.NET Patcher library using dnlib.
[
The constructor takes the filename of the assembly.
Patcher patcher = new Patcher("Test.exe");All methods take an object called Target as argument. The object is defined as follows:
public string Namespace { get; set; } // needed
public string Class { get; set; } // needed
public string Method { get; set; } // needed
/* If you want to patch multiple indexes in the method */
public int[] Indexes { get; set; }
public Instruction[] Instructions { get; set; }
/* If you want to patch 1 index in the method */
public int Index { get; set; } = -1;
public Instruction Instruction { get; set; }
/* If the path to the method has more than 1 nested class use this */
public string[] NestedClasses { get; set; }
/* If the path to the method has 1 nested class use this */
public string NestedClass { get; set; }Please make sure that you don't assign inconsistent values, e.g.
var target = new Target
{
Instructions = ...
Instruction = ...
}If you want to patch multiple methods create a Target[] and pass it to the functions, it is accepted by the most of them.
Reference dnlib and create an Instruction[] or Instruction with your Instruction(s) and assign Indexes (int[]) or Index with the indexes where the Instructions are. You can find them by reverse engineering your assembly via dnSpy or some other decompiler.
Small Example:
Instruction[] opCodes = {
Instruction.Create(OpCodes.Ldstr, "Hello Sir 1"),
Instruction.Create(OpCodes.Ldstr, "Hello Sir 2")
};
int[] indexes = {
0, // index of Instruction
2
};
Target target = new Target()
{
Namespace = "Test",
Class = "Program",
Method = "Print",
Instructions = opCodes,
Indexes = indexes
};To clear the whole methodbody and write your instructions, make sure that you don't assign the Indexes or Index property.
Here is an example:
Instruction[] opCodes = {
Instruction.Create(OpCodes.Ldstr, "Hello Sir"), // String to print
Instruction.Create(OpCodes.Call, p.BuildMemberRef("System", "Console", "WriteLine")), // Console.WriteLine call -> BUILDMEMBERREF IS ONLY FOR CONSOLE.WRITELINE
Instruction.Create(OpCodes.Ret) // Alaway return smth
};
Target target = new Target()
{
Namespace = "Test",
Class = "Program",
Method = "Print",
Instructions = opCodes
};To apply your modified instructions you can call the method 'Patch':
patcher.Patch(Target);or
patcher.Patch(Target[]);In some cases it might be useful to have find an instruction within a method, for example if the method got updated.
Instruction opCode = Instruction.Create(OpCodes.Ldstr, "TheTrain");
Instruction toFind = Instruction.Create(OpCodes.Ldstr, "TheWord");
Target target = new Target()
{
Namespace = "Test",
Class = "Program",
Method = "FindMe",
Instruction = opCode // you can also set it later
};
target.Index = p.FindInstruction(target, toFind);
// now you have the full Target objectLet's say there are multiple identical instructions. What now, baoss? Well, it's simple. There's an overload that takes and int which is the occurence of the instruction which you'd like to find.
Instruction opCode = Instruction.Create(OpCodes.Ldstr, "TheTrain");
Instruction toFind = Instruction.Create(OpCodes.Ldstr, "TheWord");
Target target = new Target()
{
Namespace = "Test",
Class = "Program",
Method = "FindMe",
Instruction = opCode // you can also set it later
};
target.Index = p.FindInstruction(target, toFind, 2); // Sir, find the second occurence!In some cases it might be easier to just replace an instruction. At this point of development, it doesn't make much sense, but the features will come soon.
Instruction opCode = Instruction.Create(OpCodes.Ldstr, "I love kittens");
Target target = new Target()
{
Namespace = "Test",
Class = "Program",
Method = "ReplaceMe",
Instruction = opCode,
Index = 0
};
p.ReplaceInstruction(target);Let's say you want to remove instructions... Well it's simple as this:
Target target = new Target()
{
Namespace = "Test",
Class = "Program",
Method = "RemoveMe",
Indexes = new[]{0,1} // the indexes, you can also just use 'Index'
};
p.RemoveInstruction(target);Hmmm.... What if you find the console output offending? You can modify the Ldstr without even creating an instruction :)
Target target = new Target()
{
Namespace = "Test",
Class = "Program",
Method = "PrintAlot",
Index = 0
};
p.PatchOperand(target, "PatchedOperand"); // pass the Target and a string to replaceor incase you need to modify an int:
p.PatchOperand(target, 1337);It is also able to patch multiple operands in the same method by using int[] or string[].
If you want to safe the assembly under a different name use this:
patcher.Save(String); // filename hereOr if you want to replace the original file:
patcher.Save(bool); // if true it will create a backup first (filename.bak)This part is in heavy development right now. The main purpose is to find a method and patch the instructions without the need of knowing the names incase the namespaces, etc are renamed via an obfuscator.
Create an Object called 'ObfuscationPatcher':
var op = new ObfuscationPatcher(string, bool);
// string: filename
// bool: keep old max stack?Let's say the strings are not encrypted (I'm talking about Ldstr here):
string[] operands = {
"Find",
"TheWord",
"The",
"Word",
"You",
"Wont"
}; // Find there words within the method.
Target[] obfuscatedTargets = op.FindInstructionsByOperand(operands); // let the boi work. It will return an Target[] with all methods he could find.
foreach (var obfTarget in obfuscatedTargets) // Let's iterate and have fun
{
obfTarget.Instructions = new Instruction[]
{
Instruction.Create(OpCodes.Ldstr, "Obfuscator"),
Instruction.Create(OpCodes.Ldstr, "Got"),
Instruction.Create(OpCodes.Ldstr, "Rekt"),
Instruction.Create(OpCodes.Ldstr, "Hell"),
Instruction.Create(OpCodes.Ldstr, "Yeah"),
Instruction.Create(OpCodes.Ldstr, "!")
}; // modify the instructions
}
op.Patch(obfuscatedTargets); // Patch the instructionsLet's say you look for an OpCode, you can do this:
op.FindInstructionsByOpcode(new[] {OpCodes.Add}) // NOT TESTEDAs before you will just do this:
op.Patch(Target); // Patch the instructions
// or
op.Patch(Target[]); // Patch multiple targetsAgain, as before :)
op.Save(string); // string -> filename
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent