search

XenocodeRCE / neo-ConfuserEx

Updated ConfuserEX, an open-source, free obfuscator for .NET applications
http://yck1509.github.io/ConfuserEx/
Other
756 stars 89 forks source link

Can someone explain what AntiMode does in AntiTamper #52

Open rollsch opened 5 years ago

rollsch commented 5 years ago

Can someone explain what the "anti" mode in anti tamper protection does? The documentation only describes the NormalMode and JITMode, Anti mode appears to be new and only available in neo-confuserex.

Is this meant to be hidden?

The reason I ask is all 3 modes of anti-tamper cause my executable to crash with no exception. If I debug it using dnspy and break at the entry point (or create process) I get "Exception ???" and no more information.

I will try building with debug symbols to see if I can get any more information where and why it is crashing.

rollsch commented 5 years ago

Also I realise these protections are easily removed but any extra step increases the time required to de-obfuscate a program.

XenocodeRCE commented 5 years ago

Hello

just read the code and compare it to original.

It adds extra debugger checks, hence why the "anti" for "antidebug".

It's old code from 15 Jul 2018 however, and the project is meant to be modified, not used as it.