BitMono Obfuscator

BitMono is a free, open-source C# obfuscator designed primarily for Mono, but compatible with various .NET environments including .NET Framework, .NET, and Unity Engine. It uses AsmResolver for assembly handling.

BitMono aims to break common reverse-engineering tools such as dnSpy, dnlib, AsmResolver, MonoCecil, ILSpy, PEBear, DetectItEasy, and CFF Explorer through various protection layers.

Key characteristics of an obfuscated application include:

• Appearing as a C++ application while remaining a C# application.
• Causing decompilers to crash or break when analyzing types.
• Breaking IL code and making types invisible or resulting in 'no code' visibility.

BitMono is a versatile obfuscation tool designed for protecting .NET assemblies. It can be used as a standalone tool for quick obfuscation (via a two-click process) or integrated as an engine to build custom obfuscation solutions for specific plugins or purposes.

Many technical questions regarding assembly manipulation in BitMono are addressed by the AsmResolver library. If you encounter low-level assembly issues, consult the AsmResolver documentation.

BitMono is a code obfuscator and protector designed for developers who need to protect their intellectual property or software logic. Common use cases include:

• Custom Protection Development: Building your own protection logic without having to write a low-level engine from scratch or relying on the aging ConfuserEx engine.
• Intellectual Property Protection: Increasing the difficulty for reversers to understand and extract your code.
• Anti-Cheat/Anti-Tamper: Protecting game cheats or sensitive software logic against anti-cheat systems or unauthorized modifications.
• Security against 'Skids': Preventing low-effort tampering or unauthorized use of your software.
• Extensibility: Because BitMono uses clean architecture and AsmResolver as its assembly manipulator, it is designed to be easily forked and extended by the community.

In Unity IL2CPP builds, only protections that affect the metadata or AOT-compile into C++ are effective.

IL2CPP-compatible protections (Kept):

• FullRenamer: Renamed names are written cloaked into global-metadata.dat.
• NoNamespaces: Clears namespaces in the metadata.
• StringsEncryption: Removes plaintext strings from metadata; the decryptor is AOT-compiled to C++.
• AntiDebugBreakpoints: Pure managed timing checks that AOT-compile and run at runtime.

Protections skipped on IL2CPP (to prevent build breakage): UnmanagedString, CallToCalli, DotNetHook, BitMethodDotnet, ObjectReturnType, AntiDe4dot, BillionNops, AntiILdasm, BitTimeDateStamp, AntiDecompiler, BitMono, BitDotNet, BitDecompiler.

BitMono supports a plugin system that allows you to add custom protections without rebuilding the entire project. You can drop your own protection implementations into a plugins folder.

For detailed implementation instructions, refer to the official plugin developer guide.

Because BitMono obfuscates code before il2cpp.exe converts managed code to C++, your decision to mark a protection depends on its output:

• Do NOT mark it if the protection performs managed metadata/IL edits that il2cpp.exe can parse (e.g., renaming, clearing namespaces, or swapping ldstr for a managed decryptor call). These changes will persist in the resulting global-metadata.dat.
• DO mark it if the protection produces output il2cpp.exe cannot handle, such as emitting native code, calli instructions, or packing the PE. These would either break the conversion process or affect the managed PE that IL2CPP eventually discards.

The StringsEncryption protection uses AES encryption to secure string literals within your application. This prevents attackers from easily finding sensitive strings (like API keys or internal identifiers) via static analysis.

Key Effects:

• Anti-Decompiler: When combined with AntiDecompiler, it can cause tools like dnSpy to crash when attempting to analyze the classes using the encrypted strings.
• RVA Obfuscation: It sets the Relative Virtual Address (RVA) of the underlying byte[] to 0, making it harder to locate the encrypted data in memory.

Warning: This protection significantly impacts application performance due to the decryption overhead at runtime. Use it sparingly for sensitive strings only.

Protection Type: Protection

A preset is a predefined protection level that enables a curated set of protections. Instead of manually toggling every individual protection in protections.json, you can select a preset to quickly apply a specific security profile.

Important: Presets are chosen explicitly by the user and are never auto-detected. Because BitMono cannot automatically distinguish between different runtimes (e.g., Mono/Unity vs. .NET Core/Framework), you must ensure your chosen preset is compatible with your target runtime. BitMono will issue a warning if a preset enables protections intended for a different runtime, but it will not block the process.

{
  "Preset": "Balanced"
}

Native AOT relies heavily on metadata for reflection and internal bookkeeping. To prevent runtime crashes or build failures, follow these guidelines:

• Exclude Reflection Members: Use criticals.json or the [Obfuscation(Exclude = true)] attribute to exclude members read by reflection. Ensure ReflectionMembersObfuscationExclude is enabled.
• Generic Instantiations: Ensure you are using a current BitMono build; FullRenamer now correctly rewrites references for members reached through generic instantiations (e.g., Foo<int>().Bar()) to prevent AOT/JIT crashes.
• Error Handling: If you encounter No entrypoint module during ilc, this is a known SDK-level limitation regarding third-party hooks, not a BitMono configuration error.