fork(6) download 
  1. //css_co /unsafe
  2. //css_ref dnlib.dll
  3. using System;
  4. using dnlib.DotNet;
  5. using dnlib.DotNet.Emit;
  6. using dnlib.DotNet.Writer;
  7. using System.Diagnostics;
  8. using System.Collections.Generic;
  9. using System.Linq;
  10. using System.Reflection;
  11. using System.Windows.Forms;
  12. using System.IO;
  13. using System.Threading;
  14. using System.Runtime.CompilerServices;
  15. using System.Runtime.InteropServices;
  16.  
  17. class Script
  18. {
  19.     public static AssemblyWriter assemblyWriter;
  20.     public static Assembly assembly;
  21.     public static MethodDef currentMethod;
  22.     public static StackFrame[] mainFrames;
  23.     public static List<TypeDef> junkType = new List<TypeDef>();
  24.  
  25.     [STAThread]
  26.     static public void Main(string[] args)
  27.     {
  28.         try
  29.         {
  30.             Console.BackgroundColor = ConsoleColor.White;
  31.             Console.ForegroundColor = ConsoleColor.Black;
  32.             Console.WriteLine("*********************************");
  33.             Console.WriteLine("***                           ***");
  34.             Console.WriteLine("***    ILProtector Unpacker   ***");
  35.             Console.WriteLine("***     Coded By RexProg      ***");
  36.             Console.WriteLine("***                           ***");
  37.             Console.WriteLine("*********************************");
  38.             Console.ForegroundColor = ConsoleColor.Blue;
  39.             Console.WriteLine("[?] Enter Your Program Path : ");
  40.             Console.ForegroundColor = ConsoleColor.Red;
  41.  
  42.             var path = Console.ReadLine();
  43.  
  44.             if (path == string.Empty)
  45.                 return;
  46.             if (path.StartsWith("\"") && path[path.Length - 1] == '"')
  47.                 path = path.Substring(1, path.Length - 2);
  48.  
  49.             if (!File.Exists(path))
  50.             {
  51.                 Console.ForegroundColor = ConsoleColor.Blue;
  52.                 Console.WriteLine("[!] File not found");
  53.                 Console.WriteLine("[!] Press key to exit...");
  54.                 Console.Read();
  55.                 return;
  56.             }
  57.             Console.ForegroundColor = ConsoleColor.DarkRed;
  58.  
  59.             assemblyWriter = new AssemblyWriter(path);
  60.             assembly = Assembly.LoadFrom(path);
  61.             Console.WriteLine("[+] Wait...");
  62.  
  63.             mainFrames = new StackTrace().GetFrames();
  64.  
  65.             Memory.Hook(typeof(StackTrace).GetMethod("CaptureStackTrace", BindingFlags.Instance | BindingFlags.NonPublic), typeof(Script).GetMethod("Hook3", BindingFlags.Instance | BindingFlags.Public));
  66.  
  67.             var types = assemblyWriter.moduleDef.GetTypes();
  68.             var list = (types as IList<TypeDef>) ?? types.ToList<TypeDef>();
  69.  
  70.             var globalType = assemblyWriter.moduleDef.GlobalType;
  71.  
  72.             var fieldMDToken = 0;
  73.  
  74.             foreach (FieldDef fieldDef in globalType.Fields)
  75.             {
  76.                 if (fieldDef.Name == "Invoke")
  77.                     fieldMDToken = fieldDef.MDToken.ToInt32();
  78.             }
  79.             if (fieldMDToken == 0)
  80.                 Console.WriteLine("[!] Couldn't find Invoke");
  81.  
  82.             var fieldValue = assembly.Modules.FirstOrDefault<Module>().ResolveField(fieldMDToken).GetValue(null);
  83.  
  84.             var method = fieldValue.GetType().GetMethod("Invoke");
  85.  
  86.             if (method == null)
  87.                 Console.WriteLine("[!] Couldn't find InvokeMethod");
  88.  
  89.             InvokeDelegates(list, method, fieldValue);
  90.  
