Program.cs

using Mono.Cecil;
using Mono.Cecil.Cil;
using Mono.Cecil.Rocks;
using System;
using System.IO;
using System.Linq;
using System.Text;
using CommandLine;

namespace NetFuscator
{
    public class Options
    {
        [Option('f', "file", Required = true, HelpText = "Path to the assembly you want to obfuscate.")]
        public string file { get; set; }
        [Option('r', "resources", Required = false, HelpText = "(OPTIONAL) Path to a directory containing text files you want to use to adjust the assembly's entropy.")]
        public string resources { get; set; }
        [Option('n', "names", Required = false, HelpText = "(OPTIONAL) What you want the assembly's name to be. Defaults to a random eight-character string.")]
        public string assemblyName { get; set; }
    }

    public class Program
    {
        // --------------------------------------------------------------------------
        // Helpers
        // --------------------------------------------------------------------------

        private static readonly Random Rng = new Random();

        private static string RandomName(int length = 8)
        {
            const string chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
            var sb = new StringBuilder(length);
            // Always start with a letter so the identifier is always valid IL
            for (int i = 0; i < length; i++)
                sb.Append(chars[Rng.Next(chars.Length)]);
            return sb.ToString();
        }

        // --------------------------------------------------------------------------
        // Namespace / class renaming
        // --------------------------------------------------------------------------

        // Maps each distinct original namespace to a single randomly-generated
        // replacement so every type that used to live in the same namespace still
        // does after renaming.  Without this, each type would get its own unique
        // random namespace and dnSpy would show one namespace per type.
        private static readonly System.Collections.Generic.Dictionary<string, string> _namespaceMap
            = new System.Collections.Generic.Dictionary<string, string>(StringComparer.Ordinal);

        private static void ObfuscateNamespace(TypeDefinition type)
        {
            var original = type.Namespace ?? string.Empty;
            if (original.Length == 0) return; // global namespace — leave alone

            if (!_namespaceMap.TryGetValue(original, out var replacement))
            {
                replacement = RandomName();
                _namespaceMap[original] = replacement;
            }

            type.Namespace = replacement;
        }

        private static void ObfuscateClass(TypeDefinition type)
        {
            if (!type.IsClass) return;

            // Generic type names need to preserve the `N arity suffix (e.g., MyClass`1 for one type parameter). Without it, the metadata is malformed.
            if (type.HasGenericParameters)
            {
                type.Name = RandomName() + "`" + type.GenericParameters.Count;
                return;
            }

            type.Name = RandomName();
        }

        // --------------------------------------------------------------------------
        // Method renaming
        // --------------------------------------------------------------------------

        private static void ObfuscateMethods(TypeDefinition type, string entrypoint_namespace)
        {
            foreach (var method in type.Methods)
            {
                // Constructors must keep their names (.ctor / .cctor)
                if (method.IsConstructor) continue;

                // Skip special-named methods (get_X, set_X, add_X, op_X …)
                if (method.IsSpecialName || method.IsRuntimeSpecialName) continue;

                // Entry point must stay named Main
                if (method.Name == "Main") continue;

                // Virtual methods override a slot defined by a base class or interface.
                // Renaming them breaks the vtable contract.
                if (method.IsVirtual) continue;

                // Explicit interface implementations are also linked by name+signature
                // even when not marked virtual in the usual sense.
                if (method.Overrides.Count > 0) continue;

                // P/Invoke: the method name IS the native entry point unless
                // EntryPoint was set explicitly in [DllImport]
                if (method.IsPInvokeImpl) continue;

                // TODO: figure out how to handle renames of methods with generic paramaters (references aren't being updated properly)
                if (method.HasGenericParameters || method.DeclaringType.HasGenericParameters) continue;

                method.Name = RandomName();
            }
        }

        // --------------------------------------------------------------------------
        // Field / parameter renaming
        // --------------------------------------------------------------------------

        private static void ObfuscateVariables(TypeDefinition type)
        {
            // Enum value names are used by reflection — don't touch them
            if (type.IsEnum) return;

            // Fields (aka variables)
            foreach (var field in type.Fields)
            {
                if (field.IsSpecialName) continue;
                if (field.Name == "value__") continue; // enum backing field
                field.Name = RandomName();
            }

