Jump to content
Tuts 4 You

NETProtect.IO v2.0.0

learningit25

By learningit25
in UnPackMe (.NET)

 Share
Go to solution Solved by Reza-HNA,

Recommended Posts

learningit25

learningit25

Posted
Posted
NETProtect.IO v2.0.0

View File

NETProtect.IO v2.0.0

This unpackme was protected using NETProtect.IO using protection options shown in the screenshot.

Nice to meet guys in forum.

mstsc_uQoTlhqPYO.png

 

Link to comment
Share on other sites
ElektroKill

ElektroKill

Posted
Posted

Hello,

This isn't anything new... It's just DNGuard 3.9.6.2 with some additional attributes and slight attempts at rebranding.

image.png.d8043503123d13da9363864a7f181642.png

We can also see this in the native dll it drops

image.png.1a43882263c87d39d1c7419860feb11e.png

This is not the first time NETProtect.IO is using other protectors under their own brand name. First it was NETGuard, then Agile.NET, CawkVM, and now DNGuard 😕

As for unpacking DNGuard, i have not done a lot of research into it. If anyone has and is willing to share the research and knowledge i think we all would be thankful :)
 

  • Like 4
  • Thanks 2
  • Haha 1
Link to comment
Share on other sites
  • Solution
Reza-HNA

Reza-HNA

Posted
  • Solution
Posted

it seems they using a stolen version of DNGuard Enterprise and made a cloud version of it!
so it's a DNG 3.9.6.2 Enterprise and almost none of options are true :)

here is the password:
 

Spoiler

Thanky0u!Myfr!3nd

approach:

Spoiler
  1. hook JIT
  2. catch method bodies in JIT and read it with dnlib, btw tokens are encrypted in enterprise version, you need to analyze runtime dll to get them (which heavily obfuscated by VMP i believe).
  3. there are proxy methods, just replace them with original.
  4. strings are encrypted, just invoke all static string methods in "ZYXDNGuarder" type.

 for more info just read JitDumper3 by yck1509 source code.

unpacked file attached.

B.R

Unpackme_cleaned.exe

  • Like 4
  • Thanks 5
Link to comment
Share on other sites
learningit25

learningit25

Posted
  • Author
Posted
13 hours ago, Reza-HNA said:

it seems they using a stolen version of DNGuard Enterprise and made a cloud version of it!
so it's a DNG 3.9.6.2 Enterprise and almost none of options are true :)

here is the password:
 

  Reveal hidden contents

Thanky0u!Myfr!3nd

approach:

  Hide contents
  1. hook JIT
  2. catch method bodies in JIT and read it with dnlib, btw tokens are encrypted in enterprise version, you need to analyze runtime dll to get them (which heavily obfuscated by VMP i believe).
  3. there are proxy methods, just replace them with original.
  4. strings are encrypted, just invoke all static string methods in "ZYXDNGuarder" type.

 for more info just read JitDumper3 by yck1509 source code.

unpacked file attached.

B.R

Unpackme_cleaned.exe 8.5 kB · 0 downloads

Hi Reza, 

Perfectly, thank you very much.

when I use jitdumper3 with DNG HVM option, it's appear error as picture below (Same error with windows 7 and windows 10 netbox).

Would you please help me more detail?

image.png.4083177fdae74580b1e2554af93939df.png

Link to comment
Share on other sites
learningit25

learningit25

Posted
  • Author
Posted
21 hours ago, ElektroKill said:

Hello,

This isn't anything new... It's just DNGuard 3.9.6.2 with some additional attributes and slight attempts at rebranding.

image.png.d8043503123d13da9363864a7f181642.png

We can also see this in the native dll it drops

image.png.1a43882263c87d39d1c7419860feb11e.png

This is not the first time NETProtect.IO is using other protectors under their own brand name. First it was NETGuard, then Agile.NET, CawkVM, and now DNGuard 😕

As for unpacking DNGuard, i have not done a lot of research into it. If anyone has and is willing to share the research and knowledge i think we all would be thankful :)
 

Sorry to hear about that is stolen product. 
In my home country, many companies and people using this in obfuscator product.
They unknown it's stolen product. It's sad.

 

 

Link to comment
Share on other sites
goro1988

goro1988

Posted
Posted

NETProtect.IO v3.0.0 is the version you use, it has several layers of dnguard, and the native dnguard cleaner is private, it is not public ...

  • Sad 1
Link to comment
Share on other sites
  • 2 weeks later...
unominhtuan

unominhtuan

Posted
Posted (edited)
On 5/8/2021 at 10:44 PM, learningit25 said:

Sorry to hear about that is stolen product. 
In my home country, many companies and people using this in obfuscator product.
They unknown it's stolen product. It's sad.

 

 

Everyone knows it's DnGuard, just put in dnspy or ILSpy to know. He buys or jailbreaks a copy of dnguard, then runs it on the server, when the user uploads the source for packaging, it also saves the original to steal the NetProtect user's code. Then go around saying its netprotect is number 1, no one can unzip it. I was going to say that a few times, but seeing how many of his fans are, I gave up. But to protect the file, you have to upload the entire source code to his server, which exposes your entire source code.

Edited by unominhtuan
  • Like 4
  • Sad 1
Link to comment
Share on other sites
  • 1 month later...
  • 2 months later...
BlackHat

BlackHat

Posted
Posted

Yup. It is a Stolen DNGuard. 

