sunnamed434 / BitMono

Obfuscator for .NET and Mono, with a customizable engine for building your own obfuscators.
https://bitmono.readthedocs.io/en/latest/
MIT License
354 stars 29 forks source link

Only BitTimeDateStamp, ObjectReturnType protection levels are working without any error for C# exe #117

Closed techei closed 1 year ago

techei commented 1 year ago

Description

Application I am trying to obfuscate is a complex one & it responsible to encrypt all files in configured directory. It is a C# exe so I can't use obfuscation protections compatible with Mono. I tried to use following protections but it makes dll unusable.

Only 2 protection configurations are usable for my use case, sharing my experiment results, let me know if I am missing something.

Protections which we planned to use : AntiDebugBreakpoints, BitTimeDateStamp, FullRenamer, StringsEncryption, AntiILdasm, AntiDe4Dot, BitMethodDotnet

Obfuscation Protections we are not using:

AntiDebugBreakpoints: not stable

FullRenamer: not stable

DotNetHook: MemberNotImportedException exception in-> some dll(s) refer logs attached

CallToCalli: MemberNotImportedException exception in-> MyApplication.dll, MyApplicationographer.dll, MyApplication.exe

NoNamespaces: run time error in event viewer Application: MyApplication.exe CoreCLR Version: 5.0.921.35908 .NET Version: 5.0.9 Description: The process was terminated due to an unhandled exception. Exception Info: System.TypeInitializationException: The type initializer for 'Program' threw an exception. ---> System.ArgumentNullException: Value cannot be null. (Parameter 'provider') at System.ThrowHelper.Throw(String paramName) at System.ThrowHelper.ThrowIfNull(Object argument, String paramName) at Microsoft.Extensions.DependencyInjection.ServiceProviderServiceExtensions.GetService[T](IServiceProvider provider) at Program..cctor() in D:\MyApplication\Program.cs:line 56 --- End of inner exception stack trace --- at Program.Main(String[] args) in D:\MyApplication\Program.cs:line 97

Faulting application name: MyApplication.exe, version: 0.0.0.0, time stamp: 0x60e896d9
Faulting module name: KERNELBASE.dll, version: 10.0.19041.2546, time stamp: 0xe8e9ac9b
Exception code: 0xe0434352
Fault offset: 0x000000000002cd29
Faulting process id: 0x908
Faulting application start time: 0x01d967c11f819eab
Faulting application path: D:\MyApplication.exe
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
Report Id: 7a39c635-d39e-4c74-ba82-a8d840558c4b
Faulting package full name: 
Faulting package-relative application ID: 

AntiDe4Dot: run time error in event viewer Application: MyApplication.exe Framework Version: v4.0.30319 Description: The process was terminated due to an unhandled exception. Exception Info: System.Runtime.InteropServices.MarshalDirectiveException at MyApplication.Program.SetProcessDPIAware() at MyApplication.Program.Main()

Faulting application name: MyApplication.exe, version: 1.4.10000.0, time stamp: 0x00000000
Faulting module name: KERNELBASE.dll, version: 10.0.19041.2546, time stamp: 0xe8e9ac9b
Exception code: 0xe0434352
Fault offset: 0x000000000002cd29
Faulting process id: 0x8114
Faulting application start time: 0x01d967c8132ce27e
Faulting application path: D:\MyApplication.exe
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
Report Id: 34b66f8e-bf0e-4e69-9625-de325ab8cd80
Faulting package full name: 
Faulting package-relative application ID: 

AntiILdasm: run time error in event viewer: Application: MyApplication.exe Framework Version: v4.0.30319 Description: The process was terminated due to an unhandled exception. Exception Info: System.Runtime.InteropServices.MarshalDirectiveException at MyApplication.Program.SetProcessDPIAware() at MyApplication.Program.Main()

Faulting application name: MyApplication.exe, version: 1.4.10000.0, time stamp: 0x00000000
Faulting module name: KERNELBASE.dll, version: 10.0.19041.2546, time stamp: 0xe8e9ac9b
Exception code: 0xe0434352
Fault offset: 0x000000000002cd29
Faulting process id: 0x8a8c
Faulting application start time: 0x01d967c8676b4d8b
Faulting application path: D:\MyApplication.exe
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
Report Id: 591626c3-2a46-40a9-889b-9f4450b65ab4
Faulting package full name: 
Faulting package-relative application ID: 

BitMethodDotnet: run time error in event viewer

StringsEncryption: Protection encrypts strings using basic AES encryption, but not everyone like it because it makes the worse performance of application.

BitDotnet: Only compatible with Mono. Dnlib exploit & modifies the file metadata (PE) Unrecognizable for dnSpy

BitMono: Only compatible with Mono. Modifies th file metadata (PE) Unrecognizable for Detect It Easy.

AntiDecompiler: Only compatible with Mono. Sets non-public accessibility attributes according to ECMA(European Computer Manufactures Association) CIL(Common Intermediate Language) standard Old dnSpy will crash decompiling, latest version won't crash.

Only following protection levels can be used: BitTimeDateStamp, ObjectReturnType

techei commented 1 year ago

How this issue is invalid @sunnamed434 ?

sunnamed434 commented 1 year ago

How this issue is invalid @sunnamed434 ?

Oh, its kinda I meant that not issue is invalid but specifically the problem that's happened is invalid, perhaps I would selected wrong issue tag

sunnamed434 commented 1 year ago

So, most of the protection didn't work because of the wrong assembly resolve, soon will pre-release a new version, which should resolve the problem

sunnamed434 commented 1 year ago

Forgot to send the message about that also, so, the problem should be fixed now, see

sunnamed434 commented 1 year ago

Closing it due to inactive, for me problem is solved, I used different files and its fine! Feel free to reopen this