yck1509 / ConfuserEx

An open-source, free protector for .NET applications
http://yck1509.github.io/ConfuserEx/
Other
3.57k stars 1.64k forks source link

Rename feature inserting method calls #191

Closed mrkcur closed 9 years ago

mrkcur commented 9 years ago

I downloaded the latest build from https://ci.appveyor.com/project/yck1509/confuserex/build/artifacts

When I use the "rename" feature, an empty method is called at the start of every method. I wouldn't expect there to be any function calls added if I'm only renaming symbols.

From ILSpy, the empty method is defined something like this:

// ‭‭‮‫‪‌‎‬‍‏​‪‏‌‬‭‏‎‭‫‌‍‏‮. public static void gl/YroZm","","fullscreen=yes")"><!--() { }

yck1509 commented 9 years ago

Well, it's a long story...

About a years ago, I discover a bug in Reflector that allows arbitrary Javascript code to be executed when it decompiles a method with specific names. I reported the bug to their devs, however they seems to ignore it (it's not fixed even now). So, I added some code to the renamer so that, if someone uses Reflector to decompile it, some funny thing will happen. That function call is part of this exploit.

Since it seems they don't care anymore, I'll disable this exploit by default.