  91.             new StringDecrypter(assembly).ReplaceStrings(list);
  92.  
  93.             foreach (var typeDef in junkType)
  94.             {
  95.                 typeDef.DeclaringType.NestedTypes.Remove(typeDef);
  96.             }
  97.  
  98.             MethodDef methodDef = globalType.FindStaticConstructor();
  99.  
  100.             if (methodDef.HasBody)
  101.             {
  102.                 var startIndex = methodDef.Body.Instructions.IndexOf(methodDef.Body.Instructions.FirstOrDefault(inst =>
  103.                 (inst.OpCode == OpCodes.Call
  104.                 && ((IMethod)inst.Operand).Name == "GetIUnknownForObject"))) - 2;
  105.  
  106.                 var endindex = methodDef.Body.Instructions.IndexOf(methodDef.Body.Instructions.FirstOrDefault(inst =>
  107.                 (inst.OpCode == OpCodes.Call
  108.                 && ((IMethod)inst.Operand).Name == "Release"))) + 2;
  109.  
  110.                 methodDef.Body.ExceptionHandlers.Remove(methodDef.Body.ExceptionHandlers.FirstOrDefault(exh => exh.HandlerEnd == methodDef.Body.Instructions[endindex + 1]));
  111.  
  112.                 for (int i = startIndex; i <= endindex; i++)
  113.                     methodDef.Body.Instructions.Remove(methodDef.Body.Instructions[startIndex]);
  114.             }
  115.  
  116.             foreach (var meth in globalType.Methods.Where(met => (met.ImplMap?.Module.Name.ToString() == "Protect32.dll" || met.ImplMap?.Module.Name.ToString() == "Protect64.dll")).ToList())
  117.                 globalType.Remove(meth);
  118.  
  119.             var invokeField = globalType.Fields.FirstOrDefault(fld => fld.Name == "Invoke");
  120.             assemblyWriter.moduleDef.Types.Remove(invokeField.FieldType.ToTypeDefOrRef().ResolveTypeDef());
  121.             globalType.Fields.Remove(invokeField);
  122.  
  123.             assemblyWriter.Save();
  124.             Console.ForegroundColor = ConsoleColor.Blue;
  125.             Console.WriteLine("[!] Program Unpacked");
  126.         }
  127.         catch (Exception ex)
  128.         {
  129.             Console.WriteLine("[!] Exception :\n" + ex.Message);
  130.         }
  131.         Console.WriteLine("[!] Press key to exit...");
  132.         Console.Read();
  133.     }
  134.  
  135.     private static void InvokeDelegates(IList<TypeDef> typeDefs, MethodInfo invokeMethod, object invokeField)
  136.     {
  137.         foreach (TypeDef typeDef in typeDefs)
  138.         {
  139.             foreach (MethodDef methodDef in typeDef.Methods)
  140.             {
  141.                 if (!(methodDef.Module.Name != assembly.ManifestModule.ScopeName) && methodDef.HasBody && methodDef.Body.Instructions.Count > 2 && methodDef.Body.Instructions[0].OpCode == OpCodes.Ldsfld && methodDef.Body.Instructions[0].Operand.ToString().Contains("Invoke") && methodDef.Body.Instructions[1].IsLdcI4())
  142.                 {
  143.                     currentMethod = methodDef;
  144.  
  145.                     var _MDToken = ((IType)methodDef.Body.Instructions[3].Operand).MDToken.ToInt32();
  146.                     junkType.Add(typeDef.NestedTypes.FirstOrDefault(net => net.MDToken.ToInt32() == _MDToken));
  147.                     object method = invokeMethod.Invoke(invokeField, new object[] { (int)methodDef.Body.Instructions[1].Operand });
  148.  
  149.                     try
  150.                     {
  151.                         var dynamicMethodBodyReader = new DynamicMethodBodyReader(assemblyWriter.moduleDef, method);
  152.                         dynamicMethodBodyReader.Read();
  153.                         var method2 = dynamicMethodBodyReader.GetMethod();
  154.                         assemblyWriter.WriteMethod(method2);
  155.                     }
  156.                     catch (Exception ex)
  157.                     {
  158.                         Console.WriteLine("Error in Read(): " + ex.Message + "\nMethod : " + method.ToString());
  159.                     }
  160.                 }
  161.             }
  162.         }
  163.     }
  164.  