            // Method parameters
            foreach (var method in type.Methods)
            {
                if (!method.HasBody) continue;
                foreach (var param in method.Parameters)
                    param.Name = RandomName();
            }

            // Note: local variables have no names in IL (only in PDB debug info), so there's nothing to rename here.
            // Note: nested types are NOT renamed here. ProcessType recurses into them
        }

        // --------------------------------------------------------------------------
        // String literal obfuscation
        // --------------------------------------------------------------------------

        // The injected decoder method — created once per module before processing starts.
        private static MethodDefinition _stringDecoderMethod;

        private static void CreateStringDecoderMethod(ModuleDefinition module)
        {
            // Insert into dedicated non-generic type — can never collide with anonymous/generic types
            var decoderType = new TypeDefinition(
                "",
                RandomName(),
                TypeAttributes.Public | TypeAttributes.Sealed | TypeAttributes.Abstract,
                module.ImportReference(typeof(object)));

            module.Types.Add(decoderType);

            var method = new MethodDefinition(
                RandomName(),
                MethodAttributes.Assembly | MethodAttributes.Static,
                module.TypeSystem.String);

            method.Parameters.Add(
                new ParameterDefinition("s", ParameterAttributes.None, module.TypeSystem.String));

            var il = method.Body.GetILProcessor();

            // Build: new string(s.ToCharArray().Reverse())
            // Using ImportReference so Cecil emits correct assembly refs
            var toCharArray = module.ImportReference(typeof(string).GetMethod("ToCharArray", Type.EmptyTypes));
            var arrayReverse = module.ImportReference(typeof(Array).GetMethod("Reverse", new[] { typeof(Array) }));
            var stringCtorArr = module.ImportReference(typeof(string).GetConstructor(new[] { typeof(char[]) }));

            il.Emit(OpCodes.Ldarg_0);
            il.Emit(OpCodes.Call, toCharArray);
            il.Emit(OpCodes.Dup);
            il.Emit(OpCodes.Call, arrayReverse);
            il.Emit(OpCodes.Newobj, stringCtorArr);
            il.Emit(OpCodes.Ret);

            decoderType.Methods.Add(method);
            _stringDecoderMethod = method;
        }

        private static void ObfuscateStrings(TypeDefinition type)
        {
            foreach (var method in type.Methods)
            {
                if (!method.HasBody) continue;

                method.Body.SimplifyMacros();
                var il = method.Body.GetILProcessor();

                foreach (var instr in method.Body.Instructions.ToList())
                {
                    if (instr.OpCode != OpCodes.Ldstr) continue;
                    var original = (string)instr.Operand;
                    if (string.IsNullOrEmpty(original)) continue;

                    instr.Operand = new string(original.Reverse().ToArray());
                    var call = il.Create(OpCodes.Call, _stringDecoderMethod);
                    il.InsertAfter(instr, call);
                }

                method.Body.OptimizeMacros();
            }
        }

        // --------------------------------------------------------------------------
        // Per-type entry point
        // --------------------------------------------------------------------------

        private static void ProcessType(TypeDefinition type, string entrypoint_namespace)
        {
            // Recurse into nested types first
            foreach (TypeDefinition nested in type.NestedTypes)
            {
                ProcessType(nested, entrypoint_namespace);
            }

            // Skip compiler-generated types
            if (type.IsSpecialName || type.Name.StartsWith("<"))
            {
                return;
            }

            var root = type;
            while (root.DeclaringType != null)
            {
                root = root.DeclaringType;
            }
            
            if (root.Namespace == null || !root.Namespace.StartsWith(entrypoint_namespace))
            {
                return;
            }

            Console.WriteLine($"Obfuscating: {type.FullName}");

            ObfuscateMethods(type, entrypoint_namespace);
            ObfuscateVariables(type);
            ObfuscateNamespace(type);
            ObfuscateClass(type);
            ObfuscateStrings(type);
        }

        private static void RenameNamespacePrefix(ModuleDefinition module, string oldPrefix, string newPrefix)
        {
            // 1. Embedded resource streams
            foreach (var r in module.Resources)
            {
                if (r.Name.StartsWith(oldPrefix + "."))
                    r.Name = newPrefix + r.Name.Substring(oldPrefix.Length);
            }

