Reverse Engineering RET Homepage RET Members Reverse Engineering Projects Reverse Engineering Papers Reversing Challenges Reverser Tools RET Re-Search Engine Reverse Engineering Forum Reverse Engineering Links

Go Back   Reverse Engineering Team Board > Reverse Engineering Board > .NET Reverse Engineering
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Display Modes
  #11  
Old 10-01-2008, 08:58 AM
LibX LibX is offline
Administrator
 
Join Date: Feb 2007
Location: The Netherlands
Posts: 118
Default

Download the latest version please this one should process the file just fine. (v1.2)

Thx for the bug report

Regards
LibX
Reply With Quote
  #12  
Old 10-02-2008, 09:57 AM
high6 high6 is offline
Member
 
Join Date: Sep 2008
Posts: 14
Default

thanks.

Also what was wrong with the original decryption?

Edit:

When I try to run it, it crashes and gives me an invalid program exception.

Last edited by high6 : 10-02-2008 at 10:00 AM.
Reply With Quote
  #13  
Old 10-06-2008, 03:12 AM
ender ender is offline
Member
 
Join Date: Oct 2008
Posts: 9
Default

Hey LibX. I've been trying to get up to speed on .net reversing, so first off, I just wanted to say I really appreciate all the stuff you guys have put together here at the RET board. It's really helped.

That being said ... in case it helps you work any kinks out of the tool, I just wanted to let you know that I tried running dotfuckscator against a dotobfuscated binary the other day, and while being able to see the (mostly) decoded strings in the disassembler was great, I found that in any given class, many strings weren't fully decoded and still had several chars that were still in the '\u####' format.

If you wanted to take a look, the program I was messing around with was "Video Thumbnails Maker by Scorp". You can grab it here: http://www.suu-design.com/downloads.html.

Just as a quick disclaimer, the app is already free/donationware, and I was only using it as something to practice on.

Anyway, thanks again for the great tool, and if you happen to find any time to figure out why some strings are only being partially decoded, would love to hear back from you.
__________________
if you build a man a fire he will be warm for a day; if you set a man on fire he will be warm for the rest of his life. :rolleyes:

Last edited by ender : 10-07-2008 at 08:06 AM.
Reply With Quote
  #14  
Old 10-06-2008, 08:26 AM
LibX LibX is offline
Administrator
 
Join Date: Feb 2007
Location: The Netherlands
Posts: 118
Default

Quote:
Originally Posted by high6 View Post
thanks.

Also what was wrong with the original decryption?

Edit:

When I try to run it, it crashes and gives me an invalid program exception.
Well since your the only one i know of with this problem i think there is something wrong with your system's configuration
I have tested this tool on Vista x86/64 / windows 2008 server 64 / windows xp x86/64 and windows 2003 x86 and its all working just fine.
Do u have .NET framework 2.0 with latest service pack installed?

Gr
LibX
Reply With Quote
  #15  
Old 10-06-2008, 08:28 AM
LibX LibX is offline
Administrator
 
Join Date: Feb 2007
Location: The Netherlands
Posts: 118
Default

Quote:
Originally Posted by ender View Post
Hey LibX. I've been trying to get up to speed on .net reversing, so first off, I just wanted to say I really appreciate all the stuff you guys have put together here at the RET board. It's really helped.

That being said ... in case it helps you work any kinks out of the tool, I just wanted to let you know that I tried running dotfucksator against a dotobfuscated binary the other day, and while being able to see the (mostly) decoded strings in the disassembler was great, I found that in any given class, many strings weren't fully decoded and still had several chars that were still in the '\u####' format.

If you wanted to take a look, the program I was messing around with was "Video Thumbnails Maker by Scorp". You can grab it here: http://www.suu-design.com/downloads.html.

Just as a quick disclaimer, the app is already free/donationware, and I was only using it as something to practice on.