You have to restore the Bodies from the Runtime and then append in the main assembly.
After devirt you can remove the strings or proxies. There is nothing much to tell as the answer is already given. ! 

I was testing something. So I took this unpackme as test. :)

Unpackme-cleaned.exe

  • Like 1
  • Thanks 2
Link to comment
Share on other sites
  • 1 year later...
HYPNOTIC

HYPNOTIC

Posted
Posted (edited)
On 5/8/2021 at 3:48 AM, Reza-HNA said:

it seems they using a stolen version of DNGuard Enterprise and made a cloud version of it!
so it's a DNG 3.9.6.2 Enterprise and almost none of options are true :)

here is the password:
 

  Reveal hidden contents

Thanky0u!Myfr!3nd

approach:

  Reveal hidden contents
  1. hook JIT
  2. catch method bodies in JIT and read it with dnlib, btw tokens are encrypted in enterprise version, you need to analyze runtime dll to get them (which heavily obfuscated by VMP i believe).
  3. there are proxy methods, just replace them with original.
  4. strings are encrypted, just invoke all static string methods in "ZYXDNGuarder" type.

 for more info just read JitDumper3 by yck1509 source code.

unpacked file attached.

B.R

Unpackme_cleaned.exe 8.5 kB · 68 downloads

i tried novmp unpacker to unpack the hvmruntime.dll it shows all addresses where it's virtualized but in the end the file can't be saved any solution ?

Edited by HYPNOTIC
Link to comment
Share on other sites
  • 2 weeks later...
Hadits follower

Hadits follower

Posted
Posted (edited)

is there anyone has dnguard hvm 4.20 [Latest] trial version => protected sample test exe which can run on other pc , 

can please post it as unpack me .

pack with following arguments ;

1, Pack Without any option checked ,

2. Pack with all option

and post two packed exe as unpack me for test

Edited by Hadits follower
Link to comment
Share on other sites
whoknows

whoknows

Posted
Posted

+ as known 

 trial version is without HVM technology

maybe a hacker (as requires login) can try to leak the full setup by  

http://dnguard.net/zyx/download_pre.php
http://dnguard.net/zyx/download.php

yeah no https enabled.

Link to comment
Share on other sites
Hadits follower

Hadits follower

Posted
Posted (edited)

i already tested dnghvm 4.20 trial => i have pack a test exe with almost all option and deob as works fine.

but i want to test other pc packed file [may be that can be different] ,

if some one have 4.20 protected sample exe for test purpose which can run in other pc please post it for learn purpose ,

 

i dont want hacking url or full version ,  just a unpack me which protected by 4.20 and can run on other pc 

Edited by Hadits follower
Link to comment
Share on other sites
whoknows

whoknows

Posted
Posted (edited)

hi @Hadits follower

please consider the following 

 

jSStOmo.png

 

source - dnguard.net/productmore.php#morehvm

only ENTERPRISE edition has the MOST WANTED feature called HVM. The Trial edition has traditional technics of 2000s... 

 

[edit]
each edition has different setup ( aka carries different DNGuardHVM.exe & HVMRuntm.dll ) as result you can use the HVM feature only if you have the ENTERPRISE setup.

 

Edited by whoknows
adding larger explanation about setup variants
Link to comment
Share on other sites
whoknows

whoknows

Posted
Posted (edited)

this protected (today) with v3.60 Enterprise (2012)

the protected are corrupted, for today framework...

56wVaeU.png
  
https://www.upload.ee/files/14777500/g.rar.html

 

[edit]

qfyshsB.png
 
 
Edited by whoknows
adding v3.6 changelog
  • Thanks 1
Link to comment
Share on other sites
0x59

0x59

Posted
Posted
On 12/26/2022 at 11:35 AM, whoknows said:

@BataBo adding variant protected with General Library Mode

 

jg7P8tQ.png

  

https://www.upload.ee/files/14777777/03_variant.rar.html

 

I saw that i can't run on my pc but here's what i did :

I downloaded the dnguard hvm trial and protected a file with it and it wasn't hvm so i used updated dnguard hvm unpacker updated by @CodeExplorer for trial just strings are problem pictures(i didn't use string encryption u can try it urself by downloading trial version) : 

tempsnip.png.4069c8d4c58542f67c3a7ec5feb985af.png

tempsnip2.png

Debug_Protected.rarFile i used 

  • Like 1
Link to comment
Share on other sites
whoknows

whoknows

Posted
Posted (edited)

using the JIT-Freezer

on native protected with the latest (v4.2) trial version on post

01_variant = options selected
02_variant = nothing selected

 

m4FNiYZ.png

dumps 

https://www.upload.ee/files/14806933/Dumps.rar.html

CyoxoGu.png

using Dnguard_Fr4_v1-codecracker against DNRuntime.dll || WindowsFormsApplication4.exe getting an error @CodeExplorer @BataBo

 

[edit]

oh both are bad by default  

[MD](0x80131205): Error (Structural): Table=0x0000000c, Col=0x00000000, Row=0x0000000d, has coded rid out of range.
1 Error(s) Verifying DNRuntime.dll

[MD](0x80131205): Error (Structural): Table=0x0000000c, Col=0x00000000, Row=0x00000010, has coded rid out of range.
1 Error(s) Verifying WindowsFormsApplication4.exe

 

[edit]

No AppDomains in .NET Core! Why?
stackoverflow.com/q/27266907

 

 

Edited by whoknows
adding shi..t
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing
×
×
  • Create New...