feature: randomize CFG state multiplier constant per run (#69)

The Constants protection's control-flow encoding baked the fixed
multiplier 0x21412321 into both the obfuscator-side CFGState and the
injected runtime CFGCtx constructor, giving de4dot a stable signature.

Generate a random odd (invertible mod 2^32) multiplier per module when
the CFG state type is injected, rewrite the literal in the runtime ctor
IL, and thread the same value through the obfuscator CFGState so both
sides stay in sync. Validated end-to-end by the constants protection
tests (obfuscate -> run -> assert output).

Author: RandomCrocodile

Confuser.Protections/Constants/CEContext.cs

@@ -35,6 +35,7 @@ internal class CEContext {
 		public TypeDef CfgCtxType;
 		public MethodDef CfgCtxCtor;
 		public MethodDef CfgCtxNext;
+		public uint CfgCtxMultiplier;
 		public Dictionary<MethodDef, List<Tuple<Instruction, uint, IMethod>>> ReferenceRepl;
 	}
 

Confuser.Protections/Constants/ReferenceReplacer.cs

@@ -51,11 +51,11 @@ struct CFGState {
 			public uint C;
 			public uint D;
 
-			public CFGState(uint seed) {
-				A = seed *= 0x21412321;
-				B = seed *= 0x21412321;
-				C = seed *= 0x21412321;
-				D = seed *= 0x21412321;
+			public CFGState(uint seed, uint mult) {
+				A = seed *= mult;
+				B = seed *= mult;
+				C = seed *= mult;
+				D = seed *= mult;
 			}
 
 			public void UpdateExplicit(int id, uint value) {
@@ -136,6 +136,15 @@ static void InjectStateType(CEContext ctx) {
 				ctx.CfgCtxCtor = ctx.CfgCtxType.FindMethod(".ctor");
 				ctx.CfgCtxNext = ctx.CfgCtxType.FindMethod("Next");
 
+				// Randomize the CFG state multiplier so the baked-in 0x21412321 literal
+				// no longer fingerprints the output. Must stay odd (invertible mod 2^32) and
+				// match the obfuscator-side CFGState computation (see CFGState.ctor).
+				ctx.CfgCtxMultiplier = ctx.Random.NextUInt32() | 1;
+				foreach (var instr in ctx.CfgCtxCtor.Body.Instructions) {
+					if (instr.OpCode == OpCodes.Ldc_I4 && (int)instr.Operand == 0x21412321)
+						instr.Operand = (int)ctx.CfgCtxMultiplier;
+				}
+
 				ctx.Name.MarkHelper(ctx.CfgCtxType, ctx.Marker, ctx.Protection);
 				foreach (var def in ctx.CfgCtxType.Fields)
 					ctx.Name.MarkHelper(def, ctx.Marker, ctx.Protection);
@@ -212,7 +221,7 @@ static void InsertEmptyStateUpdate(CFGContext ctx, ControlFlowBlock block) {
 				if (!ctx.StatesMap.TryGetValue(key.ExitState, out exit)) {
 					// Create new exit state from random seed
 					var seed = ctx.Random.NextUInt32();
-					exit = new CFGState(seed);
+					exit = new CFGState(seed, ctx.Ctx.CfgCtxMultiplier);
 					body.Instructions.Insert(targetIndex++, first = Instruction.Create(OpCodes.Ldloca, ctx.StateVariable));
 					body.Instructions.Insert(targetIndex++, Instruction.Create(OpCodes.Ldc_I4, (int)seed));
 					body.Instructions.Insert(targetIndex++, Instruction.Create(OpCodes.Call, ctx.Ctx.CfgCtxCtor));
@@ -301,7 +310,7 @@ static uint InsertStateGetAndUpdate(CFGContext ctx, ref int index, BlockKeyType
 				if (targetState == null) {
 					// Create new exit state from random seed
 					var seed = ctx.Random.NextUInt32();
-					currentState = new CFGState(seed);
+					currentState = new CFGState(seed, ctx.Ctx.CfgCtxMultiplier);
 					body.Instructions.Insert(index++, Instruction.Create(OpCodes.Ldloca, ctx.StateVariable));
 					body.Instructions.Insert(index++, Instruction.Create(OpCodes.Dup));
 					body.Instructions.Insert(index++, Instruction.Create(OpCodes.Ldc_I4, (int)seed));
@@ -398,7 +407,7 @@ static void ReplaceCFG(MethodDef method, List<Tuple<Instruction, uint, IMethod>>
 
 					// Create new entry state
 					uint blockSeed = ctx.Random.NextUInt32();
-					currentState = new CFGState(blockSeed);
+					currentState = new CFGState(blockSeed, ctx.CfgCtxMultiplier);
 					cfgCtx.StatesMap[key.EntryState] = currentState;
 
 					var index = graph.Body.Instructions.IndexOf(graph[blockRef.Key].Header);