This is the AwaitFuscator; a .NET binary-to-binary obfuscator that translates your code into long chains of await
expressions:
For more details on how it works, check the FAQ or read the accompanied blog post.
This project depends on a few other projects. Make sure you have all submodules cloned:
$ git clone --recursive https://github.com/Washi1337/AwaitFuscator.git
If you accidentally didn't clone the submodules, you can go to your repository directory and run the following instead:
$ git submodule update --init
Then, just compile using your favourite IDE like Visual Studio or JetBrains Rider, or run the following:
$ dotnet build
The binaries will then appear in src/AwaitFuscator/bin
.
To awaitfuscate a program, simply run Awaitfuscator with the path of the binary to obfuscate:
$ AwaitFuscator [path]
If everything goes well (which is a big "if"), this will create a folder called Obfuscated
in the parent directory of the input file containing the output.
For example:
$ AwaitFuscator /path/to/file.exe
will produce a file at /path/to/Obfuscated/file.exe
.
C# allows for custom awaiters to be defined on any type using custom GetAwaiter
extension methods and custom awaiter types.
These awaiter types define a method called GetResult
can contain any code you want.
Awaitfuscator locates all "awaitifiable" methods in the input binary, and creates for each statement a new awaiter with the original statement's code moved into its GetResult
method.
Then, by defining custom GetAwaiter
extension methods, it is possible to await the custom awaiters, and thus chain a bunch of awaiters together.
This effectively rewrites the entire method body as one long chain of awaits.
For more details, read the accompanied blog post.
Is the code in the output binary really hidden?
No. The original code is still more or less there, just slightly rewritten and scattered around the assembly in different places. Awaitfuscator just plays a bunch of tricks that confuses decompilers a lot.
For more details, read the accompanied blog post.
You could. Not sure if it is a good idea though.
Probably not.
- ... crashes,
- ... produces errors I don't understand,
- ... corrupts my files,
These are very likely to happen as this is more of a proof of concept rather than a finalized product. Nonetheless, bug reports are appreciated :).