            // 2. ldstr literals in EVERY method, including [CompilerGenerated] types
            //    (this is where the Resources.ResourceManager ctor string lives)
            foreach (var type in module.GetTypes())
            {
                foreach (var method in type.Methods)
                {
                    if (!method.HasBody) continue;
                    foreach (var instr in method.Body.Instructions)
                    {
                        if (instr.OpCode == OpCodes.Ldstr
                            && instr.Operand is string s
                            && s.StartsWith(oldPrefix + "."))
                        {
                            instr.Operand = newPrefix + s.Substring(oldPrefix.Length);
                        }
                    }
                }
            }

            // 3. Namespace field on the types themselves (cosmetic, but keeps things tidy)
            foreach (var type in module.GetTypes())
            {
                if (type.Namespace == oldPrefix || type.Namespace.StartsWith(oldPrefix + "."))
                    type.Namespace = newPrefix + type.Namespace.Substring(oldPrefix.Length);
            }
        }

        // --------------------------------------------------------------------------
        // Entropy measurement and adjustment
        // --------------------------------------------------------------------------

        private const double EntropyMin = 4.5;
        private const double EntropyMax = 5.5;
        private const int MaxEmbedAttempts = 500; // safety cap

        private static double ComputeShannonEntropy(byte[] data)
        {
            if (data == null || data.Length == 0) return 0.0;

            var counts = new long[256];
            foreach (var b in data) counts[b]++;

            double entropy = 0.0;
            double length = data.Length;
            for (int i = 0; i < 256; i++)
            {
                if (counts[i] == 0) continue;
                double p = counts[i] / length;
                entropy -= p * Math.Log(p, 2);
            }
            return entropy;
        }

        private static double MeasureAssemblyEntropy(AssemblyDefinition assembly)
        {
            using (var ms = new System.IO.MemoryStream())
            {
                assembly.Write(ms);
                return ComputeShannonEntropy(ms.ToArray());
            }
        }

        private static void AdjustEntropyWithResources(AssemblyDefinition assembly, string resourceDir)
        {
            var module = assembly.MainModule;

            // Queue of candidate text files. Shuffle so repeated runs don't produce
            // identical embedded resource sets.
            var candidates = System.IO.Directory
                .EnumerateFiles(resourceDir, "*.txt", System.IO.SearchOption.AllDirectories)
                .OrderBy(_ => Rng.Next())
                .ToList();

            if (candidates.Count == 0)
            {
                Console.Error.WriteLine($"Warning: no .txt files in '{resourceDir}' — skipping entropy adjustment.");
                return;
            }

            int attempts = 0;
            int candidateIndex = 0;

            while (attempts < MaxEmbedAttempts)
            {
                double entropy = MeasureAssemblyEntropy(assembly);
                Console.WriteLine($"  entropy = {entropy:F4} (target {EntropyMin}–{EntropyMax})");

                if (entropy >= EntropyMin && entropy <= EntropyMax)
                {
                    Console.WriteLine("  entropy in target range.");
                    return;
                }

                if (candidateIndex >= candidates.Count)
                {
                    Console.Error.WriteLine("  ran out of candidate files before reaching target entropy.");
                    return;
                }

                string file = candidates[candidateIndex++];
                byte[] bytes;
                try
                {
                    bytes = System.IO.File.ReadAllBytes(file);
                }
                catch (Exception ex)
                {
                    Console.Error.WriteLine($"  could not read {file}: {ex.Message}");
                    continue;
                }

                string resourceName;
                do
                {
                    resourceName = Guid.NewGuid().ToString("N");
                } while (module.Resources.Any(r => r.Name == resourceName));

                var embedded = new EmbeddedResource(resourceName, ManifestResourceAttributes.Private, bytes);
                module.Resources.Add(embedded);
                Console.WriteLine($"  embedded {System.IO.Path.GetFileName(file)} as '{resourceName}' ({bytes.Length} bytes)");

                attempts++;
            }

            Console.Error.WriteLine("  hit MaxEmbedAttempts cap without converging.");
        }

        // --------------------------------------------------------------------------
        // Assembly-level metadata scrubbing
        // --------------------------------------------------------------------------

        private static readonly string[] IdentityAttributesToStrip =
        {
            "AssemblyTitleAttribute",
            "AssemblyDescriptionAttribute",
            "AssemblyConfigurationAttribute",
            "AssemblyCompanyAttribute",
            "AssemblyProductAttribute",
            "AssemblyCopyrightAttribute",
            "AssemblyTrademarkAttribute",
            "AssemblyCultureAttribute",
            "AssemblyInformationalVersionAttribute",
        };

        private static void ScrubAssemblyMetadata(AssemblyDefinition assembly, string newName)
        {
            var module = assembly.MainModule;

