Variant9

On some older controllers, the joysticks may not be in perfect shape anymore and be a bit off-center. A deadzone would fix unwanted inputs.

"hex(ord(...))" not needed on lines 65 and 66

5

The following code is line 64, 65 and 66 from the main .py file: ```py3 for c in range(l - 1): declare += str(payload[c]) + ", " declare += str(payload[l...

Process hollowing

4

I've seen this in practice before. Hollowing an external or the own process would be a neat packer. For more see [this](http://www.autosectools.com/Process-Hollowing.pdf). **EDIT:** This seems to be called RunPE.

Allow choosing between implicit operators and methods for MemoryProtection.

2

Right now MemoryProtection uses [implicit operators](https://github.com/HoLLy-HaCKeR/Confuser.Protections.HoLLy/blob/master/Confuser.Protections.HoLLy.Runtime/AntiMemoryEditing/ObfuscatedValue.cs#L20) to normal values to obfuscated values. Using methods instead of implicit operators adds an additional bit of obfuscation.

Fix type marking in MemoryEditInjectPhase

2

Calling name.Analyze on one of the types returned from the type injection results in a null reference exception somewhere in VTable analyzer code.

Expose managed DLL injector when not connected to a process

1

This already exists, but only in debug builds.

I should investigate whether it is possible to optimize/deobfuscate the IL that is fed into the decompiler, to allow for cleaner decompilation output. Preferably, the following optimizations should take place:...

Currently, the CFG often gets put at the top left corner of the tab instead of at the center. This may require some WPF (debugging) knowledge to fix.

Disassembly of single jmp near instruction will (incorrectly?) read too many instructions

1

Not entirely sure if this is a bug on my part, a bug in echo, or no bug at all. Example of incorrect disassembly: ``` 000FB550 E9AB5A0400 jmp near ptr...

For long CFG blocks, the bottom seems to get cut off due to the block not being drawn large enough.