Reverse Engineering RET Homepage RET Members Reverse Engineering Projects Reverse Engineering Papers Reversing Challenges Reverser Tools RET Re-Search Engine Reverse Engineering Forum Reverse Engineering Links

Go Back   Reverse Engineering Team Board > Reverse Engineering Board > .NET Reverse Engineering
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Display Modes
  #1  
Old 02-23-2009, 07:31 AM
braces braces is offline
Member
 
Join Date: Feb 2009
Posts: 5
Post Unknown .Net protection?

Hello!
There is a program Articulate Studio '09 http://www.articulate.com
Is .Net program but packed/obfuscate.
What protection is?
Thank you!

http://rapidshare.com/files/20165068...maker.exe.html
MD5: 7AB94F513DC199B6C8F999424C6C4612

Thanks in advance!

Last edited by braces : 02-23-2009 at 01:59 PM.
Reply With Quote
  #2  
Old 02-23-2009, 10:47 AM
Kurapica Kurapica is offline
Senior Member
 
Join Date: May 2006
Location: Archives
Posts: 357
Default

Can you just post the main exe ?

we don't want to download the entire package !!
__________________
Life can only be understood backwards but It must be read forwards.
Reply With Quote
  #3  
Old 02-23-2009, 12:43 PM
braces braces is offline
Member
 
Join Date: Feb 2009
Posts: 5
Default

Quote:
Originally Posted by Kurapica View Post
Can you just post the main exe ?

we don't want to download the entire package !!
Thanks!
In this Studio '09 are four program Presenter '09, Quizmaker '09, Engage '09 and Video Encoder '09.
This main is from Quizmaker '09 - Quizmaker.exe.
http://rapidshare.com/files/20162317...maker.exe.html
MD5: 7AB94F513DC199B6C8F999424C6C4612
Thanks In Advance!
Reply With Quote
  #4  
Old 02-23-2009, 01:27 PM
braces braces is offline
Member
 
Join Date: Feb 2009
Posts: 5
Default Thanks in advance

Thanks in advance!
http://rapidshare.com/files/20163892...maker.exe.html
MD5: 7AB94F513DC199B6C8F999424C6C4612
Reply With Quote
  #5  
Old 02-23-2009, 03:13 PM
Kurapica Kurapica is offline
Senior Member
 
Join Date: May 2006
Location: Archives
Posts: 357
Default

You must be kiddin me !! right ?

There is no damn protection in this exe, even names obfuscation is not there.

at least read the tutors before asking such question again.
__________________
Life can only be understood backwards but It must be read forwards.
Reply With Quote
  #6  
Old 02-25-2009, 06:27 AM
sirp sirp is offline
Senior Member
 
Join Date: Apr 2008
Posts: 76
Default Articulate.Runtime.dll

hmm look into Articulate.Runtime.dll there u find the obfuscated stuff ,) .. i just had a look into that app .. and it uses DeployLX bah

void DeployLX.Licensing.v3.LicenseKeyAttribute::.ctor(s tring) = { string('$m|+m#}}R43)p4kGY6EQ%6T?B4]6mbjqW]w4BAw/t+H4]\u00b6&roBYhB.siKJ!yjs?C/%wt\'F6\'YSpiUXf\'38v.9Hdo`.]ab^I$7Q)N(lZ*-mNC\u00a7Y1ce(G#G-\u00a7;Sl^hNBz*#(r6(ml^gI+SZ-QsJW+$9b\u00a7AcpLdZ3Yd0UWQ+TH~%;7DeSX!W6yI&kN\u00 a7fg0BfW9vA\u00b6[0cW2;MKx.dG6}DWl@+4}$|x\u00a7Ev\u00a7EsTw[&,P9jh;3Zs?_TrG6o\u00b6F[yX(HnH=)3=Oc-\u00a7]AQiw0N`W3)Pcn=fI!A\'oLajGbh?Jkr@_2W@#5kA1g84k_oope n$ne@iCeP}l`qE*+Uk*/I6KcG7&)^NWK~/OM\u00a74|NY/wkYZo66CWD?68?czo$3kdh+_8%^Ba\u00a75\u00b6f\u00a72 l~j:EIC6}s!I(vmd0{3&3|gN);an`tFYV-AXRSE8\u00a7|\u00a7K\'z}ljCFXUrrN{-z=#{f!4v/\'aL,Fk*)=o:i_x6EVz.m[O~vzA`;f^FPrYPZHk,*PlhgJi;e=P-XPO5iZ=K;h6%ZJUKZ\u00b6R1x?Nph(typr5eN&qPPUM5W1[1LhfZAU(r6QWO7@R,\u00b6w3`UW}DC|P:SEEyqr') }

