Confusor.Runtime

[sammynage]

Hi all, Is there a reason why there is a reference set to Confuser.Runtime after obfuscation?

Anyway we can stop this from happening?

Thanks!

[sammynage]

So, to give a bit more context, if you try and obfuscate a dll, with the following project file:

  <rule pattern="true">
    <protection id="constants" />
    <protection id="rename">
      <argument name="mode" value="sequential" />
      <argument name="flatten" value="true" />
    </protection>
  </rule>
  <module path="example.dll" snKey="C:\mykey.snk" >
    <rule pattern="true" preset="minimum" inherit="false">
      <protection id="anti ildasm" action="remove"/>
      <protection id="anti tamper" action="remove"/>
      <protection id="ctrl flow"/>
      <protection id="anti dump" action="remove"/>
      <protection id="anti debug" action="remove"/>
      <protection id="ref proxy" />
      <protection id="rename" />
      <protection id="invalid metadata" action="remove" />
    </rule>
  </module>

The obfuscated example.dll has a reference set to Confuser.Runtime, thus, you can't use the example.dll.

[ElektroKill]

It’s because of the XorshiftConstants class, The injector only knows how to inject one class and if it finds a reference to a different one it adds the module containing the class to references.

Solution: make the XorshiftConstants class be part of the Constants class