Friday, May 28, 2010

Net Orbiter, cross dll obfuscating added

I took some time to add cross dll obfuscating. It was pretty easy (but I thought it will be easier). One core change is needed, and all others are just configuration changes. Much easier than when I use native TypeBuilder.

Now I need to make the interface a bit better, the current one is really hard to use even for me.

Wednesday, May 26, 2010

New obfuscator almost working now

Yep, after I developed my last obfuscator, which uses .Net's emit functionality, I decided to create a new one, parsing and constructing the .net assemblies myself.

The reason is simple. The emit functions has 2 drawbacks. First, there is no way to specify a catch or finally block is tiny or fat, and no way to let them not generate a leave command automatically. That increase the code size dramatically. Second, it automatically adds the framework reference in the assembly, so if it is a silverlight assembly, it will became a .net assembly, and requires a extra ildasm/ilasm to fix it.

The parsing was easy, obfuscating is much easier too, the reconstructing of the .net assembly is HARD!! I have to spend all my free time (which is tinny, often less than an hour a day) on it, and two days early I thought I got it, till I encounter a big file and the obfucsator was able to shrink it a lot. It just won't load. Turned out there are many small places where ECMA335 didn't specify, and I had to try it out.

Now all that is left is polish.... Which will be slow and boring.

Wednesday, May 19, 2010

Finally reconstructed a .net assembly

Yep, I was toying with ECMA335 recently and parse a .net assembly was easy. The re-construct of a .net assembly from the parts was hard, as you have to keep coming back to update the different RVAs. After that, I keep running to "Invalid IL format" problems, and turned out they are the alignments.

Last night I got it working, I was able to reconstruct my reconstruct program and use the reconstructed program again. That was with 3.5 framework. When I use the 4.0 framework, I got a strange "Divided by 0" exception, even though I can de-assembly using ildasm, so it is not a total success.