• Smaller File size:
  In version 2.0 the file size of Output.exe is dramatically reduced. From about 450 KB to just 23-26 KB. This is done by not including dnlib in the Crypted.exe anymore.
  


• New payload injection method:
  In version 2.0 we no longer use junk methods for our encryption overhead. We don't encrypt to the method space anymore at all. Instead we encrypt to base64 encoded strings and inject them into the file, then we replace the code in the methods we encrypted with stack neutral junk code. Using a binary patching method that I created.
  


• Output.exe no longer has to copy it's self to the temp directory to open it's self with dnlib because we don't use dnlib in Output.exe anymore. We just use memory offsets now.
  


• Now that there is real code in our methods, the JIT compiler gets ahead of us compiling code we don't want compiled yet, so I had to add the Force Re-JIT section to the dialog.
  ForceReJit is the name of a method we use in Crypted Demo.exe, and all it does is force the Just In Time compiler to recompile code when we want it to.
  ForceReJit would break if Randomize Method Names was checked, so I had to fix that.
  So now in Method Crypter.exe, if you have Randomize Method Names Checked and Force Re-JIT contains a method name, it goes into your file, finds the Force Re-JIT method name string, and renames it to the new random method name string so that Force Re-JIT still works even when Randomize Method Names is checked. (I hope you can make some sense of that explanation.)
  


• No longer detected as a virus by Windows Defender! At the time of me writing this (10/26/2025) this method is not detected as a virus and is safe to use in your programs for encryption/obfuscation, or whatever your reason is.
  

(Oct 26, 2025 07:43 AM)nodes Wrote:  At quick glance, I couldn't find anything malicious in the repo. Looks good to me from what I did review. GL with the project OP!

the commit base I reviewed:
https://github.com/PhillyStyle/Method-Crypter-DEMO-2/commit/e5cf883398f849be2f7c4866d01ea3f7b1624656

If you believe in security, please support my site suggestion & use commit URLs in your posts!!

https://hackforums.net/showthread.php?tid=6310370

(Oct 26, 2025 08:55 AM)PhillyStyle Wrote:  Thanks I added the URL to the post if that is OK with you. 😎

(Oct 26, 2025 08:56 AM)nodes Wrote:  nah don't say reviewed by me because I didn't go through every single possible line :)
but ill leave my reply there , I just looked it over and nothing seemed weird but I only do official code reviews for $$ ;)