Kris Posted January 10, 2020 Share Posted January 10, 2020 (edited) Language : C# Platform : Windows x32/x64 OS Version : Windows 10 Packer / Protector : Modded ConfuserEx + a packer. Description : Basically, just find the key to decode the string. All I will be (probably) using this for is for is to garbage-up some .INI files for my apps to read/write to, so that way there's no plain text. This isn't for hiding some sensitive information lol. Also, if you could, rate the difficulty from 1/10. Thanks! Screenshot : CrackMe.rar Edited January 11, 2020 by Kris Updated the CrackMe.rar Link to comment Share on other sites More sharing options...
Rhotav Posted January 11, 2020 Share Posted January 11, 2020 I just unpacked and cleaned it up. I don't want to deal with decode koi-fixed.exe Link to comment Share on other sites More sharing options...
Kris Posted January 11, 2020 Author Share Posted January 11, 2020 Bump. I edited the CrackMe.rar with a slight change I'll be using for now on when I use this in my apps for .INI files. I cleaned up my code a little too instead of trying to try-hard for this challenge. I feel it was okay for me to edit this since a reply hasn't been posted yet. If it was wrong please let me know. Thanks! Link to comment Share on other sites More sharing options...
aslan4747 Posted March 4, 2020 Share Posted March 4, 2020 used your decode func to decode Decoded: AnotherSuperSecretMessage Link to comment Share on other sites More sharing options...
SirKebab Posted March 19, 2020 Share Posted March 19, 2020 Spoiler Key is AnotherSuperSecretMessage After unpacking, passed byte array of the new encoded string to the decode function. Link to comment Share on other sites More sharing options...
Solution Washi Posted May 3, 2020 Solution Share Posted May 3, 2020 Spoiler Decoded: AnotherSuperSecretMessage Approach Spoiler Open in x64dbg, set breakpoint on mscoree.dll _CorExeMain, then dump .NET binary (dump1). Open dump1, notice in entrypoint it decompresses and loads a new module. Run until decompression finishes, dump module (dump2). Open dump2, notice all but <Module>::.cctor are unreadable/encrypted. In a typical ConfuserEx fashion, the method bodies are decrypted by the first call in <Module>::.cctor. Let the program execute this, and then dump executable again (dump3) Open dump3, notice how references to external methods in corlib are extracted to stub methods. Below all renamed symbols: Switch to ILSpy because it has a far superior decompiler engine. We then don't need to deobfuscate anything else. Copy/paste the encode method in a new C# project, test on sample "SuperSecretMessageLOL", and notice the output is equal to the encoded message. Decompiled code is therefore correct. Notice method is XOR with key "MjU1", so encrypt/decrypt is the same: Key: Encryption: Plug in the second encoded message as input for this method. Observe flag "AnotherSuperSecretMessage" 5 3 Link to comment Share on other sites More sharing options...
ruaden21 Posted May 29, 2020 Share Posted May 29, 2020 On 5/3/2020 at 7:29 PM, Washi said: Hide contents Hide contents Open in x64dbg, set breakpoint on mscoree.dll _CorExeMain, then dump .NET binary (dump1). I'm a noob. I searched but I do not know how to dump the .NET binary. Could you send me any source about this. Thank you! Link to comment Share on other sites More sharing options...
Washi Posted May 29, 2020 Share Posted May 29, 2020 (edited) 2 hours ago, ruaden21 said: I'm a noob. I searched but I do not know how to dump the .NET binary. Could you send me any source about this. Thank you! Personally, I like to use the Scylla plugin of x64dbg, doing it manually by going to the memory map of x64dbg and dump the relevant memory ranges from there, or using WinDbg .writemem or the !savemodule sos extension command, depending on which debugger I am using at the moment. Also, once you're able to open the app in dnSpy, dnSpy can also reconstruct .NET modules from memory, by going to Debug > Windows > Modules and then right clicking the module you want to dump. There are probably also other tools out there that can do the same. Edited May 29, 2020 by Washi 2 1 Link to comment Share on other sites More sharing options...
MindSystem Posted May 29, 2020 Share Posted May 29, 2020 On 5/3/2020 at 2:29 PM, Washi said: Hide contents Decoded: AnotherSuperSecretMessage Approach Hide contents Open in x64dbg, set breakpoint on mscoree.dll _CorExeMain, then dump .NET binary (dump1). Open dump1, notice in entrypoint it decompresses and loads a new module. Run until decompression finishes, dump module (dump2). Open dump2, notice all but <Module>::.cctor are unreadable/encrypted. In a typical ConfuserEx fashion, the method bodies are decrypted by the first call in <Module>::.cctor. Let the program execute this, and then dump executable again (dump3) Open dump3, notice how references to external methods in corlib are extracted to stub methods. Below all renamed symbols: Switch to ILSpy because it has a far superior decompiler engine. We then don't need to deobfuscate anything else. Copy/paste the encode method in a new C# project, test on sample "SuperSecretMessageLOL", and notice the output is equal to the encoded message. Decompiled code is therefore correct. Notice method is XOR with key "MjU1", so encrypt/decrypt is the same: Key: Encryption: Plug in the second encoded message as input for this method. Observe flag "AnotherSuperSecretMessage" I really like how you give your approach not as a full tutorial but with explanation instead of only saying "unpacked + file". Thanks you for your explanation ! 1 Link to comment Share on other sites More sharing options...
Uacoder Posted June 1, 2020 Share Posted June 1, 2020 Nice Challenge send me source for this app Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now