  165.     public StackFrame Hook(int num)
  166.     {
  167.         StackFrame[] frames = new StackTrace().GetFrames();
  168.  
  169.         for (int i = 0; i < frames.Length; i++)
  170.         {
  171.             MethodBase method = frames[i].GetMethod();
  172.  
  173.             if (num == 0 && method.ToString().StartsWith("System.Delegate ("))
  174.             {
  175.                 return frames[i];
  176.             }
  177.             if (num == 1 && method.ToString().StartsWith("System.Delegate ("))
  178.             {
  179.                 MethodBase value = assembly.Modules.FirstOrDefault<Module>().ResolveMethod(currentMethod.MDToken.ToInt32());
  180.                 typeof(StackFrame).GetField("method", BindingFlags.Instance | BindingFlags.NonPublic).SetValue(frames[i + 1], value);
  181.                 return frames[i + 1];
  182.             }
  183.         }
  184.         return null;
  185.     }
  186.  
  187.     public void Hook2(MethodBase mb)
  188.     {
  189.         if (mb.Name == "InvokeMethod")
  190.             typeof(StackFrame).GetField("method", BindingFlags.Instance | BindingFlags.NonPublic).SetValue(this, assembly.Modules.FirstOrDefault<Module>().ResolveMethod(currentMethod.MDToken.ToInt32()));
  191.         else
  192.             typeof(StackFrame).GetField("method", BindingFlags.Instance | BindingFlags.NonPublic).SetValue(this, mb);
  193.     }
  194.  
  195.     public void Hook3(int iSkip, bool fNeedFileInfo, Thread targetThread, Exception e)
  196.     {
  197.         ///////////////////////////////////////////////////////////////////////////////////////////////
  198.         //    FrameCount    |                2	                 |               int                 //
  199.         //  METHODS_TO_SKIP |                0	                 |               int                 //
  200.         //      frames      | {System.Diagnostics.StackFrame[6]} |  System.Diagnostics.StackFrame[]  //
  201.         // m_iMethodsToSkip	|                4	                 |               int                 //
  202.         //  m_iNumOfFrames  |                2	                 |               int                 //
  203.         ///////////////////////////////////////////////////////////////////////////////////////////////
  204.         typeof(StackFrame).GetField("method", BindingFlags.Instance | BindingFlags.NonPublic).SetValue(mainFrames.Last(), assembly.Modules.FirstOrDefault<Module>().ResolveMethod(currentMethod.MDToken.ToInt32()));
  205.  
  206.         var mainFramesList = mainFrames.ToList();
  207.  
  208.         for (int i = mainFramesList.Count(); i < 6; i++)
  209.             mainFramesList.Add(mainFrames.Last());
  210.         for (int i = mainFramesList.Count(); i > 6; i--)
  211.             mainFramesList.Remove(mainFramesList.First());
  212.  
  213.         typeof(StackTrace).GetField("frames", BindingFlags.Instance | BindingFlags.NonPublic).SetValue(this, mainFramesList.ToArray());
  214.         typeof(StackTrace).GetField("m_iMethodsToSkip", BindingFlags.Instance | BindingFlags.NonPublic).SetValue(this, 4);
  215.         typeof(StackTrace).GetField("m_iNumOfFrames", BindingFlags.Instance | BindingFlags.NonPublic).SetValue(this, 2);
  216.     }
  217. }
  218.  
  219. internal class StringDecrypter
  220. {
  221.     private readonly Assembly assembly;
  222.     private object _decryptField;
  223.     private MethodInfo decryptMethod;
  224.  
  225.     internal StringDecrypter(Assembly assembly)
  226.     {
  227.         this.assembly = assembly;
  228.     }
  229.  
