我正在尝试制作一个混淆器

发布于 2024-08-04 11:32:36 字数 278 浏览 6 评论 0原文

这是一个由两部分组成的问题。但这两者都涉及同一件事。

我想使用应用程序的 IL 代码来应用补丁。我想知道什么是正确的方法。显然我可以反编译它并读取和编辑 il 代码文件,然后重新编译。但有什么方法可以将其读取为文件中的 msil 代码。也许可以实时编辑它。

我试图编辑可执行文件的反编译代码。但每次我重新编译它时,我都会遇到执行问题。就像它再也找不到入口点一样。我该如何计算?我猜我需要知道命令的长度及其参数,或者使入口点成为标签或其他东西。如果有一个类似这样的 Visual Studio 模板,我会很高兴。

This is kind of a two part question. But it both relates to the same thing.

I want to work with the IL code of an app to apply patches. I am wondering what would be the right approach. Obviously I could decompile it and read and edit the il code file then recompile. but is there some way to read it as msil code right in the file. and maybe edit it in real time.

I was trying to edit the decompiled code of an executable. but each time I recompiled it I would get a problem with the execution. Like it couldnt find its entry point anymore. How do I calculate that ? Im guessing I need to know the length of the commands and their paramaters, Or to make the entry point a Label or something. I would be nice if there was a Visual Studio Template for something like this.

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(2

萌︼了一个春 2024-08-11 11:32:36

作为已经多次阅读 ECMA-335 规范的人用两种不同的语言实现了 CLI 图像加载器(其中一种语言具有完整的 IL 分析),我想说这对我来说仍然是一项具有挑战性的任务。我这么说是因为看起来 1) 你还没有这样做,2) 你正在寻找一个简单的答案。规范绝对应该是您的起点。

最小过程是:

  • 加载 PE 映像(exe 或 dll)
  • 解析所有方法的字节码并解析符号
  • 应用代码转换(当然,最小的过程是单个转换,例如重命名私有方法)
  • 将结果保存为新的 PE 映像

编辑:这不会阻止您了解 .NET 程序集的详细结构,但它可能会在实际实现中节省您一些时间,并有助于将混淆器逻辑与装载机。

As someone who's already read the ECMA-335 spec multiple times and implemented a CLI image loader in two different languages (with a full IL analysis in one), I'd say this would still be a challenging task for me. I say this because it appears that both 1) you haven't done this and 2) you are looking for an easy answer. The spec should definitely be your starting point.

The minimal procedure would be:

  • Load the PE image (exe or dll)
  • Parse the byte code of all methods and resolve symbols
  • Apply code transformations (minimal of course would be a single transformation such as renaming private methods)
  • Save the result as a new PE image

Edit: This won't keep you from having to learn about the detailed structure of .NET assemblies, but it may save you some time in the actual implementation and assist in keeping your obfuscator logic cleanly separated from the loader.

成熟的代价 2024-08-11 11:32:36

要阅读 MSIL,此线程:

ildasm.exe - 中级语言反汇编器。您可以使用此工具在 MSIL 级别查看编译的代码。

这可以在 Microsoft SDK 中找到。

To read the MSIL, there sure is, in this thread:

ildasm.exe - Intermediate Language Disassembler. You can view your compiled code at the MSIL level with this tool.

This is found in the Microsoft SDK.

~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文