System.BadImageFormatException: Invalid DOS signature

[StevenKrahforst]

[2022-12-10 03:33:20 INF][BitMono.Obfuscation.BitMonoEngine] Loaded Module [REDACTED]
[2022-12-10 03:33:20 WRN][BitMono.Obfuscation.ProtectionsExecutionNotifier] Skip protections: AntiAssemblyEditing, FieldsHiding, NoNamespaces, ControlFlow, HideMethods, NullInstanceMethodCall, Tests, InvalidMetadata
[2022-12-10 03:33:20 INF][BitMono.Obfuscation.ProtectionsExecutionNotifier] Execute protections: AntiILdasm, AntiDe4dot, ObjectReturnType, FullRenamer, AntiDebugBreakpoints, StringsEncryption, DotNetHook, CallToCalli, BitMethodDotnet, BitDotNet
[2022-12-10 03:33:20 INF][BitMono.Obfuscation.ProtectionsExecutionNotifier] Execute only at the end: CallToCalli, BitMethodDotnet, BitDotNet
[2022-12-10 03:33:20 INF][BitMono.Obfuscation.BitMonoEngine] Preparing to protect module: [REDACTED]
Something went wrong! System.BadImageFormatException: Invalid DOS signature
   bei dnlib.PE.ImageDosHeader..ctor(DataReader& reader, Boolean verify)
   bei dnlib.PE.PEInfo..ctor(DataReader& reader, Boolean verify)
   bei dnlib.PE.PEImage..ctor(DataReaderFactory dataReaderFactory, ImageLayout imageLayout, Boolean verify)
   bei dnlib.DotNet.MD.MetadataFactory.Load(Byte[] data, CLRRuntimeReaderKind runtime)
   bei dnlib.DotNet.ModuleDefMD.Load(Byte[] data, ModuleCreationOptions options)
   bei dnlib.DotNet.AssemblyDef.Load(Byte[] data, ModuleCreationOptions options)
   bei BitMono.Core.Protecting.Resolvers.BitMonoAssemblyResolver.ResolveAsync(CancellationToken cancellationToken)
   bei BitMono.Obfuscation.BitMonoObfuscator.<StartAsync>d__7.MoveNext()
   bei System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   bei System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   bei BitMono.Obfuscation.BitMonoEngine.<ObfuscateAsync>d__6.MoveNext()
   bei System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   bei System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   bei Program.<Main>d__2.MoveNext()

Happens on every DLL for a Unity Game (Beat Saber) with either .NET Framework 4.7.2 or .NET Framework 4.8

[StevenKrahforst]

I guess it fails to load one of the Game Assemblies from the Managed Directory (which I copied into the libs folder)

[sunnamed434]

Perhaps I was a little hasty with the bug label, but, looks like the module that you're trying to protect has a dead DOS signature and dnlib doesn't like it, if you are able to do that you can pin your module as a file unless it harms your safety or send it to my mail ([email protected]) then I will check what's wrong with that. As I can see in dnlib sources it checks the first 2 bytes of the loading module it is MZ, which means your module doesn't even have it - if correct PE metadata is not caring you I can update dnlib sources and ignore verifying the metadata correctly.

Probably Unity Game (Beat Saber) have their custom protection which removes MZ and I think this is not the only thing that they're removing.

[StevenKrahforst]

What would be good though to see which DLL causes the throw of that Exception

[sunnamed434]

What would be good though to see which DLL causes the throw of that Exception

I will add what DLL was resolved or not at the moment the problem goes by [REDACTED] Module, but I could be wrong. Can you send this file, please?

[StevenKrahforst]

It's actually not the DLL I want to obfuscate, it's one of the Managed game files, just deleted a bunch of unnecessary and it worked

[sunnamed434]

It's actually not the DLL I want to obfuscate, it's one of the Managed game files, just deleted a bunch of unnecessary and it worked

Great that problem is solved, I will bump to the new version soon also, probably the file you tried to obfuscate was an ELF file for Linux OS and not a PE.

[sunnamed434]

New version v0.4.2-alpha.11 has been pre-released, you could try to do the same things that you tried to do you will get more info about that, also protections much improved there =)

If there are no plans to continue this issue you can close it.

[sunnamed434]

Idk why but I'm started getting the same issue after much obfuscating.
Logs:

[2022-12-12 03:48:00 INF][BitMono.Obfuscation.BitMonoEngine] Loaded Module PluginRocketMagic.dll
[2022-12-12 03:48:01 WRN][BitMono.Obfuscation.ProtectionsExecutionNotifier] Skip protections: AntiDe4dot, AntiDebugBreakpoints, AntiILdasm, BitDotNet, BitMethodDotnet, CallToCalli, FieldsHiding, FullRenamer, NoNamespaces, StringsEncryption
[2022-12-12 03:48:01 INF][BitMono.Obfuscation.ProtectionsExecutionNotifier] Execute protections: ObjectReturnType, DotNetHook, BitTimeDateStamp
[2022-12-12 03:48:01 INF][BitMono.Obfuscation.ProtectionsExecutionNotifier] Execute only at the end: BitTimeDateStamp
[2022-12-12 03:48:01 INF][BitMono.Obfuscation.BitMonoEngine] Preparing to protect module: C:\Users\cetni\source\repos\PluginRocketMagic\PluginRocketMagic\bin\Release\net472\Mod_source.dll
Something went wrong! System.BadImageFormatException: Invalid DOS signature
   at dnlib.PE.ImageDosHeader..ctor(DataReader& reader, Boolean verify)
   at dnlib.PE.PEInfo..ctor(DataReader& reader, Boolean verify)
   at dnlib.PE.PEImage..ctor(DataReaderFactory dataReaderFactory, ImageLayout imageLayout, Boolean verify)
   at dnlib.DotNet.MD.MetadataFactory.Load(Byte[] data, CLRRuntimeReaderKind runtime)
   at dnlib.DotNet.ModuleDefMD.Load(Byte[] data, ModuleCreationOptions options)
   at dnlib.DotNet.AssemblyDef.Load(Byte[] data, ModuleCreationOptions options)
   at BitMono.Core.Protecting.Resolvers.BitMonoAssemblyResolver.ResolveAsync(CancellationToken cancellationToken)
   at BitMono.Obfuscation.BitMonoObfuscator.<StartAsync>d__7.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at BitMono.Obfuscation.BitMonoEngine.<ObfuscateAsync>d__6.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Program.<Main>d__2.MoveNext()

[sunnamed434]

Looks like a memory bug idk, something is not disposed yet, I'm also disabled most of the dnlib checks for the DOS header and NT Header (PE). The problem is not in protections.

[StevenKrahforst]

Also though that. I think it is cause too many assemblies are loaded or too many references to them.

[sunnamed434]

Very strange, after moving all files to another directory and deleting the same libraries in the working directory it works!

[sunnamed434]

So, I made big changes in the new version of BitMono, probably this problem will never happen again, so let this issue be alive for a while