Anyway, thanks again for the great tool, and if you happen to find any time to figure out why some strings are only being partially decoded, would love to hear back from you.
Thanks for the bugreport ender il take a look at this file
And happy to hear you find the tools usefull

regards
LibX
Reply With Quote
  #16  
Old 10-06-2008, 08:36 AM
LibX LibX is offline
Administrator
 
Join Date: Feb 2007
Location: The Netherlands
Posts: 118
Default

Quote:
Originally Posted by LibX View Post
Well since your the only one i know of with this problem i think there is something wrong with your system's configuration
I have tested this tool on Vista x86/64 / windows 2008 server 64 / windows xp x86/64 and windows 2003 x86 and its all working just fine.
Do u have .NET framework 2.0 with latest service pack installed?

Gr
LibX
Ok lol i just checked it out and i found that some strings from this application are for difrent languages on of them is rusian so that explains the \uxxx stuff
So everything is decrypted just fine you just can't display the russian characters on your windows i think (they do show here becouse i have virtualy all codepages installed)
Anyway if you find other bugs lemme know

Regards
LibX
Reply With Quote
  #17  
Old 10-06-2008, 03:03 PM
LibX LibX is offline
Administrator
 
Join Date: Feb 2007
Location: The Netherlands
Posts: 118
Default

Quote:
Originally Posted by high6 View Post
thanks.

Also what was wrong with the original decryption?

Edit:

When I try to run it, it crashes and gives me an invalid program exception.
Sorry didnt respond to this yet, well the problem is the string reading function from Mono Cecil and not the decryption process itself
Cecil uses Encoding.Unicode.GetString against a byte array but in some cases the result from this function isn't correct.
I fixed it with my own function that reads the string as raw bytes first then convert all of them to chars and create a new string out of this wich i then decrypt to get the proper result

Hope this helps

Regards
LibX
Reply With Quote
  #18  
Old 10-07-2008, 01:16 AM
ender ender is offline
Member
 
Join Date: Oct 2008
Posts: 9
Default

Quote:
Originally Posted by LibX View Post
Ok lol i just checked it out and i found that some strings from this application are for difrent languages on of them is rusian so that explains the \uxxx stuff
So everything is decrypted just fine you just can't display the russian characters on your windows i think (they do show here becouse i have virtualy all codepages installed)
Anyway if you find other bugs lemme know

Regards
LibX
Hey LibX, I just wanted to double check, but was this response intended only for high6, or did you think my problem was also related to the inclusion of strings in various languages.

As a quick side note (while I am aware the prog I am looking into has strings encoded from different languages) the "half decrypted" strings I was talking about were all in English (in some cases the "space" character wasn't decoded, or a miscellaneous letter wasn't decoded from the middle of the application title for instance, but the letters before and after were).

Anyway, thanks for your quick response, and just ignore this if your previous response didn't have anything to do with me.
__________________
if you build a man a fire he will be warm for a day; if you set a man on fire he will be warm for the rest of his life. :rolleyes:

Last edited by ender : 10-07-2008 at 01:28 AM.
Reply With Quote
  #19  
Old 10-07-2008, 06:57 AM
LibX LibX is offline
Administrator
 
Join Date: Feb 2007
Location: The Netherlands
Posts: 118
Default

Quote:
Originally Posted by ender View Post
Hey LibX, I just wanted to double check, but was this response intended only for high6, or did you think my problem was also related to the inclusion of strings in various languages.

As a quick side note (while I am aware the prog I am looking into has strings encoded from different languages) the "half decrypted" strings I was talking about were all in English (in some cases the "space" character wasn't decoded, or a miscellaneous letter wasn't decoded from the middle of the application title for instance, but the letters before and after were).

Anyway, thanks for your quick response, and just ignore this if your previous response didn't have anything to do with me.
That reply was for another problem
But are you sure you are running the latest version of DotFuckScator since i made a dump here of all strings that are decrypted and all strings are perfectly fine here :S
Latest version is v1.2 the title bar of the form should show this.

If its still not working please post a screenshot of the problem

regards
LibX
Reply With Quote
  #20  
Old 10-07-2008, 07:19 AM
LibX LibX is offline
Administrator
 
Join Date: Feb 2007
Location: The Netherlands
Posts: 118
Default

Anyway just released v1.3 the output will also be able to run now fixed a royal fuckup ;x
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump





Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2019, Jelsoft Enterprises Ltd.