            // Logical identity in the manifest
            assembly.Name.Name = newName;

            // PE-level module filename (what ildasm/dnSpy show as the module entry)
            module.Name = newName + (module.Kind == ModuleKind.Dll ? ".dll" : ".exe");

            // Module Version ID — a fresh GUID baked into the PE header
            module.Mvid = Guid.NewGuid();

            // Replace the [assembly: Guid("...")] typelib GUID blob with a new one.
            // Leaving the attribute present (rather than stripping it) preserves COM
            // interop surface area when the original assembly exposed types to COM.
            foreach (var attr in assembly.CustomAttributes)
            {
                if (attr.AttributeType.Name == "GuidAttribute" &&
                    attr.ConstructorArguments.Count == 1 &&
                    attr.ConstructorArguments[0].Type.FullName == "System.String")
                {
                    attr.ConstructorArguments[0] = new CustomAttributeArgument(
                        module.TypeSystem.String, Guid.NewGuid().ToString());
                }
            }

            // Strip identity-leaking attributes (title, company, copyright, etc.).
            // Version attributes are kept so the manifest version stays coherent.
            for (int i = assembly.CustomAttributes.Count - 1; i >= 0; i--)
            {
                if (IdentityAttributesToStrip.Contains(assembly.CustomAttributes[i].AttributeType.Name))
                    assembly.CustomAttributes.RemoveAt(i);
            }
        }

        // --------------------------------------------------------------------------
        // Entry point
        // --------------------------------------------------------------------------

        public static void Main(string[] args)
        {
            string inputPath = null;
            string resourcesPath = null;
            string newAssemblyName = null;

            Parser.Default.ParseArguments<Options>(args)
                .WithParsed(o =>
                {
                    inputPath = o.file;
                    resourcesPath = o.resources;
                    newAssemblyName = o.assemblyName;
                })
                .WithNotParsed(o =>
                {
                    Environment.Exit(1);
                });

            if (!File.Exists(inputPath))
            {
                Console.Error.WriteLine($"Error: file '{inputPath}' not found.");
                Environment.Exit(1);
            }

            if (resourcesPath != null && !Directory.Exists(resourcesPath))
            {
                Console.Error.WriteLine($"Error: directory '{inputPath}' not found.");
                Environment.Exit(1);
            }

            try
            {
                var readerParams = new ReaderParameters { ReadWrite = false, InMemory = true };
                var assembly = AssemblyDefinition.ReadAssembly(inputPath, readerParams);
                var module = assembly.MainModule;

                // Scrub assembly-level metadata (name, Mvid, GUID, identity attrs).
                if (newAssemblyName == null)
                {
                    newAssemblyName = RandomName();
                }
                ScrubAssemblyMetadata(assembly, newAssemblyName);

                string outputPath = newAssemblyName +
                    (module.Kind == ModuleKind.Dll ? ".dll" : ".exe");

                // Create the decoder helper once, before any type processing
                CreateStringDecoderMethod(module);

                string newPropertiesPrefix = RandomName() + ".Properties";
                string existingPropertiesPrefix = module.EntryPoint.DeclaringType.Namespace.Split('.')[0];
                RenameNamespacePrefix(module, $"{existingPropertiesPrefix}.Properties", newPropertiesPrefix);

                string entrypoint_namespace = module.EntryPoint.DeclaringType.Namespace;

                CustomAttributeHelper.BuildTypeMap(module);

                foreach (TypeDefinition type in module.Types)
                {
                    ProcessType(type, entrypoint_namespace);
                }

                CustomAttributeHelper.FixCustomAttributeTypeReferences(module);

                if (resourcesPath != null)
                {
                    AdjustEntropyWithResources(assembly, resourcesPath);
                }

                assembly.Write(Path.Combine(Directory.GetCurrentDirectory(), outputPath));

                Console.WriteLine($"Obfuscated: {inputPath}  ->  {outputPath}");
                Console.WriteLine("Done.");
            }
            catch (Exception ex)
            {
                Console.Error.WriteLine(ex.ToString());
            }
        }
    }
}