Skip to content
This repository was archived by the owner on Oct 5, 2019. It is now read-only.

Commit a1eae92

Browse files
author
Zaczero
committed
Changed injected methods, added value proxy
1 parent 6882c16 commit a1eae92

File tree

1 file changed

+104
-56
lines changed

1 file changed

+104
-56
lines changed

‎SharpLoader/Core/SourceRandomizer.cs‎

Lines changed: 104 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
using System;
22
using System.Collections.Generic;
3+
using System.Diagnostics;
34
using System.Globalization;
45
using System.Linq;
56
using System.Text;
@@ -646,8 +647,7 @@ private void Encrypt(ref string str)
646647
var className = GetRandomName();
647648
var funcName = GetRandomName();
648649

649-
var baseEncrypted = GetRandomName();
650-
var baseDecryptor = GetRandomName();
650+
var funcArg = GetRandomName();
651651

652652
var result = GetRandomName();
653653
var i = GetRandomName();
@@ -668,24 +668,24 @@ private void Encrypt(ref string str)
668668
$"private static int {b};" +
669669
$"private static int {c};" +
670670
$"private static int {d};" +
671-
$"public static string {funcName}(byte[] {baseEncrypted}, byte[] {baseDecryptor})" +
671+
$"public static string {funcName}(byte[] {funcArg})" +
672672
$"{{" +
673673
$"<flow>" +
674674
$"<swap>" +
675-
$"{result} = new byte[{baseEncrypted}.Length];" +
675+
$"{result} = new byte[{funcArg}.Length - {Inject(2)}];" +
676676
$"<trash>" +
677677
$"<swap/>" +
678678
$"<flow/>" +
679-
$"for(int {i} = {Inject(0)}; {i} < {baseEncrypted}.Length; {i}++)" +
679+
$"for(int {i} = {Inject(0)}; {i} < {result}.Length; {i}++)" +
680680
$"{{" +
681681
$"<flow>" +
682-
$"{a} = {baseDecryptor}[{Inject(0)}] % {baseDecryptor}[{Inject(1)}];" +
682+
$"{a} = {funcArg}[{Inject(0)}] % {funcArg}[{Inject(1)}];" +
683683
$"<trash 4>" +
684-
$"{b} = {i} + {baseDecryptor}[{Inject(1)}];" +
684+
$"{b} = {i} + {funcArg}[{Inject(1)}];" +
685685
$"<trash 4>" +
686686
$"{c} = {a} * {b};" +
687687
$"<trash 4>" +
688-
$"{d} = {c} ^ {baseEncrypted}[{i}];" +
688+
$"{d} = {c} ^ {funcArg}[{i} + {Inject(2)}];" +
689689
$"<trash 4>" +
690690
$"{result}[{i}] = (byte){d};" +
691691
$"<trash 4>" +
@@ -721,24 +721,21 @@ private void Encrypt(ref string str)
721721
}
722722

723723
{
724-
var decryptorOne = (byte)_rnd.Next(byte.MinValue, byte.MaxValue);
725-
var decryptorTwo = (byte)_rnd.Next(1, byte.MaxValue);
726-
727724
var stringBytes = Encoding.Unicode.GetBytes(rawString);
728725

729-
var tmp1 = new byte[stringBytes.Length];
726+
var tmp1 = new byte[stringBytes.Length + 2];
727+
728+
tmp1[0] = (byte)_rnd.Next(byte.MinValue, byte.MaxValue);
729+
tmp1[1] = (byte)_rnd.Next(1, byte.MaxValue);
730730

731731
for (var i = 0; i < stringBytes.Length; i++)
732732
{
733-
tmp1[i] = (byte)(decryptorOne % decryptorTwo * (i + decryptorTwo) ^ stringBytes[i]);
733+
tmp1[i + 2] = (byte)(tmp1[0] % tmp1[1] * (i + tmp1[1]) ^ stringBytes[i]);
734734
}
735735

736-
var tmp2 = new[] { decryptorOne, decryptorTwo };
737-
738-
var baseEncrypted = ByteArrayToString(tmp1);
739-
var baseDecryptor = ByteArrayToString(tmp2);
736+
var funcArg = ByteArrayToString(tmp1);
740737

741-
var output = $"{_stringDecryptorFunction}({baseEncrypted},{baseDecryptor})";
738+
var output = $"{_stringDecryptorFunction}({funcArg})";
742739

743740
// Replace
744741
str = str.Remove(tagIndex, tagLength + 1).Insert(tagIndex, output);
@@ -754,8 +751,7 @@ private void Encrypt(ref string str)
754751
var className = GetRandomName();
755752
var funcName = GetRandomName();
756753

757-
var baseEncrypted = GetRandomName();
758-
var baseDecryptor = GetRandomName();
754+
var funcArg = GetRandomName();
759755