  230.     internal void ReplaceStrings(IList<TypeDef> typeDefs)
  231.     {
  232.         foreach (TypeDef typeDef in typeDefs)
  233.         {
  234.             foreach (MethodDef methodDef in typeDef.Methods)
  235.             {
  236.                 if (methodDef.HasBody)
  237.                 {
  238.                     IList<Instruction> instructions = methodDef.Body.Instructions;
  239.  
  240.                     for (int i = 0; i < instructions.Count; i++)
  241.                     {
  242.                         Instruction instruction = instructions[i];
  243.  
  244.                         if (instruction.OpCode == OpCodes.Ldsfld && instruction.Operand.ToString().Contains("<Module>::String") && instructions[i + 1].IsLdcI4() && instructions[i + 2].OpCode == OpCodes.Callvirt && instructions[i + 2].Operand.ToString().Contains("Invoke"))
  245.                         {
  246.                             if (this._decryptField == null)
  247.                             {
  248.                                 FieldDef fieldDef = (FieldDef)instruction.Operand;
  249.                                 this.InitDecryptor(fieldDef);
  250.                             }
  251.                             int idx = (int)instructions[i + 1].Operand;
  252.                             instructions[i].OpCode = OpCodes.Ldstr;
  253.                             instructions[i].Operand = this.GetString(idx);
  254.                             instructions[i + 1].OpCode = OpCodes.Nop;
  255.                             instructions[i + 2].OpCode = OpCodes.Nop;
  256.                         }
  257.                     }
  258.                 }
  259.             }
  260.         }
  261.     }
  262.  
  263.     private void InitDecryptor(FieldDef fieldDef)
  264.     {
  265.         FieldInfo fieldInfo = this.assembly.Modules.FirstOrDefault<Module>().ResolveField(fieldDef.MDToken.ToInt32());
  266.         this._decryptField = fieldInfo.GetValue(null);
  267.         this.decryptMethod = this._decryptField.GetType().GetMethod("Invoke");
  268.     }
  269.  
  270.     private string GetString(int idx)
  271.     {
  272.         return (string)this.decryptMethod.Invoke(this._decryptField, new object[] { idx });
  273.     }
  274. }
  275.  
  276. internal static class Memory
  277. {
  278.     [DllImport("kernel32.dll", ExactSpelling = true, SetLastError = true)]
  279.     private static extern bool VirtualProtect(IntPtr lpAddress, IntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
  280.  
  281.     internal unsafe static void Hook(MethodBase from, MethodBase to)
  282.     {
  283.         IntPtr address = Memory.GetAddress(from);
  284.         IntPtr address2 = Memory.GetAddress(to);
  285.         uint flNewProtect;
  286.         Memory.VirtualProtect(address, (IntPtr)8, 64u, out flNewProtect);
  287.         if (IntPtr.Size == 8)
  288.         {
  289.             byte* ptr = (byte*)address.ToPointer();
  290.             *ptr = 73;
  291.             ptr[1] = 187;
  292.             *(long*)(ptr + 2) = address2.ToInt64();
  293.             ptr[10] = 65;
  294.             ptr[11] = 255;
  295.             ptr[12] = 227;
  296.             Console.WriteLine("[!] Prefer use a 32-bit processor ");
  297.         }
  298.         else if (IntPtr.Size == 4)
  299.         {
  300.             byte* ptr2 = (byte*)address.ToPointer();
  301.             ptr2[1] = 144;
  302.             ptr2[2] = 144;
  303.             ptr2[3] = 233;
  304.             *(long*)(ptr2 + 4) = (long)(address2.ToInt32() - address.ToInt32() - 5);
  305.             ptr2[8] = 195;
  306.         }
  307.         uint num;
  308.         Memory.VirtualProtect(address, (IntPtr)8, flNewProtect, out num);
  309.     }
  310.  
  311.     public static IntPtr GetAddress(MethodBase methodBase)
  312.     {
  313.         RuntimeHelpers.PrepareMethod(methodBase.MethodHandle);
  314.         return methodBase.MethodHandle.GetFunctionPointer();
  315.     }
  316. }
  317.  
