KoiVM Modified (Beds Protector 1.4.1)

[0x72]

View File

KoiVM Modified (Beds Protector 1.4.1)

---

KoiVM is a virtualizing protector for .NET applications, as a plugin of ConfuserEx. ConfuserEx is a open-source protector for .NET applications. It is the successor of Confuser project.

Quote

KoiVM is a virtual machine made to work on ConfuserEx, it turns the .NET opcodes into new ones that only are understood by our machine. There are multiple ways of using the plugin, first one is certainly ridiculous as it will "merge" with cex and virtualize every single method, including protections from ConfuserEX, however note that this might KILL your performance. Second one will just virtualize the methods that you decide, this is the best option in all if not all the cases.

This file is protected with KoiVM using;

• MD5 Hash Check
• Constants
• Renamer
• Anti-Tamper

I took KoiVM from https://github.com/BedTheGod/ConfuserEx-Mod-By-Bed (1.4.1) and modified it to make OldRod fail devirt.

---

• Submitter
  0x72
• Submitted
  05/20/2020
• Category
  UnPackMe (.NET)

 

[Washi]

UnpackMe.clean.exe

Approach:

Spoiler

Latest version of OldRod doesn't really struggle with this file apart from one small bug (or feature? :P)

• Set bp on <Module>::.cctor in dnSpy, step over call and dump file.
• Notice resulting PE file is corrupted, fix PE and Cor20 headers by copying headers of original PE. (Dumped file is in mapped mode, so set file offsets equal to RVAs in section headers).
• Notice file is protected by KoiVM with a custom koi stream name: Run OldRod.exe <file> --koi-stream-name #RobertsVM --rename-symbols
• Observe constants encrypted in Main. Set breakpoint on decrypt methods in original bin and dynamically find constants. Replace all found constants in new binary.
• Remove anti tamper calls in <Module>::.cctor() and remaining junk.
• Notice oldrod made mistake in the devirtualization of Main by incorrectly adding a cast to uint instead of bool after the call to __VMFUNCTION__10551 (stub for String::op_Equality). Replace call to __VMFUNCTION__10551 with String::op_Equality or change the unbox.any uint32 to unbox.any bool.
• Done.

Code is readable enough already, but one could further improve it by inlining all the stub __VMFUNCTION__XXXX methods.

 

Edited May 26, 2020 by Washi