search

0xb11a1 / yetAnotherObfuscator

C# obfuscator that bypass windows defender
690 stars 112 forks source link

Seatbelt unable to properly resolve type 'Seatbelt.Commands.LolbasCommand+LolbasDTO' #8

Open picheljitsu opened 1 year ago

picheljitsu commented 1 year ago

Tested w/ SeatBelt. Just did a basic clone of this project and SeatBelt, compiled both, then copied SeatBelt.exe into the directory. Output is below. Looks to fail when attempting to resolve 'Seatbelt.Commands.LolbasCommand'. 

PS C:\Dev\C#\yetAnotherObfuscator\yetAnotherObfuscator\bin\Debug> ls

    Directory: C:\Dev\C#\yetAnotherObfuscator\yetAnotherObfuscator\bin\Debug

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----          6/6/2023  12:18 PM                app.publish
-a----        11/19/2022   7:46 AM        1167872 dnlib.dll
-a----        11/19/2022   7:46 AM        1854717 dnlib.xml
-a----         4/12/2023   6:25 PM         697856 Seatbelt.exe
-a----          6/6/2023  12:18 PM           1884 yetAnotherObfuscator.application
-a----          6/6/2023  12:18 PM          12288 yetAnotherObfuscator.exe
-a----          6/6/2023  12:17 PM            272 yetAnotherObfuscator.exe.config
-a----          6/6/2023  12:18 PM           5302 yetAnotherObfuscator.exe.manifest
-a----          6/6/2023  12:18 PM          34304 yetAnotherObfuscator.pdb

PS C:\Dev\C#\yetAnotherObfuscator\yetAnotherObfuscator\bin\Debug> $(ls .\Seatbelt.exe).fullname
C:\Dev\C#\yetAnotherObfuscator\yetAnotherObfuscator\bin\Debug\Seatbelt.exe
PS C:\Dev\C#\yetAnotherObfuscator\yetAnotherObfuscator\bin\Debug>
PS C:\Dev\C#\yetAnotherObfuscator\yetAnotherObfuscator\bin\Debug>
PS C:\Dev\C#\yetAnotherObfuscator\yetAnotherObfuscator\bin\Debug> .\yetAnotherObfuscator.exe        
  __    __  ______  _____
 /\ \  /\ \/\  _  \/\  __`\
 \ `\`\\/'/\ \ \L\ \ \ \/\ \
  `\ `\ /'  \ \  __ \ \ \ \ \
    `\ \ \   \ \ \/\ \ \ \_\ \
      \ \_\   \ \_\ \_\ \_____\
       \/_/    \/_/\/_/\/_____/
Enter exe path: C:\Dev\C#\yetAnotherObfuscator\yetAnotherObfuscator\bin\Debug\Seatbelt.exe
[+] Working on: C:\Dev\C#\yetAnotherObfuscator\yetAnotherObfuscator\bin\Debug\Seatbelt.exe
[+] Injecting the decryption method
[+] Encrypting all strings with encryption key: uvRT5AELd8uSvpZm6prD5NtWRqYKwnlGr2cLcCCaIc
[+] Changing classes names
[+] Saving the obfuscated file
[+] Changing exe GUID if it exists
[+] All done, the obfuscated exe in: C:\Dev\C#\yetAnotherObfuscator\yetAnotherObfuscator\bin\Debug\Seatbelt.exe._obf.exe

PS C:\Dev\C#\yetAnotherObfuscator\yetAnotherObfuscator\bin\Debug> .\Seatbelt.exe._obf.exe
Unhandled terminating exception: System.TypeLoadException: Could not load type 'Seatbelt.Commands.LolbasCommand+LolbasDTO' from assembly 'Seatbelt, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null'.
   at System.Reflection.CustomAttribute._CreateCaObject(RuntimeModule pModule, IRuntimeMethodInfo pCtor, Byte** ppBlob, Byte* pEndBlob, Int32* pcNamedArgs)
   at System.Reflection.CustomAttribute.CreateCaObject(RuntimeModule module, IRuntimeMethodInfo ctor, IntPtr& blob, IntPtr blobEnd, Int32& namedArgs)
   at System.Reflection.CustomAttribute.GetCustomAttributes(RuntimeModule decoratedModule, Int32 decoratedMetadataToken, Int32 pcaCount, RuntimeType attributeFilterType, Boolean mustBeInheritable, IList derivedAttributes, Boolean isDecoratedTargetSecurityTransparent)
   at System.Reflection.CustomAttribute.GetCustomAttributes(RuntimeType type, RuntimeType caType, Boolean inherit)
   at System.Attribute.GetCustomAttributes(MemberInfo element, Boolean inherit)
   at Seatbelt.Output.Sinks.VGV4dE91dHB1dFNpbmtB.InitializeCustomTextFormatters()
   at Seatbelt.Output.Sinks.VGV4dE91dHB1dFNpbmtB..ctor(SVRleHRXcml0ZXJB writer, Boolean filterResults)
   at Seatbelt.U2VhdGJlbHRB.OutputSinkFromArgs(String outputFileArg)
   at Seatbelt.U2VhdGJlbHRB..ctor(String[] args)
   at Seatbelt.UHJvZ3JhbUFB.Main(String[] args)
Veids commented 1 year ago

I was playing with debugger and it looks like one of the Method custom attributes still points to the old Method/Namespace


Out[121]: 'System.Type'

In [122]: custom = t.CustomAttributes[1]

In [123]: custom.ConstructorArguments[0].Type.ToString()
Out[123]: 'System.Type'

In [124]: custom.ConstructorArguments[0].Value.ToString()
Out[124]: 'Seatbelt.Commands.LolbasCommand/LolbasDTO'

In [125]: t.Name.ToString()
Out[125]: 'LolbasFormatter'