Obfuscation Engine Execution Order

BitMono uses its own obfuscation execution order which is good to be known, and it reminds ConfuserEx a lot, if you’re familiar with it you can be easier with it.

  1. Output Loaded Module Info

  2. Sort Protections

  3. Basic output information about Protections

  4. Elapsed time counter

  5. Output Information of Running Framework

  6. Resolve References

  7. Expand Macros

  8. Run Protection, PipelineProtection and child pipeline protections

public class StandardProtection : Protection

public class Pipeline : PipelineProtection

  1. Optimize Macros

  2. [ObfuscationAttribute] cleanup

  3. Create PE Image

  4. Write Module

  5. Run Packers

public class Packer : PackerProtection

  1. Output Elapsed Time since obfuscation