Rule Inheritance & Order

Mar 14, 2013 at 8:02 AM
Can someone please explain how are Rules inherited and what order to put in them.

For Example:
I have a Project containing A.exe, B.dll & c.dll, having Namespaces ANS, BNS & CNS respectively.
I made a rule with pattern ___.*___ and included a set to Confusions, including Invalid Metadata Confusion.

Now I need to exclude Assembly B from the Invalid Metadata Confusion. I added a new rule with pattern __BNS\..*__ and added the Invalid Metadata Confusion but set it as remove.

When I compile, the Invalid Metadata Confusion is still executed.
Coordinator
Mar 30, 2013 at 9:47 AM
Hi,
You can refer to method ApplyRules in Confuser.Core/Marker.New.cs to have a detailed look of the rule apply process.
The rule string is a Regular Expression which is used to match the signature of the items.
For assembly, the signature is like "[Assemly Name]"
For module, the signature is like "[File Name]
For types, the signature is like "[Assembly Name]![Namespace].[Name].[Nested Type Name]"
For methods, the signature is like "[Declaring Type Sig].[Name]([Param 1 Type], [Param 2 Type]...) : [Return Type]"
For fields, the signature is like "[Declaring Type Sig].[Name] : [Field Type]"
For methods, the signature is like "[Declaring Type Sig].[Name]([Index 1 Type], [Index 2 Type]...) : [Property Type]"
For events, the signature is like "[Declaring Type Sig].[Name] : [EventType]"
For a item, the marker will go through all rules and try to match it in order. For each rules matched, it will try to applied the corresponding settings. If the rule does not have 'Inherit' flag set, it will discard all settings previously applied. So order is important.
But note that some confusions cannot be applied to all kind of items, like AntiDump, AntiTamper, InvalidMd. They can only be applied to modules. You can check what is the target of a confusion by checking the Target proerty.

In your case, the first rule should be .* with [Add, Invalid Metadata Confusion] and the second rule should be B.dll with [Remove, Invalid Metadata Confusion]
Apr 3, 2013 at 4:54 PM
Hi

First of all I would like to thank you for the reply and the brilliant product your contributing.

Is it possible to have a simple example adjacent to each regex signature?
Does it make a difference in the signature if the project is written in VB or C# ?

Thanks again
Coordinator
Apr 4, 2013 at 6:11 AM
Take PresentationFramework.dll as a example:
Assembly : "PresentationFramework"
Module : "PresentationFramework.dll"
Type : "PresentationFramework!System.Windows.Application"
Method : "PresentationFramework!System.Windows.Application.Run(Window) : Int32"
Fields : "PresentationFramework!System.Windows.Window.IconProperty : DependencyProperty"
Property : "PresentationFramework!System.Windows.ResourceDictionary.Item(Object) : Object"
Event : "PresentationFramework!System.Windows.Application.Exit : ExitEventHandler"
The signature will not have any difference between C# and VB.
The type names are following the standard type name of .NET Framework, like "int" in C# and "Integer" in VB both refers to System.Int32 in .NET Framework.
Apr 4, 2013 at 8:05 AM
Thanks for the examples.

In the Method example, the [Declaring Type Sig.] is written in full, whilst the [Return Type] is not. Can the Full name be omitted or the Regex must cater for it?

Can I get the regex text of a particular Property / Method by using .Net Reflector and analysing it? Is there any other way?

Thanks

JP