Skip to content

feature: randomize anti-tamper feedback + CFG multiplier constants (#69 level 2) #98

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mcpolo99 merged 2 commits into from
Jul 4, 2026
Merged

feature: randomize anti-tamper feedback + CFG multiplier constants (#69 level 2) #98

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
110b096
feature: randomize anti-tamper feedback constant per run (#69)
Jul 4, 2026
99977b6
feature: randomize CFG state multiplier constant per run (#69)
Jul 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# Visual Studio Cache files (starting with VS 2015)
.vs/
.temp

# Launch Settings
launchSettings.json
Expand Down
8 changes: 5 additions & 3 deletions Confuser.Protections/AntiTamper/AntiMode.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@
namespace Confuser.Protections.AntiTamper {
internal class AntiMode : IModeHandler {
uint c;
uint feedback;
IKeyDeriver deriver;

List<MethodDef> methods;
Expand All @@ -31,6 +32,7 @@ public void HandleInject(AntiTamperProtection parent, ConfuserContext context, P
x = random.NextUInt32();
c = random.NextUInt32();
v = random.NextUInt32();
feedback = random.NextUInt32();
name1 = random.NextUInt32() & 0x7f7f7f7f;
name2 = random.NextUInt32() & 0x7f7f7f7f;

Expand Down Expand Up @@ -77,8 +79,8 @@ public void HandleInject(AntiTamperProtection parent, ConfuserContext context, P
initMethod.Body.Instructions.Add(instr);

MutationHelper.InjectKeys(initMethod,
new[] { 0, 1, 2, 3, 4 },
new[] { (int)(name1 * name2), (int)z, (int)x, (int)c, (int)v });
new[] { 0, 1, 2, 3, 4, 5 },
new[] { (int)(name1 * name2), (int)z, (int)x, (int)c, (int)v, (int)feedback });

var name = context.Registry.GetService<INameService>();
var marker = context.Registry.GetService<IMarkerService>();
Expand Down Expand Up @@ -219,7 +221,7 @@ void EncryptSection(ModuleWriterBase writer) {
for (uint i = 0; i < encSize; i++) {
uint data = reader.ReadUInt32();
result[i] = data ^ key[i & 0xf];
key[i & 0xf] = (key[i & 0xf] ^ data) + 0x3dbb2819;
key[i & 0xf] = (key[i & 0xf] ^ data) + feedback;
}
var byteResult = new byte[encSize << 2];
Buffer.BlockCopy(result, 0, byteResult, 0, byteResult.Length);
Expand Down
8 changes: 5 additions & 3 deletions Confuser.Protections/AntiTamper/NormalMode.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@
namespace Confuser.Protections.AntiTamper {
internal class NormalMode : IModeHandler {
uint c;
uint feedback;
IKeyDeriver deriver;

List<MethodDef> methods;
Expand All @@ -31,6 +32,7 @@ public void HandleInject(AntiTamperProtection parent, ConfuserContext context, P
x = random.NextUInt32();
c = random.NextUInt32();
v = random.NextUInt32();
feedback = random.NextUInt32();
name1 = random.NextUInt32() & 0x7f7f7f7f;
name2 = random.NextUInt32() & 0x7f7f7f7f;

Expand Down Expand Up @@ -77,8 +79,8 @@ public void HandleInject(AntiTamperProtection parent, ConfuserContext context, P
initMethod.Body.Instructions.Add(instr);

MutationHelper.InjectKeys(initMethod,
new[] { 0, 1, 2, 3, 4 },
new[] { (int)(name1 * name2), (int)z, (int)x, (int)c, (int)v });
new[] { 0, 1, 2, 3, 4, 5 },
new[] { (int)(name1 * name2), (int)z, (int)x, (int)c, (int)v, (int)feedback });

var name = context.Registry.GetService<INameService>();
var marker = context.Registry.GetService<IMarkerService>();
Expand Down Expand Up @@ -220,7 +222,7 @@ void EncryptSection(ModuleWriterBase writer) {
for (uint i = 0; i < encSize; i++) {
uint data = reader.ReadUInt32();
result[i] = data ^ key[i & 0xf];
key[i & 0xf] = (key[i & 0xf] ^ data) + 0x3dbb2819;
key[i & 0xf] = (key[i & 0xf] ^ data) + feedback;
}
var byteResult = new byte[encSize << 2];
Buffer.BlockCopy(result, 0, byteResult, 0, byteResult.Length);
Expand Down
1 change: 1 addition & 0 deletions Confuser.Protections/Constants/CEContext.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ internal class CEContext {
public TypeDef CfgCtxType;
public MethodDef CfgCtxCtor;
public MethodDef CfgCtxNext;
public uint CfgCtxMultiplier;
public Dictionary<MethodDef, List<Tuple<Instruction, uint, IMethod>>> ReferenceRepl;
}

Expand Down
25 changes: 17 additions & 8 deletions Confuser.Protections/Constants/ReferenceReplacer.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,11 +51,11 @@ struct CFGState {
public uint C;
public uint D;

public CFGState(uint seed) {
A = seed *= 0x21412321;
B = seed *= 0x21412321;
C = seed *= 0x21412321;
D = seed *= 0x21412321;
public CFGState(uint seed, uint mult) {
A = seed *= mult;
B = seed *= mult;
C = seed *= mult;
D = seed *= mult;
}

public void UpdateExplicit(int id, uint value) {
Expand Down Expand Up @@ -136,6 +136,15 @@ static void InjectStateType(CEContext ctx) {
ctx.CfgCtxCtor = ctx.CfgCtxType.FindMethod(".ctor");
ctx.CfgCtxNext = ctx.CfgCtxType.FindMethod("Next");

