XenocodeRCE / neo-ConfuserEx

Updated ConfuserEX, an open-source, free obfuscator for .NET applications
http://yck1509.github.io/ConfuserEx/
Other
746 stars 89 forks source link

Obfuscated property works differently #24

Closed lcsondes closed 5 years ago

lcsondes commented 5 years ago

Describe the bug I have a property that looks like string MyProperty => (A && !B) ? "string A" : "string B";. After obfuscation it is always returning null.

To Reproduce I have tried to produce a minimal example, but it seems that this is specific to our particular project. If I do this in a test class it works.

Here's my config:

Configuration file

```xml ```


Expected behavior The property to behave the same way as it is unobfuscated.

Screenshots N/A

File (optional) N/A

Additional context If I add Trace.WriteLine methods to the property getter, the problem goes away, as well as using ObfuscationAttribute on it to exclude it from obfuscation. I'm happy to help with debugging this but I've spent 2 days so far on this not really knowing where to even look really. The decompiled method looks like it's a funky switch that jumps around and eventually calls <Module>.something<string>(number) with two different numbers, so it vaguely looks like my original code. I didn't prove this due to the extreme difficulty in debugging (even with anti debug off and looking at the x64 disassembly, so in a way ConfuserEx works great :) ) but the only plausible explanation for me seems that these decryptor(?) methods are the ones returning null.

lcsondes commented 5 years ago

The problem persists if the only obfuscation I apply is

  <rule preset="none" pattern="true">
    <protection id="constants">
      <argument name="elements" value="S" />
    </protection>
  </rule>

The ldstr instruction is replaced by ldc.i4, a br.s to the next instruction, and a call to the decryptor method.

Changing the property to something like

var x = ternary_expression_from_above;
if(x == null)
  Debugger.Break();
return x;

Also makes the problem go away.

XenocodeRCE commented 5 years ago

Ternary operator are not handled, and without further exemple for me to test on (your app) i cannot fix.