks.Count - 1)).Instructions)
method.Body.Instructions.Add(instruction);
method.Body.InitLocals = true;
}
public static List<Block> Randomize(List<Block> input)
{
List<Block> blockList = new List<Block>();
foreach (Block block in input)
blockList.Insert(ControlFlowObfuscation.rnd.Next(0, blockList.Count), block);
return blockList;
}
public static List<Instruction> Calc(int value, TypeSig sig)
{
List<Instruction> instructionList;
if (sig == sig.Module.CorLibTypes.Double)
instructionList = new List<Instruction>()
{
Instruction.Create(OpCodes.Ldc_R8, (double) value)
};
else
instructionList = new List<Instruction>()
{
Instruction.Create(OpCodes.Ldc_I4, value)
};
return instructionList;
}
public void AddJump(IList<Instruction> instrs, Instruction target)
{
instrs.Add(Instruction.Create(OpCodes.Br, target));
}
}
}
Server/MindLated/Protection/CtrlFlow/JumpCFlow.cs
+37
View File
@@ -0,0 +1,37 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.CtrlFlow.JumpCFlow
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Renamer;
using System.Collections.Generic;
using System.Linq;
//#nullable disable
namespace MindLated.Protection.CtrlFlow {
public static class JumpCFlow
{
public static void Execute(ModuleDefMD module)
{
foreach (TypeDef type in (IEnumerable<TypeDef>) module.Types)
{
foreach (MethodDef methodDef in type.Methods.ToArray<MethodDef>())
{
if (methodDef.HasBody && methodDef.Body.HasInstructions && !methodDef.Body.HasExceptionHandlers)
{
for (int index = 0; index < methodDef.Body.Instructions.Count - 2; index = index + 2 + 1)
{
Instruction instruction = methodDef.Body.Instructions[index + 1];
methodDef.Body.Instructions.Insert(index + 1, Instruction.Create(OpCodes.Ldstr, RenamerPhase.GenerateString(RenamerPhase.RenameMode.Ascii)));
methodDef.Body.Instructions.Insert(index + 1, Instruction.Create(OpCodes.Br_S, instruction));
}
}
}
}
}
}
}