Reverse Engineering RET Homepage RET Members Reverse Engineering Projects Reverse Engineering Papers Reversing Challenges Reverser Tools RET Re-Search Engine Reverse Engineering Forum Reverse Engineering Links

Go Back   Reverse Engineering Team Board > Reverse Engineering Board > .NET Reverse Engineering
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Display Modes
  #111  
Old 05-24-2007, 08:38 AM
zilot zilot is offline
Member
 
Join Date: May 2007
Posts: 6
Default

Quote:
Originally Posted by LibX View Post
Still removing the strong name works in some cases but with bigger apps that have signed satalite DLL's its useless since the public key token is used to make sure its the right DLL not just some DLL with the same name.
So its better to patch the strong name token (next RE-Sign will have this function) then resign it.
Also i found lots of apps that don't even work without a strong name.

Regards
LibX // RETeam
As I understood, and tried for some applications (it works) you have to patch both, mainexe public token that is strong name for itself, then to patch public token related to satelite dll in mainexe, then you can patch satelite's dll public token that is strong name for itself. If you have A.dll that loads another B.dll and M.exe that loads A.dll, you have to do hard patching if you want to modify B.dll.

1. You have to remove SN from B.dll
2. You have to remove SN from A.dll, and token related to B.dll
3. You have to remove SN from M.exe and token related to A.dll

after all of that it will work. with modified B.dll. Recently I've dealt with activeX for NET that worked in this manner, A was main activeX dll, B was dll for time checking, and compiled application was M.
Reply With Quote
  #112  
Old 05-24-2007, 08:42 AM
zilot zilot is offline
Member
 
Join Date: May 2007
Posts: 6
Default

tKC....

will you continue with your latest tutorial. You've stopped with virtual protect, come on man, write down here, or in tut about string decryption. As I see your Crackme #9 has exactly what I want to know. As soon as I can, I will upload target I spoke about.
Reply With Quote
  #113  
Old 05-26-2007, 07:05 AM
Kurapica Kurapica is offline
Senior Member
 
Join Date: May 2006
Location: Archives
Posts: 357
Cool

Actually I have put maxtocode aside until i finish the current tutor regarding .net PE structure.
__________________
Life can only be understood backwards but It must be read forwards.
Reply With Quote
  #114  
Old 05-26-2007, 07:28 AM
zilot zilot is offline
Member
 
Join Date: May 2007
Posts: 6
Default

Ok

this is the target I spoke about, try yourself.

Original file is protected and there is license checking, it is Xheo license system. If you unpack original NET file, by removing calls to Xheo dll you should pass license protection. I couldnt unpack file

http://www.icefile.net/index.php?pag...e=Digimoto.rar
Reply With Quote
  #115  
Old 05-27-2007, 05:34 AM
Kurapica Kurapica is offline
Senior Member
 
Join Date: May 2006
Location: Archives
Posts: 357
Cool This is the managed resources pack

I hope it's useful !

http://www.filesend.net/download.php...030310851f4a63

__________________
Life can only be understood backwards but It must be read forwards.
Reply With Quote
  #116  
Old 05-27-2007, 09:39 PM
UFO-Pu55y UFO-Pu55y is offline
Senior Member
 
Join Date: Jan 2007
Posts: 87
Unhappy First LOL, then WTF

Quote:
Originally Posted by tKC View Post
I hope it's useful !
It is, thanks for that !!
Well, smartkill works like a charm now - u can drag in anything
u want... EXE or dump. It finds its way and decodes ur shit correctly
No dumping needed anymore.
I've added other functions, too, but it needs some more
finetuning before getting posted again.

Only some mins ago, I've tried to open up ur player in reflector
to see if smartkill gives me the right values, but... WTF ?
I didn't know that option of smartass before !
"Incorrect MetaData" added... huh ?
And I don't see a single piece of shit in reflector...

This is interesting. It adds ~10 bytes to the MetaData, but I didn't understand, yet, what it really does...
Aargh, it makes smartkill useless - should definitively be the
next target to be cleared up...

Greets
Reply With Quote
  #117  
Old 05-28-2007, 04:38 AM
UFO-Pu55y UFO-Pu55y is offline
Senior Member
 
Join Date: Jan 2007
Posts: 87
Default

Ok, I've played a bit with its options and got an overview...

Summary about SmartAss's anti stuff(so far):
-Strings encoding... solved
-StrongName signing... solved
-Classes/Methods obfuscation... hum
-MetaData alienation... hum

So still lot of work left. Obfuscation doesn't really hinder us reversing,
but maybe there's also a way to make things easier...

@tKC: but u're right, it rox. I was looking for a .net packer.
I did not know, that it also does a great job on that

But it doesn't like smartkill at all :/
It fails building - even with all options unchecked.
Maybe I should send 'em smartkill, to see what's wrong with it ???

Greets

Last edited by UFO-Pu55y : 05-28-2007 at 05:16 AM.
Reply With Quote
  #118  
Old 05-28-2007, 05:50 AM
Kurapica Kurapica is offline
Senior Member
 
Join Date: May 2006
Location: Archives
Posts: 357
Angry This is a good paper

It's actually one page but I have a hard copy of it attached to my monitor !


Link was removed but fixed at 127


UFO...

Deobfuscation is hard shit but still doeable ...
main problem I face is lack of documentation on .Net PE structure.

P.S : I forgot to include ntoskrnl paper ! but you can grab it from www.pmode.net
__________________
Life can only be understood backwards but It must be read forwards.

Last edited by Kurapica : 05-29-2007 at 11:03 AM.
Reply With Quote
  #119  
Old 05-28-2007, 07:16 AM
rongchaua rongchaua is offline
Senior Member
 
Join Date: Apr 2007
Posts: 91
Default

Take a look at here
http://madebits.com/netz/index.php

An open source packer. .
Reply With Quote
  #120  
Old 05-28-2007, 08:18 AM
UFO-Pu55y UFO-Pu55y is offline
Senior Member
 
Join Date: Jan 2007
Posts: 87
Default

Quote:
Originally Posted by rongchaua View Post
Take a look at here
http://madebits.com/netz/index.php

An open source packer. .
I saw it before and tested it, nice, coz OpenSource.
I like it !
But C# again... hum.

Will try to make a gui version

Last edited by UFO-Pu55y : 05-28-2007 at 08:40 AM.
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump





Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.