ConfuserEx InjectHelper注入依赖项DLL文件

时间:2019-05-28 12:05:02

标签: c# confuserex dnlib

我正在使用ConfuserEx's InjectHelper类,问题在于它向Anti Tamper类注入了依赖项(引用了我的DLL文件)。

enter image description here

enter image description here

在上面的图片中,我正在注入Anti Tampering的Normal类,您可以看到Mutation.KeyI1RuntimeHelper.VirtualProtect是从我的Core.dll引用的。

在下面,您可以看到ConfuserEx实际输出文件的外观。它取代了Mutation类依赖关系和RuntimeHelper.VirtualProtect依赖关系。

enter image description here

有趣的是,我的代码在Initialize函数上方声明了VirtualProtect PInvoke,并且它仍引用RuntimeHelper。

另一个有趣的事实是,当我从Mutation类中删除名称空间时,依赖项引用消失了,但是VirtualProtect的依赖项仍然存在。有办法解决吗?我的代码与ConfuserEx的代码之间没有任何区别-这是ConfuserEx的代码的link

Mutation.cs

namespace Core.Protections.AntiTamper
{
    internal static class Mutation
    {
        public static readonly int KeyI0 = 0;
        public static readonly int KeyI1 = 1;
        public static readonly int KeyI2 = 2;
        public static readonly int KeyI3 = 3;
        public static readonly int KeyI4 = 4;
        public static readonly int KeyI5 = 5;
        public static readonly int KeyI6 = 6;
        public static readonly int KeyI7 = 7;
        public static readonly int KeyI8 = 8;
        public static readonly int KeyI9 = 9;
        public static readonly int KeyI10 = 10;
        public static readonly int KeyI11 = 11;
        public static readonly int KeyI12 = 12;
        public static readonly int KeyI13 = 13;
        public static readonly int KeyI14 = 14;
        public static readonly int KeyI15 = 15;

        public static void Crypt(uint[] data, uint[] key)
        {
        }
    }
}

RuntimeHelper.cs

using System;
using System.Reflection;
using System.Runtime.InteropServices;

namespace Core.Protections.AntiTamper
{
    internal static class RuntimeHelper
    {
        [DllImport("kernel32.dll", SetLastError = true)]
        private static extern bool VirtualProtect(IntPtr lpAddress, uint dwSize, uint flNewProtect, out uint lpflOldProtect);

        private static unsafe void Initialize()
        {
            Module m = typeof(RuntimeHelper).Module;
            string n = m.FullyQualifiedName;
            bool f = n.Length > 0 && n[0] == '<';
            var b = (byte*)Marshal.GetHINSTANCE(m);
            byte* p = b + *(uint*)(b + 0x3c);
            ushort s = *(ushort*)(p + 0x6);
            ushort o = *(ushort*)(p + 0x14);

            uint* e = null;
            uint l = 0;
            var r = (uint*)(p + 0x18 + o);
            uint z = (uint)Mutation.KeyI1, x = (uint)Mutation.KeyI2, c = (uint)Mutation.KeyI3, v = (uint)Mutation.KeyI4;
            for (int i = 0; i < s; i++)
            {
                uint g = (*r++) * (*r++);
                if (g == (uint)Mutation.KeyI0)
                {
                    e = (uint*)(b + (f ? *(r + 3) : *(r + 1)));
                    l = (f ? *(r + 2) : *(r + 0)) >> 2;
                }
                else if (g != 0)
                {
                    var q = (uint*)(b + (f ? *(r + 3) : *(r + 1)));
                    uint j = *(r + 2) >> 2;
                    for (uint k = 0; k < j; k++)
                    {
                        uint t = (z ^ (*q++)) + x + c * v;
                        z = x;
                        x = c;
                        x = v;
                        v = t;
                    }
                }
                r += 8;
            }

            uint[] y = new uint[0x10], d = new uint[0x10];
            for (int i = 0; i < 0x10; i++)
            {
                y[i] = v;
                d[i] = x;
                z = (x >> 5) | (x << 27);
                x = (c >> 3) | (c << 29);
                c = (v >> 7) | (v << 25);
                v = (z >> 11) | (z << 21);
            }

            Mutation.Crypt(y, d);

            uint w = 0x40;
            VirtualProtect((IntPtr)e, l << 2, w, out w);

            if (w == 0x40)
                return;

            uint h = 0;
            for (uint i = 0; i < l; i++)
            {
                *e ^= y[h & 0xf];
                y[h & 0xf] = (y[h & 0xf] ^ (*e++)) + 0x3dbb2819;
                h++;
            }
        }
    }
}

我的注射代码

    ModuleDefMD module = ModuleDefMD.Load(typeof(RuntimeHelper).Module);
    TypeDef type = module.ResolveTypeDef(MDToken.ToRID(typeof(RuntimeHelper).MetadataToken));
    IEnumerable<IDnlibDef> members = InjectHelper.Inject(type, manifestModule.GlobalType, manifestModule);

0 个答案:

没有答案
相关问题