feature: randomize anti-tamper feedback + CFG multiplier constants (#69 level 2) - #98
Merged
Merged
Conversation
added 2 commits
July 4, 2026 17:11
Phase 2 of #69 (Level 2 identity). The anti-tamper method-body cipher used a hardcoded feedback constant 0x3dbb2819 in both the obfuscator (encrypt) and the injected runtime (decrypt) — a value de4dot signature-matches to identify ConfuserEx. Normal and Anti modes now generate a random per-run feedback value, use it in the encryption loop, and inject it into the runtime via a new Mutation key (KeyI5), exactly like the existing z/x/c/v hash constants (KeyI1-4). Obfuscator and runtime stay in sync automatically because the same generated value is both used and injected. JIT mode is intentionally left unchanged — its runtime component is already broken and its test is skipped, so a crypto change there cannot be validated. Validated by AntiTamper.Test: the obfuscated app decrypts its own method bodies at runtime and produces correct output (exit 42) for both Normal and Anti modes.
The Constants protection's control-flow encoding baked the fixed multiplier 0x21412321 into both the obfuscator-side CFGState and the injected runtime CFGCtx constructor, giving de4dot a stable signature. Generate a random odd (invertible mod 2^32) multiplier per module when the CFG state type is injected, rewrite the literal in the runtime ctor IL, and thread the same value through the obfuscator CFGState so both sides stay in sync. Validated end-to-end by the constants protection tests (obfuscate -> run -> assert output).
mcpolo99
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Level 2 constant randomization (#69)
Removes fixed magic constants that de4dot and AV engines pattern-match to fingerprint ConfuserEx output. Each is replaced with a per-run random value, kept in sync between the obfuscator's encryption side and the injected runtime's decryption side via the existing mutation/injection mechanism.
Included in this PR
0x3dbb2819AntiTamper/NormalMode.cs,AntiMode.cs↔Runtime/AntiTamper.Normal.cs,AntiTamper.Anti.csAntiTamper.Test(normal + anti modes)0x21412321Constants/ReferenceReplacer.cs↔Runtime/Constant.cs(CFGCtx)270_EnumArrayConstantProtection.Test,193_ConstantsInlining.TestBoth changes round-trip through obfuscate → run → assert output, so a broken constant sync fails the test immediately.
How sync is preserved
feedback = random.NextUInt32(), uses it in the encrypt loop, and injects the same value into the runtime placeholder viaMutationHelper.InjectKeys(slot 5).CFGCtxinjection, a random odd multiplier is generated, the0x21412321literal is rewritten in the injected ctor IL, and the same value is threaded through the obfuscator-sideCFGStateconstructor.Intentionally scoped out (follow-up)
0x3ddb2819, LCG constants, prime moduli, xorshift/rotation triples — require signature changes and/or curated valid-value sets; tracked in.temp/issue-69-analysis.md.Part of #69.