Question Dotfuscator causes program to crash

[DragonQ]

I've used the Enhanced Community Edition of Dotfuscator on two of my programs that work together. At first, neither worked but then I realised that using System.Reflection was causing problems with one of the programs and I've now fixed that.

However, I have no idea where to start looking for problems in my other program. It uses a WQLEventQuery to watch for stopping processes and it works fine when it hasn't been put through Dotfuscator. As you can see, I've put in a debug message box so I know this code is being run through. However, when Dotfuscated, no message boxes ever show when I end a process, so presumably this code is not running:

            Dim WQLEventQuery As New WqlEventQuery("__InstanceDeletionEvent", New TimeSpan(0, 0, 0, 1, 0), "TargetInstance ISA 'Win32_Process'")
            Dim Watcher As New ManagementEventWatcher(WQLEventQuery)
            Dim EventObject As ManagementBaseObject = Watcher.WaitForNextEvent()
            MessageBox.Show("-11")
            Watcher.Stop()
            Watcher.Dispose()
            EventObject.Dispose()

There is an additional piece of code that checks if the closing program matches a specific program in a list, and if it does, my program should exit. But when Dotfuscated, it just crashes whenever the closing program matches a program on the list. There's no error message, it's just a generic Windows fatal error. If I choose to debug it, VS 2008 opens, says "cannot find the file specified" and closes again - I have no idea if this is to do with my program or VS 2008.

So....where do I start trying to fix this problem? I can't figure out how to get more information about the problem, let alone fix it. Apart from System.Reflection, are there any other things that I might be using that are known not to work with Dotfuscator?

Thanks for any help.

 

[Stonkie]

From what I understand, __InstanceDeletionEvent is the name of a class or class member? Obsfucation messes with the names of everything, yet this __InstanceDeletionEvent isn't referenced directly, but bound at run time.

My guess is it cannot find that __InstanceDeletionEvent because the name was messed with by the obfsucation. Can you post the Exception type, message and stack trace?

You should try to either bind it at compile time so the obsfucator knows this is bound to the field it messes with (maybe WqlEventQuery has a constuctor that takes a reference to the method to use instead of its name?) or maybe something like this :

GetType(__InstanceDeletionEvent).Name

EDIT : I looked up the class names you provided and __InstanceDeletionEvent is from a dll provided by microsoft so it should not be obsfucated by the utility you use so it is unlikely this is the problem... Provide the Exception information and maybe it will give some insight.

 

[DragonQ]

"__InstanceDeletionEvent" is just a string in my code. If Dotfuscator messed with strings, no programs it was ever applied on would work. Are you saying that the string reference that WQLEventQuery is expecting might be being changed?

Also, I cannot post any information about the exception because there is no information presented to me. That's why I have no idea what to do.

 

[Stonkie]

Nah, it doesn't mess with string, but it messes with class names. Anyway, I haven't used obsfucation, but that's my understanding. And I think the WqlEventQuery constructor matches the string you give it with the class name. However, only the class name was changed and not the string, so they do not match anymore!

But it should not mess with class names in dlls that are not in your projects and if I understand correctly, __InstanceDeletionEvent is not defined in your project and should not be messed with.

You can try surrounding the lines of code with a try catch block, catching the exception that is thrown and outputing the message and type from it into a message box. I guess the stack trace would be useless since it is obsfucated, but we can at least get the message and maybe the exception type...

In any case, I'm trying my best to help you, but I must admit I never used obsfucation so my knowledge on the matter is limited...

 

[JohnH]

You mean if I use the code MsgBox("hello world") and obscuis it it would say "nah Stonkie" in runtime?

 

[DragonQ]

Unfortunately I did already try putting message boxes everywhere around this code to see where it was failing but none of the message boxes ever appear. It just has a fatal error.

 

[Stonkie]

You mean if I use the code MsgBox("hello world") and obscuis it it would say "nah Stonkie" in runtime?

Nope, but MsgBox(GetType(MyCustomClass).Name) might because it changed the name of MyCustomClass. Actually, I'm not even sure of that one, as I said, I didn't use obsfucation, I just thought it might be potential source for the error that you try to bind the class name with a literal string at run time because the class name is obsfucated and thee string remains as is.

Unfortunately I did already try putting message boxes everywhere around this code to see where it was failing but none of the message boxes ever appear. It just has a fatal error.

Even a message box before any of that code won't appear? Does the executable even run? What it the latest point at which you can show a message box?

 

[JohnH]

Nope, but MsgBox(GetType(MyCustomClass).Name) might because it changed the name of MyCustomClass.

It can't do that, because it can't recompile referenced assemblies, ie if you declare a variable as type String it can't change that to type alskjfhasdf.

 

[DragonQ]

Even a message box before any of that code won't appear? Does the executable even run? What it the latest point at which you can show a message box?

I don't know but none of the message boxes in the code that deals with processes ever appear. The executable does run but clearly most of it isn't doing anything for some reason.