Prerequisites:
I saw I a lot of people playing around with mono.cecil and using it as obfuscation, and nearly no one here seems to use the alternative, dnlib. The goal of this thread is to teach you all about dnlib and show you how to "convert" or "port" the mono.cecil code to the dnlib equivalent. Please do not flame the thread. I know I am new here, but I have been coding for a few years, but I am just now starting to get into malware and things like that.
Dnlib Download: https://bitbucket.org/0xd4d/dnlib
Mono.Cecil Download: http://mono-project.com/Cecil
If you want to download Mono.Cecil, I think you need to install it, then go to the Program Files folder for it and copy the Mono.Cecil.dll file to a location where you want to use it. For Dnlib, I think you need to download the source and compile it yourself.
Tutorial:
First off you want reference the Dnlib library:
1. Once you have created a project, double-click on "My Project" in your Solution Explorer tab.
2. Then find and click the reference tab.
3. There then should be a button in that tab that says "Add." Click it.
4. Find your Dnlib.dll file and open it.
5. You have now referenced that library
Next Up, you will want to import the Dnlib library to your code:
![[Image: 7Qa2t.png]](https://puu.sh/7Qa2t.png)
Next, I am assuming all of you will want to load the file you are trying to edit:
Mono.Cecil Code:
Dnlib Code:
Next, you would want to loop through each class in the application. You also want to make sure that the Application has any class or namespaces:
Mono.Cecil Code:
Dnlib Code:
Next, this is what you do in order to loop through each method in a class or namespace. You would put this inside the class loop. Once again, you also want to make sure that the class has methods:
Mono.Cecil Code:
Dnlib Code:
Next, you may want to loop through each variable in a method, so here is what you would do inside of the method loop. And again, you need to make sure that your method has a body and has variables in the body:
Mono.Cecil Code:
Dnlib Code:
Renaming:
Renaming is basically just taking the loop variable and finding the name property and setting it to something else. I would also like to say that renaming classes, methods, and variables may cause your application to crash. You will need to make checks in your method to make sure you do not rename certain variables, methods, and classes.
Both Mono.Cecil Code and Dnlib Code
Summation:
As you can see, the code is nearly exactly the same for method loops and variable loops, so porting it was pretty easy. These libraries are not exactly the same. There are differences in the way they handle the executable when the file is loaded and saved. You can do basically everything you can do in dnlib that you can do in mono.cecil.
Final Notes:
If you want to take renaming even further, you can make loops to loop through other aspects of code such as Fields, Properties, and Resources. You also have to take into account if the method is a constructor, or is the names are Special Names or not. I do not want to hand everyone the code, so I will not be giving everyone the exact code. I hope this helps you all, and if you want me to add something to this, please tell me.
I saw I a lot of people playing around with mono.cecil and using it as obfuscation, and nearly no one here seems to use the alternative, dnlib. The goal of this thread is to teach you all about dnlib and show you how to "convert" or "port" the mono.cecil code to the dnlib equivalent. Please do not flame the thread. I know I am new here, but I have been coding for a few years, but I am just now starting to get into malware and things like that.
Dnlib Download: https://bitbucket.org/0xd4d/dnlib
Mono.Cecil Download: http://mono-project.com/Cecil
If you want to download Mono.Cecil, I think you need to install it, then go to the Program Files folder for it and copy the Mono.Cecil.dll file to a location where you want to use it. For Dnlib, I think you need to download the source and compile it yourself.
Tutorial:
First off you want reference the Dnlib library:
1. Once you have created a project, double-click on "My Project" in your Solution Explorer tab.
2. Then find and click the reference tab.
3. There then should be a button in that tab that says "Add." Click it.
4. Find your Dnlib.dll file and open it.
5. You have now referenced that library
Next Up, you will want to import the Dnlib library to your code:
Next, I am assuming all of you will want to load the file you are trying to edit:
Mono.Cecil Code:
Code
Dim aDef As AssemblyDefinition = AssemblyDefinition.ReadAssembly("PATH")Dnlib Code:
Code
Dim mdef As ModuleDefMD = ModuleDefMD.Load("PATH")Next, you would want to loop through each class in the application. You also want to make sure that the Application has any class or namespaces:
Mono.Cecil Code:
Code
If aDef.MainModule.HasTypes Then
For Each cls In aDef.MainModule.Types()
Next
End IfDnlib Code:
Code
If mdef.HasTypes Then
For Each cls In mdef.Types()
Next
End IfNext, this is what you do in order to loop through each method in a class or namespace. You would put this inside the class loop. Once again, you also want to make sure that the class has methods:
Mono.Cecil Code:
Code
If cls.HasMethods Then
For Each mthd In cls.Methods()
Next
End IfDnlib Code:
Code
If cls.HasMethods() Then
For Each mthd In cls.Methods()
Next
End IfNext, you may want to loop through each variable in a method, so here is what you would do inside of the method loop. And again, you need to make sure that your method has a body and has variables in the body:
Mono.Cecil Code:
Code
If mthd.HasBody() And mthd.Body.HasVariables() Then
For Each var In mthd.Body.Variables()
Next
End IfDnlib Code:
Code
If mthd.HasBody And mthd.Body.HasVariables Then
For Each var In mthd.Body.Variables()
Next
End IfRenaming:
Renaming is basically just taking the loop variable and finding the name property and setting it to something else. I would also like to say that renaming classes, methods, and variables may cause your application to crash. You will need to make checks in your method to make sure you do not rename certain variables, methods, and classes.
Both Mono.Cecil Code and Dnlib Code
Code
cls.Name = "BLAHBLAH"
mthd.Name = "BLAHBLAH"
var.Name = "BLAHBLAH"Summation:
As you can see, the code is nearly exactly the same for method loops and variable loops, so porting it was pretty easy. These libraries are not exactly the same. There are differences in the way they handle the executable when the file is loaded and saved. You can do basically everything you can do in dnlib that you can do in mono.cecil.
Final Notes:
If you want to take renaming even further, you can make loops to loop through other aspects of code such as Fields, Properties, and Resources. You also have to take into account if the method is a constructor, or is the names are Special Names or not. I do not want to hand everyone the code, so I will not be giving everyone the exact code. I hope this helps you all, and if you want me to add something to this, please tell me.