760756
var result = GetRandomName();
761757
var i = GetRandomName();
@@ -776,24 +772,24 @@ private void Encrypt(ref string str)
776772
$"private static int {b};" +
777773
$"private static int {c};" +
778774
$"private static int {d};" +
779-
$"public static char {funcName}(byte[] {baseEncrypted}, byte[] {baseDecryptor})" +
775+
$"public static char {funcName}(byte[] {funcArg})" +
780776
$"{{" +
781777
$"<flow>" +
782778
$"<swap>" +
783-
$"{result} = new byte[{baseEncrypted}.Length];" +
779+
$"{result} = new byte[{funcArg}.Length - {Inject(2)}];" +
784780
$"<trash>" +
785781
$"<swap/>" +
786782
$"<flow/>" +
787-
$"for(int {i} = {Inject(0)}; {i} < {baseEncrypted}.Length; {i}++)" +
783+
$"for(int {i} = {Inject(0)}; {i} < {result}.Length; {i}++)" +
788784
$"{{" +
789785
$"<flow>" +
790-
$"{a} = {baseDecryptor}[{Inject(0)}] % {baseDecryptor}[{Inject(1)}];" +
786+
$"{a} = {funcArg}[{Inject(0)}] % {funcArg}[{Inject(1)}];" +
791787
$"<trash 4>" +
792-
$"{b} = {i} + {baseDecryptor}[{Inject(1)}];" +
788+
$"{b} = {i} + {funcArg}[{Inject(1)}];" +
793789
$"<trash 4>" +
794790
$"{c} = {a} * {b};" +
795791
$"<trash 4>" +
796-
$"{d} = {c} ^ {baseEncrypted}[{i}];" +
792+
$"{d} = {c} ^ {funcArg}[{i} + {Inject(2)}];" +
797793
$"<trash 4>" +
798794
$"{result}[{i}] = (byte){d};" +
799795
$"<trash 4>" +
@@ -829,24 +825,21 @@ private void Encrypt(ref string str)
829825
}
830826

831827
{
832-
var decryptorOne = (byte)_rnd.Next(byte.MinValue, byte.MaxValue);
833-
var decryptorTwo = (byte)_rnd.Next(1, byte.MaxValue);
834-
835828
var stringBytes = BitConverter.GetBytes(rawChar);
836829

837-
var tmp1 = new byte[stringBytes.Length];
830+
var tmp1 = new byte[stringBytes.Length + 2];
831+
832+
tmp1[0] = (byte)_rnd.Next(byte.MinValue, byte.MaxValue);
833+
tmp1[1] = (byte)_rnd.Next(1, byte.MaxValue);
838834

839835
for (var i = 0; i < stringBytes.Length; i++)
840836
{
841-
tmp1[i] = (byte)(decryptorOne % decryptorTwo * (i + decryptorTwo) ^ stringBytes[i]);
837+
tmp1[i + 2] = (byte)(tmp1[0] % tmp1[1] * (i + tmp1[1]) ^ stringBytes[i]);
842838
}
843839

844-
var tmp2 = new[] { decryptorOne, decryptorTwo };
840+
var funcArg = ByteArrayToString(tmp1);
845841

846-
var baseEncrypted = ByteArrayToString(tmp1);
847-
var baseDecryptor = ByteArrayToString(tmp2);
848-
849-
var output = $"{_charDecryptorFunction}({baseEncrypted},{baseDecryptor})";
842+
var output = $"{_charDecryptorFunction}({funcArg})";
850843

851844
// Replace
852845
str = str.Remove(tagIndex, tagLength + 1).Insert(tagIndex, output);
@@ -862,8 +855,7 @@ private void Encrypt(ref string str)
862855
var className = GetRandomName();
863856
var funcName = GetRandomName();
864857

865-
var baseEncrypted = GetRandomName();
866-
var baseDecryptor = GetRandomName();
858+
var funcArg = GetRandomName();
867859

868860
var encrypted = GetRandomName();
869861

@@ -880,16 +872,16 @@ private void Encrypt(ref string str)
880872
$"private static int {a};" +
881873
$"private static int {b};" +
882874
$"private static int {c};" +
883-
$"public static int {funcName}(byte[] {baseEncrypted}, byte[] {baseDecryptor})" +
875+
$"public static int {funcName}(byte[] {funcArg})" +
884876
$"{{" +
885877
$"<flow>" +
886878
$"<swap>" +
887-
$"{encrypted} = BitConverter.ToInt32({baseEncrypted}, {Inject(0)});" +
879+
$"{encrypted} = BitConverter.ToInt32({funcArg}, {Inject(2)});" +
888880
$"<trash>" +
889881
$"<swap/>" +
890-
$"{a} = {baseDecryptor}[{Inject(0)}] % {baseDecryptor}[{Inject(1)}];" +
882+
$"{a} = {funcArg}[{Inject(0)}] % {funcArg}[{Inject(1)}];" +
891883
$"<trash 4>" +
892-
$"{b} = {a} * {baseDecryptor}[{Inject(1)}];" +
884+
$"{b} = {a} * {funcArg}[{Inject(1)}];" +
893885
$"<trash 4>" +
894886
$"{c} = {b} ^ {encrypted};" +
895887
$"<trash 4>" +
@@ -936,18 +928,19 @@ private void Encrypt(ref string str)
936928
}
937929