// Randomize the CFG state multiplier so the baked-in 0x21412321 literal
// no longer fingerprints the output. Must stay odd (invertible mod 2^32) and
// match the obfuscator-side CFGState computation (see CFGState.ctor).
ctx.CfgCtxMultiplier = ctx.Random.NextUInt32() | 1;
foreach (var instr in ctx.CfgCtxCtor.Body.Instructions) {
if (instr.OpCode == OpCodes.Ldc_I4 && (int)instr.Operand == 0x21412321)
instr.Operand = (int)ctx.CfgCtxMultiplier;
}

ctx.Name.MarkHelper(ctx.CfgCtxType, ctx.Marker, ctx.Protection);
foreach (var def in ctx.CfgCtxType.Fields)
ctx.Name.MarkHelper(def, ctx.Marker, ctx.Protection);
Expand Down Expand Up @@ -212,7 +221,7 @@ static void InsertEmptyStateUpdate(CFGContext ctx, ControlFlowBlock block) {
if (!ctx.StatesMap.TryGetValue(key.ExitState, out exit)) {
// Create new exit state from random seed
var seed = ctx.Random.NextUInt32();
exit = new CFGState(seed);
exit = new CFGState(seed, ctx.Ctx.CfgCtxMultiplier);
body.Instructions.Insert(targetIndex++, first = Instruction.Create(OpCodes.Ldloca, ctx.StateVariable));
body.Instructions.Insert(targetIndex++, Instruction.Create(OpCodes.Ldc_I4, (int)seed));
body.Instructions.Insert(targetIndex++, Instruction.Create(OpCodes.Call, ctx.Ctx.CfgCtxCtor));
Expand Down Expand Up @@ -301,7 +310,7 @@ static uint InsertStateGetAndUpdate(CFGContext ctx, ref int index, BlockKeyType
if (targetState == null) {
// Create new exit state from random seed
var seed = ctx.Random.NextUInt32();
currentState = new CFGState(seed);
currentState = new CFGState(seed, ctx.Ctx.CfgCtxMultiplier);
body.Instructions.Insert(index++, Instruction.Create(OpCodes.Ldloca, ctx.StateVariable));
body.Instructions.Insert(index++, Instruction.Create(OpCodes.Dup));
body.Instructions.Insert(index++, Instruction.Create(OpCodes.Ldc_I4, (int)seed));
Expand Down Expand Up @@ -398,7 +407,7 @@ static void ReplaceCFG(MethodDef method, List<Tuple<Instruction, uint, IMethod>>

// Create new entry state
uint blockSeed = ctx.Random.NextUInt32();
currentState = new CFGState(blockSeed);
currentState = new CFGState(blockSeed, ctx.CfgCtxMultiplier);
cfgCtx.StatesMap[key.EntryState] = currentState;

var index = graph.Body.Instructions.IndexOf(graph[blockRef.Key].Header);
Expand Down
3 changes: 2 additions & 1 deletion Confuser.Runtime/AntiTamper.Anti.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ static unsafe void Initialize() {
uint l = 0;
var r = (uint*)(p + 0x18 + o);
uint z = (uint)Mutation.KeyI1, x = (uint)Mutation.KeyI2, c = (uint)Mutation.KeyI3, v = (uint)Mutation.KeyI4;
uint fb = (uint)Mutation.KeyI5;

CheckRemoteDebuggerPresent(Process.GetCurrentProcess().Handle, ref isDebuggerPresent);
if (isDebuggerPresent) Environment.FailFast(null);
Expand Down Expand Up @@ -80,7 +81,7 @@ static unsafe void Initialize() {
uint h = 0;
for (uint i = 0; i < l; i++) {
*e ^= y[h & 0xf];
y[h & 0xf] = (y[h & 0xf] ^ (*e++)) + 0x3dbb2819;
y[h & 0xf] = (y[h & 0xf] ^ (*e++)) + fb;

CheckRemoteDebuggerPresent(Process.GetCurrentProcess().Handle, ref isDebuggerPresent);
if (isDebuggerPresent) Environment.FailFast(null);
Expand Down
3 changes: 2 additions & 1 deletion Confuser.Runtime/AntiTamper.Normal.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ static unsafe void Initialize() {
uint l = 0;
var r = (uint*)(p + 0x18 + o);
uint z = (uint)Mutation.KeyI1, x = (uint)Mutation.KeyI2, c = (uint)Mutation.KeyI3, v = (uint)Mutation.KeyI4;
uint fb = (uint)Mutation.KeyI5;
for (int i = 0; i < s; i++) {
uint g = (*r++) * (*r++);
if (g == (uint)Mutation.KeyI0) {
Expand Down Expand Up @@ -60,7 +61,7 @@ static unsafe void Initialize() {
uint h = 0;
for (uint i = 0; i < l; i++) {
*e ^= y[h & 0xf];
y[h & 0xf] = (y[h & 0xf] ^ (*e++)) + 0x3dbb2819;
y[h & 0xf] = (y[h & 0xf] ^ (*e++)) + fb;
h++;
}
}
Expand Down