  318. internal class AssemblyWriter
  319. {
  320.     private readonly string assemblyPath;
  321.  
  322.     internal ModuleDefMD moduleDef;
  323.     internal AssemblyWriter(string assemblyPath)
  324.     {
  325.         this.assemblyPath = assemblyPath;
  326.  
  327.         AssemblyResolver assemblyResolver = new AssemblyResolver();
  328.         ModuleContext moduleContext = new ModuleContext(assemblyResolver);
  329.         assemblyResolver.EnableTypeDefCache = true;
  330.         assemblyResolver.DefaultModuleContext = moduleContext;
  331.         moduleDef = ModuleDefMD.Load(assemblyPath, moduleContext);
  332.         moduleDef.Context = moduleContext;
  333.         moduleDef.Context.AssemblyResolver.AddToCache(moduleDef);
  334.     }
  335.  
  336.     internal void WriteMethod(MethodDef methodDef)
  337.     {
  338.         MethodDef executingMethod = Script.currentMethod;
  339.  
  340.         if (executingMethod == null)
  341.         {
  342.             Console.WriteLine("[!] Failed to write " + methodDef);
  343.             return;
  344.         }
  345.         Script.currentMethod = null;
  346.         executingMethod.FreeMethodBody();
  347.         executingMethod.Body = methodDef.Body;
  348.     }
  349.  
  350.     internal void Save()
  351.     {
  352.         try
  353.         {
  354.             string text = Path.GetDirectoryName(assemblyPath);
  355.  
  356.             if (!text.EndsWith("\\"))
  357.             {
  358.                 text += "\\";
  359.             }
  360.  
  361.             string filename = text + Path.GetFileNameWithoutExtension(assemblyPath) + "_Unpacked" + Path.GetExtension(assemblyPath);
  362.             ModuleWriterOptions options = new ModuleWriterOptions(moduleDef);
  363.             options.Logger = DummyLogger.NoThrowInstance;
  364.             moduleDef.Write(filename, options);
  365.         }
  366.         catch (Exception ex)
  367.         {
  368.             Console.WriteLine("[!] Exception :\n" + ex.Message);
  369.         }
  370.     }
  371.  
  372. }
Compilation error #stdin compilation error #stdout 0s 0KB
comments (?)
stdin 
Standard input is empty
compilation info 
prog.cs(4,7): error CS0246: The type or namespace name `dnlib' could not be found. Are you missing an assembly reference?
prog.cs(5,7): error CS0246: The type or namespace name `dnlib' could not be found. Are you missing an assembly reference?
prog.cs(6,7): error CS0246: The type or namespace name `dnlib' could not be found. Are you missing an assembly reference?
prog.cs(11,22): error CS0234: The type or namespace name `Forms' does not exist in the namespace `System.Windows'. Are you missing `System.Windows.Forms' assembly reference?
prog.cs(21,19): error CS0246: The type or namespace name `MethodDef' could not be found. Are you missing an assembly reference?
prog.cs(23,24): error CS0246: The type or namespace name `TypeDef' could not be found. Are you missing an assembly reference?
prog.cs(135,47): error CS0246: The type or namespace name `TypeDef' could not be found. Are you missing an assembly reference?
prog.cs(230,40): error CS0246: The type or namespace name `TypeDef' could not be found. Are you missing an assembly reference?
prog.cs(263,32): error CS0246: The type or namespace name `FieldDef' could not be found. Are you missing an assembly reference?
prog.cs(322,14): error CS0246: The type or namespace name `ModuleDefMD' could not be found. Are you missing an assembly reference?
prog.cs(336,31): error CS0246: The type or namespace name `MethodDef' could not be found. Are you missing an assembly reference?
Compilation failed: 11 error(s), 0 warnings
stdout 
Standard output is empty
https://ideone.com/fi3BfH
language:
C# (gmcs 5.20.1)
created:
8 years ago
visibility:
public

Share or Embed source code

Discover > Sphere Engine API

The brand new service which powers Ideone!

Discover > IDE Widget

Widget for compiling and running the source code in a web browser!