.NET Reversing Tips (1-6)

.NET Reversing Tips - Chapter 1

Quote

In this series of tutorials we will be targeting .net applications. If you search the web you will find [if you are lucky] few tutorials on this topic, although the .net technology has been around for a while now but the number of applications devloped with it is still nothing compared to those developed with [old] languages like C++ or Delphi or VB.

.NET Reversing Tips - Chapter 2

Quote

Entrypoint method is first method called on your .net application startup, and it's very Important to be able to locate it in reflector or Ildasm, in a simple .net application it may Look like this:-

Public Shared Sub Main()
Application.Run(New MainForm)
End Sub

The importance of this method is that you can start tracing the program actions from the beginning until you reach the protection scheme which is usually checked on Startup!

The second thing you can benefit from this Method is identifying the MainForm Class which will be used as a main form for the targeted application, If you see the Application.run method wandering around then you must keep an eye on the passed Arguments to this function.

.NET Reversing Tips - Chapter 3

Quote

I hope you have read the 2 previous tutorials and liked them too! This is a quick tutor and it's to give you an idea about patching in .NET applications.

This tutor depends on the Opcodes table in Chapter I, so please make sure you have the Opcodes table since we will use it later.

.NET Reversing Tips - Chapter 4

Quote

Hello there, as you can see we will try to crack a collection of .Net crackmes every time, and the level of difficulty will increase with time, because this is our first tutor, professional crackers may find it silly and very easy but like I said before it's for newbies.

This is our first example; you will find it with tutorial if you are lucky! Run the crackme and try to analyze it first.

.NET Reversing Tips - Chapter 5

Quote

Hello every one, this is a new tutor for cracking .net assemblies, Today I have chosen to tell you about a commercial product called .NET reactor, The only difference between this software and all the other protection systems for .net executables is that it uses old packing techniques to protect your assembly and that's why I have chosen it.

.NET Reversing Tips - Chapter 6

Quote

This time we are unpacking, the target is an unpackme written by Rendari, thanks for him for this nice challenge, actually I want to thank my friend UFO-PU55Y for sending me this one, he told me that it has been hanging since summer without solution, so I will try to share with you the technique I used to solve it.