Last edited by sirp : 02-25-2009 at 06:29 AM.
Reply With Quote
  #7  
Old 02-25-2009, 03:31 PM
braces braces is offline
Member
 
Join Date: Feb 2009
Posts: 5
Default

Quote:
Originally Posted by sirp View Post
hmm look into Articulate.Runtime.dll there u find the obfuscated stuff ,) .. i just had a look into that app .. and it uses DeployLX bah

void DeployLX.Licensing.v3.LicenseKeyAttribute::.ctor(s tring) = { string('$m|+m#}}R43)p4kGY6EQ%6T?B4]6mbjqW]w4BAw/t+H4]\u00b6&roBYhB.siKJ!yjs?C/%wt\'F6\'YSpiUXf\'38v.9Hdo`.]ab^I$7Q)N(lZ*-mNC\u00a7Y1ce(G#G-\u00a7;Sl^hNBz*#(r6(ml^gI+SZ-QsJW+$9b\u00a7AcpLdZ3Yd0UWQ+TH~%;7DeSX!W6yI&kN\u00 a7fg0BfW9vA\u00b6[0cW2;MKx.dG6}DWl@+4}$|x\u00a7Ev\u00a7EsTw[&,P9jh;3Zs?_TrG6o\u00b6F[yX(HnH=)3=Oc-\u00a7]AQiw0N`W3)Pcn=fI!A\'oLajGbh?Jkr@_2W@#5kA1g84k_oope n$ne@iCeP}l`qE*+Uk*/I6KcG7&)^NWK~/OM\u00a74|NY/wkYZo66CWD?68?czo$3kdh+_8%^Ba\u00a75\u00b6f\u00a72 l~j:EIC6}s!I(vmd0{3&3|gN);an`tFYV-AXRSE8\u00a7|\u00a7K\'z}ljCFXUrrN{-z=#{f!4v/\'aL,Fk*)=o:i_x6EVz.m[O~vzA`;f^FPrYPZHk,*PlhgJi;e=P-XPO5iZ=K;h6%ZJUKZ\u00b6R1x?Nph(typr5eN&qPPUM5W1[1LhfZAU(r6QWO7@R,\u00b6w3`UW}DC|P:SEEyqr') }

Thanks sirp!
Is there a tutorial to unpack it?
Reply With Quote
  #8  
Old 02-27-2009, 04:06 AM
sirp sirp is offline
Senior Member
 
Join Date: Apr 2008
Posts: 76
Default

hmm i started the .dll in olly and then i tryed to dump it with winhex ..but still u cant use it properly in reflector
would be nice if someone got an tip ,)
neither u cant open the dll file with ida it crashes
Reply With Quote
  #9  
Old 02-27-2009, 07:42 AM
Kurapica Kurapica is offline
Senior Member
 
Join Date: May 2006
Location: Archives
Posts: 357
Default

No need to unpack this Licensing DLL, all you have to do is to learn patching to the max, keep reading and trying till you become up to DeployLX !! all you have to do is to patch where the license classes are called, no other solution.
__________________
Life can only be understood backwards but It must be read forwards.
Reply With Quote
  #10  
Old 02-27-2009, 08:28 AM
sirp sirp is offline
Senior Member
 
Join Date: Apr 2008
Posts: 76
Default

yep ... i just tryed a bit of patchin in the runtime.dll .. after that the strongname was broken for sure ,) ... but that dll is only for the reg and about stuff .. only the lill error window pops up about strong name but app runs on lol
so ----> as kurapica says i think too : all you have to do is to patch where the license classes are called, no other solution.
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump





Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2021, Jelsoft Enterprises Ltd.