You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
If you want to overwrite the body with a return true/false do this:
219
+
```cs
220
+
target=newTarget()
221
+
{
222
+
Namespace="Test",
223
+
Class="Program",
224
+
Method="WriteLog"
225
+
};
226
+
p.WriteReturnBody(target, bool);
227
+
// bool is the return value, e.g. true will return true ;)
228
+
```
229
+
If you want to remove the body simply call this:
230
+
```cs
231
+
target=newTarget()
232
+
{
233
+
Namespace="Test",
234
+
Class="Program",
235
+
Method="WriteLog"
236
+
};
237
+
p.WriteEmptyBody(target);
238
+
```
239
+
240
+
### Find methods
241
+
If you want to find a method, you can simply scan the whole file by 2 ways:
242
+
```cs
243
+
p.FindInstructionsByOperand(string[]);
244
+
// or p.FindInstructionsByOperand(int[]);
245
+
// string[] with all operands in the method, if there are multiple identical operands, make sure to have the same amount as in the method.
246
+
247
+
// or do this via opcodes:
248
+
p.FindInstructionsByOpcode(OpCode[]);
249
+
```
250
+
Both ways return an Target[] which contains all targets pointing to the findings.
251
+
252
+
#### Find instructions in methods or classes
253
+
If you want to find the instructions and you know the class and optionally the method you can let this method return a Target[] with the pathes and indexes.
254
+
```cs
255
+
p.FindInstructionsByOperand(Target,int[],bool);
256
+
// int[]: the operands
257
+
// bool: if true it will search for the operands once, it will delete the index if the index was found
258
+
259
+
// for opcodes:
260
+
p.FindInstructionsByOpcode(Target,int[],bool);
261
+
```
262
+
mbo
201
263
### Building calls
202
264
To build calls like "Console.WriteLine()" you can use this method:
203
265
```cs
@@ -232,118 +294,6 @@ Or if you want to replace the original file:
232
294
patcher.Save(bool); // if true it will create a backup first (filename.bak)
233
295
```
234
296
235
-
## Obfuscated assemblies...
236
-
This part is in heavy development right now. The main purpose is to find a method and patch the instructions without the need of knowing the names incase the namespaces, etc are renamed via an obfuscator.
237
-
238
-
### Constructor
239
-
Create an Object called 'ObfuscationPatcher':
240
-
```cs
241
-
varop=newObfuscationPatcher(string, bool);
242
-
// string: filename
243
-
// bool: keep old max stack?
244
-
```
245
-
246
-
### Searching the target method
247
-
#### By operand
248
-
Let's say the strings are not encrypted (I'm talking about Ldstr here):
249
-
```cs
250
-
string[] operands= {
251
-
"Find",
252
-
"TheWord",
253
-
"The",
254
-
"Word",
255
-
"You",
256
-
"Wont"
257
-
}; // Find there words within the method.
258
-
Target[] obfuscatedTargets=op.FindInstructionsByOperand(operands); // let the boi work. It will return an Target[] with all methods he could find.
259
-
foreach (varobfTargetinobfuscatedTargets) // Let's iterate and have fun
260
-
{
261
-
obfTarget.Instructions=newInstruction[]
262
-
{
263
-
Instruction.Create(OpCodes.Ldstr, "Obfuscator"),
264
-
Instruction.Create(OpCodes.Ldstr, "Got"),
265
-
Instruction.Create(OpCodes.Ldstr, "Rekt"),
266
-
Instruction.Create(OpCodes.Ldstr, "Hell"),
267
-
Instruction.Create(OpCodes.Ldstr, "Yeah"),
268
-
Instruction.Create(OpCodes.Ldstr, "!")
269
-
}; // modify the instructions
270
-
}
271
-
op.Patch(obfuscatedTargets); // Patch the instructions
272
-
```
273
-
274
-
#### By OpCode
275
-
Let's say you look for an OpCode, you can do this:
276
-
```cs
277
-
op.FindInstructionsByOpcode(new[] {OpCodes.Add}) // NOT TESTED
278
-
```
279
-
280
-
### Patching
281
-
As before you will just do this:
282
-
```cs
283
-
op.Patch(Target); // Patch the instructions
284
-
// or
285
-
op.Patch(Target[]); // Patch multiple targets
286
-
```
287
-
288
-
### Save the assembly
289
-
Again, as before :)
290
-
```cs
291
-
op.Save(string); // string -> filename
292
-
```
293
-
294
-
## Resources
295
-
Wanna patch some resources? No, problem! Just create an object called ResourcePatcher!
You can replace byte[] with a string to load the byte[] from a file.
310
-
311
-
### Removing resources
312
-
You can remove resources if you know the index:
313
-
```cs
314
-
rp.RemoveResource(int); // int -> index
315
-
```
316
-
If you want to remove all resources do this:
317
-
```cs
318
-
rp.RemoveResources();
319
-
```
320
-
321
-
### Replacing resources
322
-
If you want to replace a resource, you can do this my friend:
323
-
```cs
324
-
rp.ReplaceResource(int, string, byte[]);
325
-
/*
326
-
* int -> index
327
-
* string -> name
328
-
* byte[] -> ByteArray with your data
329
-
*/
330
-
```
331
-
You can replace byte[] with a string pointing to a file.
332
-
333
-
### Getting resources
334
-
dnlib stores the resources as ResourceCollection and I'm not going to wrap it, use this method to get the resources:
335
-
```cs
336
-
rp.GetResources();
337
-
```
338
-
339
-
### Save
340
-
As always:
341
-
```cs
342
-
rp.Save(string);
343
-
// or
344
-
rp.Save(bool);
345
-
```
346
-
347
297
## Deobfuscation [BETA]
348
298
Baoss, what can I do if it's heavily obfuscated?! Well, listen careful to your grandpa Joe. Use 'dnpatch.deobfuscation'! It has magic powers! Nah, Joe is just kiddin', it uses the de4dot libraries.
349
299
Reference the library dnpatch.deobfuscation and make sure that you also copy all others from the zip!
0 commit comments