Xenocode Postbuild 2008

[rongchaua]

Hi all,
it is a long time I did not play with .Net protection. Today I see that Xenocode has already a new version 2008. My friend hat helped me to protect my sample crackme so that I can test new version of Xenocode. I would like to share this protected file to you. Here is it: http://www.mediafire.com/?mw0deyzynzk

Enjoy yourself with unpacking it.
Regards.
rca.

[pvlog]

Hi,
I unpacked it dynamically, then ildasm/ilasm did the job for chalenge 1 and 2.

about chalenge 3 :the serial for 'rongchaua' is 'cm9uZ2NoYXVh', isn't it ?

Regards,
Phil.

[Kurapica]

You should write tutor I think and show everybody your method.

[pvlog]

I used windbg and sos to unpack it:
1. load SampleCrackme.exe into windbg
2. let the program run (Debug->Go)
3. as soon as mscorwks is loaded, you can break (Debug->break)
4. load sos:
on the command line, type .loadby sos mscorwks
5. dump the AppDomain with sos:
type !DumpDomain on the command line
6. You get the list of loaded assemblies; look for assemblies that seem to be loaded from the same location as your main assembly.
In this case, you'l find:
module XYZ <path>\SampleCrackme.exe
7. let sos save the module:
!SaveModule XYZ <dumpdir>\SampleCrackme.exe
voilà! you get the unprotected assembly saved to disk. Just unassemble it or load it in reflector to solve the other chalenges.

Phil.

[rongchaua]

@pvlog:
1. Greate solution.
2. I just suggest to unpack it. I always use this crackme to test a new version of .net protector. It is very easy to solve my crackme. And I did not remember what is right serial for my name too. . I documented your way with a video. For someone who needs it:
Unpack Xenocode
@all:
Other methods to unpack will be always welcomed. .

Regards.
rca.

[sirp]

very nice new tut thx mates, )

[packetloss]

rongchaua,

Thanks for the walkthrough on this!

pvlog,

nice method!

[high6]

Originally Posted by pvlog

I used windbg and sos to unpack it:
1. load SampleCrackme.exe into windbg
2. let the program run (Debug->Go)
3. as soon as mscorwks is loaded, you can break (Debug->break)
4. load sos:
on the command line, type .loadby sos mscorwks
5. dump the AppDomain with sos:
type !DumpDomain on the command line
6. You get the list of loaded assemblies; look for assemblies that seem to be loaded from the same location as your main assembly.
In this case, you'l find:
module XYZ <path>\SampleCrackme.exe
7. let sos save the module:
!SaveModule XYZ <dumpdir>\SampleCrackme.exe
voilà! you get the unprotected assembly saved to disk. Just unassemble it or load it in reflector to solve the other chalenges.

Phil.

What is "sos"?

[vb_master]

Originally Posted by high6

What is "sos"?

Part of windbg.