Posted September 2, 201113 yr Please Unpack and Crack itOptions :[+] Method Obfuscation[+] String Enryption[+] Resource Protection[+] anti Patch ProtectionBest RegardsMagician
September 2, 201113 yr Hi, so why do you use NetFrameWork now?Ok so with NetFrameW.... I have not much and less to do so I have to quit this time. greetz
September 2, 201113 yr Author I am just trying some methods and commercial protectors in .net and there is no idea to make some thing stronger Thanks Dear LCF-AT Edited September 2, 201113 yr by Magician
September 4, 201113 yr The protection scheme is really simply, they used name and string obfuscation and also a flow obfuscation based on delegates calls.All the calls in this app are redirected to delegates, in the .cctor() of these delegates there is another call to a method that receives an integer, this integer indexes the real method that need to be executed.The body method is obtained by reflection from a resource file.The key of the crackme is: HF738HVHXHCIHQ2873H8273HFIUSHF7238HF2FRemoving all the delegates will require me a little bit of programming, perhaps mono.cecil is a good option.
September 4, 201113 yr Author @jacano:What about unpacking ? in this case we have so simple target and i think finding password was not so hard but what we can do in complex targets ?
September 4, 201113 yr At entry point:Assembly assembly = delegate034.m0000ad(delegate034.f000084);Stream stream = delegate035.m0000ae(assembly, "_", delegate035.f000085);is infact:Assembly assembly = Assembly.GetExecutingAssembly();Stream stream = Assembly.GetManifestResourceStream(assembly, "_");quite easy to deprotect using reflection/mono.cecil
September 4, 201113 yr @LCF-AT:Seems that "Magician" test all posible comercial .NET protectionin order to use them for "his" next .NET protector.Unpacked file:/>http://www.multiupload.com/148JCQE44HNext ?
September 4, 201113 yr Author @LCF-AT:Seems that "Magician" test all posible comercial .NET protectionin order to use them for "his" next .NET protector.Unpacked file:http://www.multiupload.com/148JCQE44HNext ?No , i just test them for learning some thing and don't want to use them.Thanks.
September 9, 201113 yr No , i just test them for learning some thing and don't want to use them.Thanks.I've heard something else ...So you stopped at CodeFort .NET for "your" protector.
Create an account or sign in to comment