feature: randomize anti-tamper feedback constant per run (#69)

Phase 2 of #69 (Level 2 identity). The anti-tamper method-body cipher used a
hardcoded feedback constant 0x3dbb2819 in both the obfuscator (encrypt) and the
injected runtime (decrypt) — a value de4dot signature-matches to identify
ConfuserEx.

Normal and Anti modes now generate a random per-run feedback value, use it in the
encryption loop, and inject it into the runtime via a new Mutation key (KeyI5),
exactly like the existing z/x/c/v hash constants (KeyI1-4). Obfuscator and runtime
stay in sync automatically because the same generated value is both used and
injected.

JIT mode is intentionally left unchanged — its runtime component is already broken
and its test is skipped, so a crypto change there cannot be validated.

Validated by AntiTamper.Test: the obfuscated app decrypts its own method bodies at
runtime and produces correct output (exit 42) for both Normal and Anti modes.

Author: RandomCrocodile

.gitignore

@@ -1,5 +1,6 @@
 # Visual Studio Cache files (starting with VS 2015)
 .vs/
+.temp
 
 # Launch Settings
 launchSettings.json

Confuser.Protections/AntiTamper/AntiMode.cs

@@ -16,6 +16,7 @@
 namespace Confuser.Protections.AntiTamper {
 	internal class AntiMode : IModeHandler {
 		uint c;
+		uint feedback;
 		IKeyDeriver deriver;
 
 		List<MethodDef> methods;
@@ -31,6 +32,7 @@ public void HandleInject(AntiTamperProtection parent, ConfuserContext context, P
 			x = random.NextUInt32();
 			c = random.NextUInt32();
 			v = random.NextUInt32();
+			feedback = random.NextUInt32();
 			name1 = random.NextUInt32() & 0x7f7f7f7f;
 			name2 = random.NextUInt32() & 0x7f7f7f7f;
 
@@ -77,8 +79,8 @@ public void HandleInject(AntiTamperProtection parent, ConfuserContext context, P
 				initMethod.Body.Instructions.Add(instr);
 
 			MutationHelper.InjectKeys(initMethod,
-									  new[] { 0, 1, 2, 3, 4 },
-									  new[] { (int)(name1 * name2), (int)z, (int)x, (int)c, (int)v });
+									  new[] { 0, 1, 2, 3, 4, 5 },
+									  new[] { (int)(name1 * name2), (int)z, (int)x, (int)c, (int)v, (int)feedback });
 
 			var name = context.Registry.GetService<INameService>();
 			var marker = context.Registry.GetService<IMarkerService>();
@@ -219,7 +221,7 @@ void EncryptSection(ModuleWriterBase writer) {
 			for (uint i = 0; i < encSize; i++) {
 				uint data = reader.ReadUInt32();
 				result[i] = data ^ key[i & 0xf];
-				key[i & 0xf] = (key[i & 0xf] ^ data) + 0x3dbb2819;
+				key[i & 0xf] = (key[i & 0xf] ^ data) + feedback;
 			}
 			var byteResult = new byte[encSize << 2];
 			Buffer.BlockCopy(result, 0, byteResult, 0, byteResult.Length);

Confuser.Protections/AntiTamper/NormalMode.cs

@@ -16,6 +16,7 @@
 namespace Confuser.Protections.AntiTamper {
 	internal class NormalMode : IModeHandler {
 		uint c;
+		uint feedback;
 		IKeyDeriver deriver;
 
 		List<MethodDef> methods;
@@ -31,6 +32,7 @@ public void HandleInject(AntiTamperProtection parent, ConfuserContext context, P
 			x = random.NextUInt32();
 			c = random.NextUInt32();
 			v = random.NextUInt32();
+			feedback = random.NextUInt32();
 			name1 = random.NextUInt32() & 0x7f7f7f7f;
 			name2 = random.NextUInt32() & 0x7f7f7f7f;
 
@@ -77,8 +79,8 @@ public void HandleInject(AntiTamperProtection parent, ConfuserContext context, P
 				initMethod.Body.Instructions.Add(instr);
 
 			MutationHelper.InjectKeys(initMethod,
-									  new[] { 0, 1, 2, 3, 4 },
-									  new[] { (int)(name1 * name2), (int)z, (int)x, (int)c, (int)v });
+									  new[] { 0, 1, 2, 3, 4, 5 },
+									  new[] { (int)(name1 * name2), (int)z, (int)x, (int)c, (int)v, (int)feedback });
 
 			var name = context.Registry.GetService<INameService>();
 			var marker = context.Registry.GetService<IMarkerService>();
@@ -220,7 +222,7 @@ void EncryptSection(ModuleWriterBase writer) {
 			for (uint i = 0; i < encSize; i++) {
 				uint data = reader.ReadUInt32();
 				result[i] = data ^ key[i & 0xf];
-				key[i & 0xf] = (key[i & 0xf] ^ data) + 0x3dbb2819;
+				key[i & 0xf] = (key[i & 0xf] ^ data) + feedback;
 			}
 			var byteResult = new byte[encSize << 2];
 			Buffer.BlockCopy(result, 0, byteResult, 0, byteResult.Length);

Confuser.Runtime/AntiTamper.Anti.cs

@@ -27,6 +27,7 @@ static unsafe void Initialize() {
 			uint l = 0;
 			var r = (uint*)(p + 0x18 + o);
 			uint z = (uint)Mutation.KeyI1, x = (uint)Mutation.KeyI2, c = (uint)Mutation.KeyI3, v = (uint)Mutation.KeyI4;
+			uint fb = (uint)Mutation.KeyI5;
 
 			CheckRemoteDebuggerPresent(Process.GetCurrentProcess().Handle, ref isDebuggerPresent);
 			if (isDebuggerPresent) Environment.FailFast(null);
@@ -80,7 +81,7 @@ static unsafe void Initialize() {
 			uint h = 0;
 			for (uint i = 0; i < l; i++) {
 				*e ^= y[h & 0xf];
-				y[h & 0xf] = (y[h & 0xf] ^ (*e++)) + 0x3dbb2819;
+				y[h & 0xf] = (y[h & 0xf] ^ (*e++)) + fb;
 
 				CheckRemoteDebuggerPresent(Process.GetCurrentProcess().Handle, ref isDebuggerPresent);
 				if (isDebuggerPresent) Environment.FailFast(null);

Confuser.Runtime/AntiTamper.Normal.cs

@@ -20,6 +20,7 @@ static unsafe void Initialize() {
 			uint l = 0;
 			var r = (uint*)(p + 0x18 + o);
 			uint z = (uint)Mutation.KeyI1, x = (uint)Mutation.KeyI2, c = (uint)Mutation.KeyI3, v = (uint)Mutation.KeyI4;
+			uint fb = (uint)Mutation.KeyI5;
 			for (int i = 0; i < s; i++) {
 				uint g = (*r++) * (*r++);
 				if (g == (uint)Mutation.KeyI0) {
@@ -60,7 +61,7 @@ static unsafe void Initialize() {
 			uint h = 0;
 			for (uint i = 0; i < l; i++) {
 				*e ^= y[h & 0xf];
-				y[h & 0xf] = (y[h & 0xf] ^ (*e++)) + 0x3dbb2819;
+				y[h & 0xf] = (y[h & 0xf] ^ (*e++)) + fb;
 				h++;
 			}
 		}