EB00
March 15th, 2012, 05:53
Hi guys,
I am currently facing a target which seems to be protected with Remotesoft's Salamander Protector. The target is a msi setup which asks for a license file during the installation routine.
Now after reading the excellent articles of Daniel Pistelli on native compiling of .net modules and the analysis of the salamander protection, I expected some success beating this one. Unfortunately, so far I didn't. Here's what I have:
1) The msi extracts serveral files in the temporary directory, including a .net file <vendor>_Licensing_<blabla>.dll which is a .net file. Analysis of reflector brings up that every method has been replaced with an empty stub, so all I can see is ret 0; most of the time. Some other extracted files do have "Remotesoft Salamander bla bla" strings in it, so that's how I found out about the protection. However, I don't see any rscoree.dll as it has been described by Daniel.
2) My first naive approach was to attach dile to the setup anyway and see what happens. Dile stops at an exception caused by the License manager, I can verify from the call stack that several methods from the <vendor>_Licensing_<blabla>.dll are called, but as described above this file has been protected, so dile cannot provide any more information than reflector does.
3) After some research I found Daniel's articles which also is my first contact with this native compiling stuff of .net modules. So following his hints, I had a look at the GAC. I found a file called <vendor>_Licensing_<blabla>.dll_ (mind the '_' at the end) which has a size of 0kb?!
Now here I am and don't know what's actually happening
I am currently facing a target which seems to be protected with Remotesoft's Salamander Protector. The target is a msi setup which asks for a license file during the installation routine.
Now after reading the excellent articles of Daniel Pistelli on native compiling of .net modules and the analysis of the salamander protection, I expected some success beating this one. Unfortunately, so far I didn't. Here's what I have:
1) The msi extracts serveral files in the temporary directory, including a .net file <vendor>_Licensing_<blabla>.dll which is a .net file. Analysis of reflector brings up that every method has been replaced with an empty stub, so all I can see is ret 0; most of the time. Some other extracted files do have "Remotesoft Salamander bla bla" strings in it, so that's how I found out about the protection. However, I don't see any rscoree.dll as it has been described by Daniel.
2) My first naive approach was to attach dile to the setup anyway and see what happens. Dile stops at an exception caused by the License manager, I can verify from the call stack that several methods from the <vendor>_Licensing_<blabla>.dll are called, but as described above this file has been protected, so dile cannot provide any more information than reflector does.
3) After some research I found Daniel's articles which also is my first contact with this native compiling stuff of .net modules. So following his hints, I had a look at the GAC. I found a file called <vendor>_Licensing_<blabla>.dll_ (mind the '_' at the end) which has a size of 0kb?!
Now here I am and don't know what's actually happening