// Decompiled with JetBrains decompiler // Type: MindLated.Protection.CtrlFlow.ControlFlowObfuscation // Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null // MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA // Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe using dnlib.DotNet; using dnlib.DotNet.Emit; using MindLated.Protection.Renamer; using System; using System.Windows.Forms; using System.Collections.Generic; using System.Linq; //#nullable disable namespace MindLated.Protection.CtrlFlow { internal class ControlFlowObfuscation { public static Random rnd = new Random(); public static void Execute(ModuleDefMD md) { foreach (TypeDef type in (IEnumerable) md.Types) { if (type != md.GlobalType) { foreach (MethodDef method in (IEnumerable) type.Methods) { if (!method.Name.StartsWith("get_") && !method.Name.StartsWith("set_") && method.HasBody && !method.IsConstructor) { method.Body.SimplifyBranches(); ControlFlowObfuscation.ExecuteMethod(method); } } } } } public static Instruction StLoc(Local local) { switch (local.Index) { case 0: return Instruction.Create(OpCodes.Stloc_0); case 1: return Instruction.Create(OpCodes.Stloc_1); case 2: return Instruction.Create(OpCodes.Stloc_2); case 3: return Instruction.Create(OpCodes.Stloc_3); default: return Instruction.Create(OpCodes.Stloc, local); } } public static Instruction Ldloc(Local local) { switch (local.Index) { case 0: return Instruction.Create(OpCodes.Ldloc_0); case 1: return Instruction.Create(OpCodes.Ldloc_1); case 2: return Instruction.Create(OpCodes.Ldloc_2); case 3: return Instruction.Create(OpCodes.Ldloc_3); default: return Instruction.Create(OpCodes.Ldloc, local); } } public static TypeSig RandomSig(MethodDef method) { switch (ControlFlowObfuscation.rnd.Next(0, 3)) { case 0: return (TypeSig) method.Module.CorLibTypes.Int32; case 1: return (TypeSig) method.Module.CorLibTypes.Int64; case 2: return (TypeSig) method.Module.CorLibTypes.Double; default: return (TypeSig) method.Module.CorLibTypes.Int32; } } public static void ExecuteMethod(MethodDef method) { method.Body.SimplifyMacros((IList) method.Parameters); List blocks = BlockParser.ParseMethod(method); int num1 = ControlFlowObfuscation.rnd.Next(1, 10); int num2 = 0; foreach (Block block in blocks) { block.SubRand = num1; num1 = ControlFlowObfuscation.rnd.Next(num1 + 1, num1 + 10); block.PlusRand = num1; if (blocks.Count - 2 == block.Number) num2 = num1; } blocks = ControlFlowObfuscation.Randomize(blocks); method.Body.Instructions.Clear(); Local local = new Local(ControlFlowObfuscation.RandomSig(method)); method.Body.Variables.Add(local); local.Name = RenamerPhase.GenerateString(RenamerPhase.RenameMode.Ascii); Instruction target1 = Instruction.Create(OpCodes.Nop); Instruction target2 = Instruction.Create(OpCodes.Br, target1); int num3 = ControlFlowObfuscation.rnd.Next(0, 10000); foreach (Instruction instruction in ControlFlowObfuscation.Calc(num3, local.Type)) method.Body.Instructions.Add(instruction); method.Body.Instructions.Add(ControlFlowObfuscation.StLoc(local)); method.Body.Instructions.Add(Instruction.Create(OpCodes.Br, target2)); method.Body.Instructions.Add(target1); foreach (Block block in blocks.Where((Func) (block => block != blocks.Single((Func) (x => x.Number == blocks.Count - 1))))) { method.Body.Instructions.Add(ControlFlowObfuscation.Ldloc(local)); if (block.Number == 0) { foreach (Instruction instruction in ControlFlowObfuscation.Calc(num3, local.Type)) method.Body.Instructions.Add(instruction); } else { foreach (Instruction instruction in ControlFlowObfuscation.Calc(block.SubRand + num3, local.Type)) method.Body.Instructions.Add(instruction); } method.Body.Instructions.Add(Instruction.Create(OpCodes.Ceq)); Instruction target3 = Instruction.Create(OpCodes.Nop); method.Body.Instructions.Add(Instruction.Create(OpCodes.Brfalse, target3)); foreach (Instruction instruction in block.Instructions) method.Body.Instructions.Add(instruction); foreach (Instruction instruction in ControlFlowObfuscation.Calc(block.PlusRand + num3, local.Type)) method.Body.Instructions.Add(instruction); method.Body.Instructions.Add(ControlFlowObfuscation.StLoc(local)); method.Body.Instructions.Add(target3); } method.Body.Instructions.Add(ControlFlowObfuscation.Ldloc(local)); foreach (Instruction instruction in ControlFlowObfuscation.Calc(num2 + num3, local.Type)) method.Body.Instructions.Add(instruction); method.Body.Instructions.Add(Instruction.Create(OpCodes.Ceq)); method.Body.Instructions.Add(Instruction.Create(OpCodes.Brfalse, target2)); method.Body.Instructions.Add(Instruction.Create(OpCodes.Br, blocks.Single((Func) (x => x.Number == blocks.Count - 1)).Instructions[0])); method.Body.Instructions.Add(target2); foreach (Instruction instruction in blocks.Single((Func) (x => x.Number == blocks.Count - 1)).Instructions) method.Body.Instructions.Add(instruction); method.Body.InitLocals = true; } public static List Randomize(List input) { List blockList = new List(); foreach (Block block in input) blockList.Insert(ControlFlowObfuscation.rnd.Next(0, blockList.Count), block); return blockList; } public static List Calc(int value, TypeSig sig) { List instructionList; if (sig == sig.Module.CorLibTypes.Double) instructionList = new List() { Instruction.Create(OpCodes.Ldc_R8, (double) value) }; else instructionList = new List() { Instruction.Create(OpCodes.Ldc_I4, value) }; return instructionList; } public void AddJump(IList instrs, Instruction target) { instrs.Add(Instruction.Create(OpCodes.Br, target)); } } }