Ideas for a Native Runtime protection?

[0xNOP]

I'm trying to implement a Native Runtime protection scheme just like how some protectors does, (keep in mind [Native Runtime != Native Wrapper]) I found it interesting so I wanted to do something similar to that just because, and because of learning purposes, I think this little project can open me doors for learning what I want to learn which is be more fluent in C# or at least I hope so.

 

Basically what I would like to apply is the same principles, I know they take some measures that are kinda obvious and prone to reverse for example Jitted methods, MITM Jit Attacks, etc, etc.

 

However, like I said, I just want to do it.

 

I was looking into doing somewhat of a Licensing System, but then I was like, if I keep sending stuff from the native runtime back to the .net assembly, things will have to be decrypted at a certain point, at some point that's Ok because the encryption/decryption routines will all be stored in the runtime and not in the assembly, but yet again, since everything is decompilable with Assemblies anyone can just open it up and for example:

public int CheckRuntime()
{
	if(RuntimeInvoker() == "Active")
	{
		return 1; // Can be tampered...
	}else
	{
		return 0; // Can be tampered...
	}
}

So I was thinking in another method, just like how the protector does, injects code dynamically at runtime, if you see an assembly protected by HVM it will be something like this:

public int MyProtectedCallback()
{
	throw new Exception("Error, The Runtime library is not loaded!");
}

So what it does is that in the CTOR method body it just puts it's runtime callbacks and whatnot, then if everything goes as expected it just injects stuff dynamically and the above method gets resolved, or at least that's how I see it.

 

If someone has more info on this could you share it?

 

I will really appreciate it 

Edited September 8, 2016 by 0xNOP