Reverse Engineering RET Homepage RET Members Reverse Engineering Projects Reverse Engineering Papers Reversing Challenges Reverser Tools RET Re-Search Engine Reverse Engineering Forum Reverse Engineering Links

Go Back   Reverse Engineering Team Board > Reverse Engineering Board > .NET Reverse Engineering
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Display Modes
  #11  
Old 02-18-2009, 07:35 AM
rongchaua rongchaua is offline
Senior Member
 
Join Date: Apr 2007
Posts: 91
Default

Version 1.0.0.6 ist out
- Support SA 3.2
- I don't know if it work with version < 3.2. It is nice if someone can share me an assembly which be protected by SA 2.x
- I have tested with this file http://reteam.org/board/showthread.php?t=1386
- Some strings still encrypted after deobfuscating. I don't know why .
- Link to download tool: http://rongchaua.net/tools-mainmenu-...-smartassembly
__________________
My site: http://rongchaua.net

Last edited by rongchaua : 02-18-2009 at 07:43 AM.
Reply With Quote
  #12  
Old 02-18-2009, 10:28 AM
Kurapica Kurapica is offline
Senior Member
 
Join Date: May 2006
Location: Archives
Posts: 357
Default

Nice tool my friend...
__________________
Life can only be understood backwards but It must be read forwards.
Reply With Quote
  #13  
Old 02-21-2009, 12:28 PM
high6 high6 is offline
Member
 
Join Date: Sep 2008
Posts: 14
Default

Quote:
Originally Posted by rongchaua View Post
- Some strings still encrypted after deobfuscating. I don't know why .
In case you missed it in the other thread.

Quote:
Originally Posted by high6
Also would be cool if you made it options in desmart. So that you can choose the decrypt string and/or anti control flow and/or renaming.

Also something I added to my code.

Code:
Instruction GetNext(Instruction ins)
        {
            ins = ins.Next;
            while (ins != null && (ins.OpCode == OpCodes.Br || ins.OpCode == OpCodes.Br_S))
            {
                ins = ins.Operand as Instruction;
            }
            return ins;
        }
Because control flow obfuscation is applied after string encryption so sometimes you get.

ldc 435
br somewhere
call stringdecrypt
Reply With Quote
  #14  
Old 02-22-2009, 07:09 AM
rongchaua rongchaua is offline
Senior Member
 
Join Date: Apr 2007
Posts: 91
Default

Hi high6,
thank for your help. But the problem don't lie at the flow control because I fixed the flow control before decrypting strings.
It lies at the decrypt function because this function does not work with some Id. It works with most of Ids, but not with all IDs.
I think the decrypt routine of SA has errors. However I am not sure. And I do not intend to check that. .
For example: You can try your old code with this assembly http://reteam.org/board/showthread.php?t=1386 . The Id 33e8 will not be accepted although it is used in this function

Code:
private static bool Method_02(bool flag1)
{
    DateTime time = DateTime.Parse("2009-02-22T00:00:00");
    if ((DateTime.Now <= time) && (DateTime.Now >= time.AddDays(-21.0)))
    {
        return true;
    }
    string name = Assembly.GetExecutingAssembly().GetName().Name;
    string message = string.Format(Class_04.Method_00(0x33e8), name, time.ToString("D"));
    if (flag1)
    {
        throw new Exception(message);
    }
    Class_02 mainForm = new Class_02(message, "{smartassembly} License Exception", "error");
    Method_00();
    Application.Run(mainForm);
    return false;
}
__________________
My site: http://rongchaua.net
Reply With Quote
  #15  
Old 02-22-2009, 01:40 PM
high6 high6 is offline
Member
 
Join Date: Sep 2008
Posts: 14
Default

Hm, my version decrypts all the strings fine, I checked for all references to the decrypt call and there arent any after running mine.

Also that string is

"\'{0}\' has been built with an evaluation version of {{smartassembly}}, which has expired on {1}.\n\nYou need to purchase a license of {{smartassembly}}."

I posted my code in the other thread. Do you think it has something to do with your deobfuscating method?
Reply With Quote
  #16  
Old 02-28-2009, 10:52 AM
jerry828 jerry828 is offline
Junior Member
 
Join Date: Feb 2009
Posts: 1
Default

thank rongchaua for this good tool
Reply With Quote
  #17  
Old 02-28-2009, 12:16 PM
rongchaua rongchaua is offline
Senior Member
 
Join Date: Apr 2007
Posts: 91
Default

Version 1.0.0.7 ist out:
[1.0.0.7] : Bugfix in decrypting string. It works now better.

Regards.
rca.
__________________
My site: http://rongchaua.net
Reply With Quote
  #18  
Old 02-28-2009, 02:44 PM
Kurapica Kurapica is offline
Senior Member
 
Join Date: May 2006
Location: Archives
Posts: 357
Default

Well done rongchaua !! yourr tools are excellent.
__________________
Life can only be understood backwards but It must be read forwards.
Reply With Quote
  #19  
Old 03-02-2009, 09:04 AM
sirp sirp is offline
Senior Member
 
Join Date: Apr 2008
Posts: 76
Default

love em too always very usefull and time saving
Reply With Quote
  #20  
Old 03-10-2009, 02:09 AM
RFTO RFTO is offline
Junior Member
 
Join Date: Oct 2008
Posts: 2
Default

Am I the only one where this doesn't work?

Issues:
Breaks any .exe I use it on, "Error system.typeinitialization". ALL VERSIONS
Doesn't decrypt strings in a few versions
Freezes up sometimes towards the end (Seems to be fixed in 1.0.0.7 though)

It is still nice, but I thought I would bring the issues to your attention.

I don't have a specific application to give you, as these are problems that always occur.
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump





Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2019, Jelsoft Enterprises Ltd.