Skip to content

Commit 4bbad41

Browse files
authored
Update README.md
1 parent 2b00834 commit 4bbad41

File tree

1 file changed

+62
-112
lines changed

1 file changed

+62
-112
lines changed

README.md

Lines changed: 62 additions & 112 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@ The constructor takes the filename of the assembly.
1313
```cs
1414
Patcher patcher = new Patcher("Test.exe");
1515
```
16+
If you want to keep the old maxstack (for example for obfuscated assemblies) use the overload:
17+
```cs
18+
Patcher patcher = new Patcher("Test.exe", true);
19+
```
1620

1721
### Targeting Methods
1822
All methods take an object called Target as argument. The object is defined as follows:
@@ -198,6 +202,64 @@ target = new Target()
198202
p.WriteEmptyBody(target);
199203
```
200204

205+
### Getting instructions from target
206+
Simply do this if you want to get instructions of the Target object:
207+
```cs
208+
target = new Target()
209+
{
210+
Namespace = "Test",
211+
Class = "Program",
212+
Method = "WriteLog"
213+
};
214+
Instruction[] instructions = p.GetInstructions(target);
215+
```
216+
217+
### Writing return bodies
218+
If you want to overwrite the body with a return true/false do this:
219+
```cs
220+
target = new Target()
221+
{
222+
Namespace = "Test",
223+
Class = "Program",
224+
Method = "WriteLog"
225+
};
226+
p.WriteReturnBody(target, bool);
227+
// bool is the return value, e.g. true will return true ;)
228+
```
229+
If you want to remove the body simply call this:
230+
```cs
231+
target = new Target()
232+
{
233+
Namespace = "Test",
234+
Class = "Program",
235+
Method = "WriteLog"
236+
};
237+
p.WriteEmptyBody(target);
238+
```
239+
240+
### Find methods
241+
If you want to find a method, you can simply scan the whole file by 2 ways:
242+
```cs
243+
p.FindInstructionsByOperand(string[]);
244+
// or p.FindInstructionsByOperand(int[]);
245+
// string[] with all operands in the method, if there are multiple identical operands, make sure to have the same amount as in the method.
246+
247+
// or do this via opcodes:
248+
p.FindInstructionsByOpcode(OpCode[]);
249+
```
250+
Both ways return an Target[] which contains all targets pointing to the findings.
251+
252+
#### Find instructions in methods or classes
253+
If you want to find the instructions and you know the class and optionally the method you can let this method return a Target[] with the pathes and indexes.
254+
```cs
255+
p.FindInstructionsByOperand(Target,int[],bool);
256+
// int[]: the operands
257+
// bool: if true it will search for the operands once, it will delete the index if the index was found
258+
259+
// for opcodes:
260+
p.FindInstructionsByOpcode(Target,int[],bool);
261+
```
262+
mbo
201263
### Building calls
202264
To build calls like "Console.WriteLine()" you can use this method:
203265
```cs
@@ -232,118 +294,6 @@ Or if you want to replace the original file:
232294
patcher.Save(bool); // if true it will create a backup first (filename.bak)
233295
```
234296

235-
## Obfuscated assemblies...
236-
This part is in heavy development right now. The main purpose is to find a method and patch the instructions without the need of knowing the names incase the namespaces, etc are renamed via an obfuscator.
237-
238-
### Constructor
239-
Create an Object called 'ObfuscationPatcher':
240-
```cs
241-
var op = new ObfuscationPatcher(string, bool);
242-
// string: filename
243-
// bool: keep old max stack?
244-
```
245-
246-
### Searching the target method
247-
#### By operand
248-
Let's say the strings are not encrypted (I'm talking about Ldstr here):
249-
```cs
250-
string[] operands = {
251-
"Find",
252-
"TheWord",
253-
"The",
254-
"Word",
255-
"You",
256-
"Wont"
257-
}; // Find there words within the method.
258-
Target[] obfuscatedTargets = op.FindInstructionsByOperand(operands); // let the boi work. It will return an Target[] with all methods he could find.
259-
foreach (var obfTarget in obfuscatedTargets) // Let's iterate and have fun
260-
{
261-
obfTarget.Instructions = new Instruction[]
262-
{
263-
Instruction.Create(OpCodes.Ldstr, "Obfuscator"),
264-
Instruction.Create(OpCodes.Ldstr, "Got"),
265-
Instruction.Create(OpCodes.Ldstr, "Rekt"),
266-
Instruction.Create(OpCodes.Ldstr, "Hell"),
267-
Instruction.Create(OpCodes.Ldstr, "Yeah"),
268-
Instruction.Create(OpCodes.Ldstr, "!")
269-
}; // modify the instructions
270-
}
271-
op.Patch(obfuscatedTargets); // Patch the instructions
272-
```
273-
274-
#### By OpCode
275-
Let's say you look for an OpCode, you can do this:
276-
```cs
277-
op.FindInstructionsByOpcode(new[] {OpCodes.Add}) // NOT TESTED
278-
```
279-
280-
### Patching
281-
As before you will just do this:
282-
```cs
283-
op.Patch(Target); // Patch the instructions
284-
// or
285-
op.Patch(Target[]); // Patch multiple targets
286-
```
287-
288-
### Save the assembly
289-
Again, as before :)
290-
```cs
291-
op.Save(string); // string -> filename
292-
```
293-
294-
## Resources
295-
Wanna patch some resources? No, problem! Just create an object called ResourcePatcher!
296-
```cs
297-
ResourcePatcher rp = new ResourcePatcher(string); // string-> assembly
298-
```
299-
300-
### Insert resources
301-
Add resources using this piece of code:
302-
```cs
303-
rp.InsertResource(string, byte[]);
304-
/*
305-
* string -> resourcename
306-
* byte[] -> ByteArray of the data to write
307-
*/
308-
```
309-
You can replace byte[] with a string to load the byte[] from a file.
310-
311-
### Removing resources
312-
You can remove resources if you know the index:
313-
```cs
314-
rp.RemoveResource(int); // int -> index
315-
```
316-
If you want to remove all resources do this:
317-
```cs
318-
rp.RemoveResources();
319-
```
320-
321-
### Replacing resources
322-
If you want to replace a resource, you can do this my friend:
323-
```cs
324-
rp.ReplaceResource(int, string, byte[]);
325-
/*
326-
* int -> index
327-
* string -> name
328-
* byte[] -> ByteArray with your data
329-
*/
330-
```
331-
You can replace byte[] with a string pointing to a file.
332-
333-
### Getting resources
334-
dnlib stores the resources as ResourceCollection and I'm not going to wrap it, use this method to get the resources:
335-
```cs
336-
rp.GetResources();
337-
```
338-
339-
### Save
340-
As always:
341-
```cs
342-
rp.Save(string);
343-
// or
344-
rp.Save(bool);
345-
```
346-
347297
## Deobfuscation [BETA]
348298
Baoss, what can I do if it's heavily obfuscated?! Well, listen careful to your grandpa Joe. Use 'dnpatch.deobfuscation'! It has magic powers! Nah, Joe is just kiddin', it uses the de4dot libraries.
349299
Reference the library dnpatch.deobfuscation and make sure that you also copy all others from the zip!

0 commit comments

Comments
 (0)