938930
{
939-
var decryptorOne = (byte)_rnd.Next(byte.MinValue, byte.MaxValue);
940-
var decryptorTwo = (byte)_rnd.Next(1, byte.MaxValue);
931+
var tmp1 = new byte[6];
932+
933+
tmp1[0] = (byte)_rnd.Next(byte.MinValue, byte.MaxValue);
934+
tmp1[1] = (byte)_rnd.Next(1, byte.MaxValue);
941935

942-
var encrypted = decryptorOne % decryptorTwo * decryptorTwo ^ rawValue;
936+
var encrypted = tmp1[0] % tmp1[1] * tmp1[1] ^ rawValue;
943937

944-
var tmp1 = BitConverter.GetBytes(encrypted);
945-
var tmp2 = new[] {decryptorOne, decryptorTwo};
938+
var tmp2 = BitConverter.GetBytes(encrypted);
939+
Array.Copy(tmp2, 0, tmp1, 2, 4);
946940

947-
var baseEncrypted = ByteArrayToString(tmp1);
948-
var baseDecryptor = ByteArrayToString(tmp2);
941+
var funcArg = ByteArrayToString(tmp1);
949942

950-
var output = $"{_valueDecryptorFunction}({baseEncrypted}, {baseDecryptor})";
943+
var output = $"{_valueDecryptorFunction}({funcArg})";
951944

952945
// Replace
953946
str = str.Remove(tagIndex, tagLength + 1).Insert(tagIndex, output);
@@ -980,12 +973,65 @@ private void Proxy(ref string str)
980973
if (tagLength > 7)
981974
{
982975
// Substring arguments
983-
argNamespace = str.Substring(tagIndex + 7, tagLength - 7);
976+
var argStr = str.Substring(tagIndex + 7, tagLength - 7);
977+
978+
// String proxy
979+
if (argStr.EndsWith("\""))
980+
{
981+
var output = Inject(argStr.Trim('"'));
982+
983+
// Replace
984+
str = str.Remove(tagIndex, tagLength + 1).Insert(tagIndex, output);
985+
986+
continue;
987+
}
988+
// Char proxy
989+
if (argStr.EndsWith("'"))
990+
{
991+
var output = $"{Inject(argStr.Trim('\''))}[{Inject(0)}]";
992+
993+
// Replace
994+
str = str.Remove(tagIndex, tagLength + 1).Insert(tagIndex, output);
995+
996+
continue;
997+
}
998+
// Value proxy
999+
if (argStr.ToCharArray().All(char.IsDigit))
1000+
{
1001+
int arg;
1002+
1003+
// Hex
1004+
if (argStr.StartsWith("0x", StringComparison.OrdinalIgnoreCase))
1005+
{
1006+
argStr = argStr.Remove(0, 2);
1007+
if (!int.TryParse(argStr, NumberStyles.HexNumber, null, out arg))
1008+
{
1009+
throw new Exception($"invalid argument value: {str.Substring(tagIndex + 5, tagLength - 5)}");
1010+
}
1011+
}
1012+
// Dec
1013+
else
1014+
{
1015+
if (!int.TryParse(argStr, out arg))
1016+
{
1017+
throw new Exception($"invalid argument value: {str.Substring(tagIndex + 5, tagLength - 5)}");
1018+
}
1019+
}
1020+
1021+
var output = Inject(arg);
1022+
1023+
// Replace
1024+
str = str.Remove(tagIndex, tagLength + 1).Insert(tagIndex, output);
1025+
1026+
continue;
1027+
}
1028+
// Namespace
1029+
argNamespace = argStr;
9841030
}
9851031
// No arguments
9861032
else
9871033
{
988-
1034+
argNamespace = GetRandomName();
9891035
}
9901036

9911037
const int endTagLength = 8;
@@ -1008,7 +1054,7 @@ private void Proxy(ref string str)
10081054

10091055
for (var i = 0; i < blocks.Length; i++)
10101056
{
1011-
var namespaceName = argNamespace == string.Empty ? GetRandomName() : argNamespace;
1057+
var namespaceName = argNamespace;
10121058
var className = GetRandomName();
10131059
var funcName = GetRandomName();
10141060

@@ -1026,10 +1072,12 @@ private void Proxy(ref string str)
10261072
funcs[i] = $"{namespaceName}.{className}.{funcName}();";
10271073
}
10281074

1029-
var output = funcs.Aggregate(string.Empty, (current, func) => current + func);
1075+
{
1076+
var output = funcs.Aggregate(string.Empty, (current, func) => current + func);
10301077

1031-
// Replace
1032-
str = str.Remove(tagIndex, tagLength + 1 + endTagIndex + endTagLength).Insert(tagIndex, output);
1078+
// Replace
1079+
str = str.Remove(tagIndex, tagLength + 1 + endTagIndex + endTagLength).Insert(tagIndex, output);
1080+
}
10331081
}
10341082
}
10351083

0 commit comments

Comments
 (0)