feature: randomize compressor feedback + library-seed constants (#69) - #100
Open
mcpolo99 wants to merge 2 commits into
Open
feature: randomize compressor feedback + library-seed constants (#69)#100mcpolo99 wants to merge 2 commits into
mcpolo99 wants to merge 2 commits into
Conversation
added 2 commits
July 4, 2026 20:39
The compressor packer baked the fixed feedback 0x3ddb2819 into both the encryption loop (CompressorContext.Encrypt) and the injected runtime Decrypt method, giving de4dot a stable signature for packed output. Generate a random feedback per pack, use it in Encrypt for both the main module and every embedded library, and rewrite the literal in the runtime Decrypt IL so encrypt/decrypt stay in sync. Validated end-to-end by CompressorWithResx.Test (12 cases: compat x deriver x resource modes, covering both Compressor and CompressorCompat runtimes).
The rolling hash that derives each embedded library's decryption seed from its name used fixed constants 0x6fff61 (init) and 0x5e3f1f (multiplier) in both PackModules and the injected runtime Resolve method — another de4dot signature. Generate a random init and a random odd multiplier per pack, use them in PackModules, and rewrite the literals in the runtime Resolve IL so the seed derivation stays in sync. Validated by CompressorWithResx.Test, whose 'de' satellite assembly is resolved+decrypted through this exact path at runtime (asserts 'Test (deutsch)' across all 12 cases).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Level 2 constant randomization — Compressor (#69)
Removes two fixed magic constants from the compressor packer that de4dot/AV pattern-match to fingerprint packed output. Each becomes a per-pack random value, kept in sync between the obfuscator's encryption side and the injected runtime's decryption side.
0x3ddb2819CompressorContext.Encrypt↔DecryptIL0x6fff61/0x5e3f1fPackModules↔ResolveILHow sync is preserved
Encryptfor the main module and every embedded library, and rewritten into the runtimeDecryptmethod'sldc.i4literal.PackModulesto derive per-library seeds, and rewritten into the runtimeResolvemethod's literals.Both runtime variants (
CompressorandCompressorCompat) are handled — the rewrite operates on whichever type was injected.Validation
CompressorWithResx.Test— 12/12 pass (compattrue/false× derivernormal/dynamic× resource modes). The test app loads adesatellite assembly at runtime, which is embedded, resolved, and decrypted through the exactResolve→Decryptpath these constants drive (asserts both"Test (fallback)"and"Test (deutsch)"). A broken constant-sync fails the run immediately.Scoped out (follow-up)
0x143fc089/0x444d56fb/0x8a5cb7— need a curated valid-prime set (grouped with the xorshift/rotation curated sets in the other protections).Part of #69.