Jump to content
Tuts 4 You

[UnpackMe] Fort UnpackMe


Gladiator

Recommended Posts

I am just trying some methods and commercial protectors in .net and there is no idea to make some thing stronger

Thanks Dear LCF-AT wub.png

Edited by Magician
Link to comment

The protection scheme is really simply, they used name and string obfuscation and also a flow obfuscation based on delegates calls.

All the calls in this app are redirected to delegates, in the .cctor() of these delegates there is another call to a method that receives an integer, this integer indexes the real method that need to be executed.

The body method is obtained by reflection from a resource file.

The key of the crackme is: HF738HVHXHCIHQ2873H8273HFIUSHF7238HF2F

Removing all the delegates will require me a little bit of programming, perhaps mono.cecil is a good option.

  • Like 2
Link to comment

@jacano:

What about unpacking ? in this case we have so simple target and i think finding password was not so hard but what we can do in complex targets ?

Link to comment

At entry point:

Assembly assembly = delegate034.m0000ad(delegate034.f000084);

Stream stream = delegate035.m0000ae(assembly, "_", delegate035.f000085);

is infact:

Assembly assembly = Assembly.GetExecutingAssembly();

Stream stream = Assembly.GetManifestResourceStream(assembly, "_");

quite easy to deprotect using reflection/mono.cecil

Link to comment

@LCF-AT:

Seems that "Magician" test all posible comercial .NET protection

in order to use them for "his" next .NET protector.

Unpacked file:
/>http://www.multiupload.com/148JCQE44H

Next ?

Link to comment
No , i just test them for learning some thing and don't want to use them.Thanks.

I've heard something else ...

So you stopped at CodeFort .NET for "your" protector.

  • Like 1
Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...