Capture in Apr. 2024, BitMono’s latest version of pre-release as v0.20.1-alpha.36 provides 16 protection.
| PROTECTIONS | DESCRIPTION | LIMITATION |
|---|---|---|
| AntiILdasm | Protection adds [SuppressIldasmAttribute] which prevents the Ildasm (IL Disassembler) from disassembling the protected file. | |
| AntiDe4dot | Protection adds multiple attributes of known obfuscators/protectors and as a result fools de4dot. | Due to protection is not really powerful and widely known by most reversers and skids, on GitHub you may see a lot of solutions to destroy this protection. |
| BitDotNet | The protection uses dnlib exploit and modifies the file metadata (PE) to make it unrecognizable for dnSpy, as the result, at first sight, it will look like not a .NET file, for example, a C++ file. Mono doesn’t care about the thing which dnlib care about, and because of that it does what it does. | This protection compatible only with Mono. |
| BitMono | Protection modifies the file metadata (PE) to make it unrecognizable for decompilers or other tools such as Detect It Easy, as the result most of the tools will be fooled to think that this is an MS-DOS Executable as Detect It Easy does, decompilers will just not be able to open it up. Mono doesn’t care about the things which decompilers/tools care about, and because of that it does what it does. | This protection compatible only with Mono. |
| BitTimeDateStamp | Protection modifies the file metadata (PE) and erases the TimeDateStamp, as the result no one will be able to know when this file was compiled. | |
| BitMethodDotnet | Protection adds invalid IL code in the file, as the result in the old dnSpy version it’s going to be harder to see the C# code of the method body. | This protection compatible only with Mono, but, as far as is known this protection can be used in old versions of .NET Framework, but literally not with .NET Core, etc. |
| AntiDecompiler | Protection looks for a nested type in and sets non-public accessibility attributes, according to ECMA CIL standard nested types should always have one of them applied, but Mono doesn’t care about this standard. That means if someone will try to analyze the protected nested type, dnSpy will crash, however in a newer version, this exploit was fixed. | This protection compatible only with Mono. |
| AntiDebugBreakpoints | Protection adds things in method bodies that check if from the last execution passed more than the const value, then as a result the program will be crashed. | |
| CallToCalli | Protection replaces call opcode to calli and calls method by its function pointer. | This protection doesn’t work the same way as ConfuserEx Bed’s Mod, it works absolutely differently, as you may know in Confuser’s mod their CallToCalli won’t work on Mono, this version of protection works fine with both .NET and Mono. |
| DotNetHook | Protection hooks methods, as a result, will call empty methods but, in fact, a completely different method will be called (the original one). | |
| FullRenamer | Protection renames types/methods/fields, however, ignores things such as reflection, Unity Methods (Update/FixedUpdate/LateUpdate, i.e all of them), overrides from Thanking (OV_methodName), and the most popular frameworks for plugin development in Unturned and Rust on GitHub - RocketMod, OpenMod, and rust-oxide-umod, you even could specify your methods/types to ignore. If you want you can easily configure criticals.json to ignore strings and lot of stuff. Be careful, because renamer is tricky protection, not always useful, and does not always work properly. But, if you configure BitMono correctly Renamer can be a great protection (I’m about big projects, not crackmes). | |
| ObjectReturnType | Protection changes the nonvoid method return types to object return types. | |
| StringsEncryption | Protection encrypts strings using basic AES encryption, but not everyone like it because it makes the worse performance of application, but can be used with AntiDecompiler to crash dnSpy while analyzing the used class, also makes the RVA of the byte[] 0 | This protection slows down the application a lot. |
| UnmanagedString | Protection creates native method with assembly code and protects strings only that can be encoded with Windows-1252 encoding. | This protection is only compatible with .NET Framework and .NET Core, and doens’t work with Mono. |
| NoNamespaces | Protection removes all namespaces. | |
| BillionNops | Protection adds a new dummy method in the Module and then adds 100.000 nop instructions, and ret at the end. As a result when someone will try to analyze this method will cause a crashed dnSpy, and it will lead a reverse engineer install old dnSpy or use a IDE/VS Code/LinqPad with installed AsmResolver or dnlib to remove this method. | Be careful because this protection will increase a file size a lot, and a bigger file size will cause more questions by users, most of us when see a big file size think that this file is obfuscated. |