Cracking an assembly protected with {smartassembly} 3.2

[Slashmolder]

I am attempting to crack an application protected with the newest version of {smartassembly} (3.2). I found a function which can decrypt the resources here: http://forum.tuts4you.com/showtopic=18498.

The first step I did when trying to crack was use {smartkill} and {smartassasin} which both did not work. They do not support the newest smart assembly.

After that I removed the fake meta header that way I could open the application in reflector. Now, where I am stuck is attempting to remove the strong name. Every single program I use breaks the application when removing the strong name. I am told {smartassembly} uses the strong name in the string encryption so that way I must decrypt all the strings before I remove the strong name.

That is where I am stuck. Any help would be appreciated.

Copy of the exe, both the original one and the one patched without the fake meta header:
http://rapidshare.com/files/198615947/ClubLiveLBI_1.0.rar

[rongchaua]

@Slashmolder:
1. I have removed strong name in your file to make it work with my DeSmart.
2. I have deobfuscate your files http://www.megaupload.com/de/?d=NQG76P1R . However the string is still encrypted.
3. If someone has time and would like to help me improve my DeSmart. Then use the target above to rip the decrypted function. I get lost when rip this function. It relates to a lot of another classes.

http://img140.imageshack.us/img140/9592/1602bj0.png

[Slashmolder]

Sorry to say it still breaks the exe because the strings aren't decrypted. I need to decrypt the strings before I remove the strong name because in {SA} the encrypted strings use the strong name to decrypt the strings.

[RapidCrash]

I was working with a few protected apps myself, and the strings are the easy part.

If you disassemble a program that has been deobfuscated with DeSmart, look through the resources. One resource has a bunch of hex (in mine it's the 3rd resource). This is your strings database. Each string is base64-encoded. Before each string, there is also a byte that determines the length of the string. If the situation requires, more than that one byte will be used for the string length.
If you wish to find a specific string that's referenced, I use this simple formula for finding the entry_point:

DB_Entry = Given_Offset - Common_Offset

The way I found the common offset was I took a string that I KNEW what it was supposed to be and plugged them in to find the Common_Offset, however there does appear to be some other way to do this as referenced by the function for making the calls. Here is the actual function used across all SmartAssembly-protected applications for strings:

public static unsafe string Method_0(int num1)
{
byte[] buffer;
Assembly assembly;
byte[] buffer2;
int num;
int num2;
int num3;
int num4;
byte[] buffer3;
Type type;
Guid guid;
Monitor.Enter(type = typeof(Class_4_Object));
Label_0012:
try
{
if (Field_0 != null)
{
goto Label_00A0;
}
assembly = Assembly.GetExecutingAssembly();
Field_0 = assembly.GetManifestResourceStream(&assembly.ManifestModule.ModuleVersionId.ToString("B"));
buffer2 = assembly.GetName().GetPublicKeyToken();
if (buffer2 == null)
{
goto Label_0079;
}
num = 0;
Label_0057:
Field_1 ^= (buffer2[num] << 8) + buffer2[num + 1];
num += 2;
if (num < (((int) buffer2.Length) - 1))
{
goto Label_0057;
}
Label_0079:
num2 = ((MethodBase.GetCurrentMethod().MetadataToken & 0xffffff) - 1) % 0xffff;
Field_1 ^= num2;
Label_00A0:
Field_0.Position = (long) (num1 - Field_1);
num3 = Field_0.ReadByte();
num4 = 0;
if ((num3 & 0x80) != null)
{
goto Label_00CF;
}
num4 = num3;
Label_00CF:
if ((num3 & 0x40) != null)
{
goto Label_00EC;
}
num4 = ((num3 & 0x3f) << 8) + Field_0.ReadByte();
goto Label_011C;
Label_00EC:
num4 = ((((num3 & 0x1f) << 0x18) + (Field_0.ReadByte() << 0x10)) + (Field_0.ReadByte() << 8)) + Field_0.ReadByte();
Label_011C:
buffer = new byte[num4];
Field_0.Read(buffer, 0, num4);
goto Label_013D;
}
finally
{
Label_0135:
Monitor.Exit(type);
}
Label_013D:
if (((int) buffer.Length) != null)
{
goto Label_0148;
}
return string.Empty;
Label_0148:
buffer3 = Convert.FromBase64String(Encoding.UTF8.GetString(b uffer, 0, (int) buffer.Length));
return string.Intern(Encoding.UTF8.GetString(buffer3, 0, (int) buffer3.Length));
}






When I get more information on this, I'll be sure to let you know.

[Nitrogen]

hello
i'm need help with encrypted strings
saved res here: http://aftalik.firstvds.ru/ps/ps.bin
this res from PocketShield (.NET CF + smartassembly v2.0.50727)

look like strings are decrypting with this code:
internal sealed class Class_14
{
// Fields
private static byte[] Field_00;
private static int Field_01;

// Methods
static Class_14()
{
Assembly executingAssembly = Assembly.GetExecutingAssembly();
using (Stream stream = executingAssembly.GetManifestResourceStream("{a38ee919-3e39-4e8a-85ef-b57391248334}"))
{
int count = Convert.ToInt32(stream.Length);
byte[] buffer = new byte[count];
stream.Read(buffer, 0, count);
Field_00 = Class_00.Method_00(buffer);
buffer = null;
stream.Close();
}
Field_01 = 0;
byte[] publicKeyToken = executingAssembly.GetName().GetPublicKeyToken();
if (publicKeyToken != null)
{
int index = 0;
do
{
Field_01 ^= (publicKeyToken[index] << 8) + publicKeyToken[index + 1];
index += 2;
}
while (index < (publicKeyToken.Length - 1));
}
}

public static string Method_00(int num1)
{
int count = 0;
int index = num1 - Field_01;
int num3 = Field_00[index++];
if ((num3 & 0x80) == 0)
{
count = num3;
if (count == 0)
{
return string.Empty;
}
}
else
{
if ((num3 & 0x40) == 0)
{
count = ((num3 & 0x3f) << 8) + Field_00[index++];
}
count = ((((num3 & 0x1f) << 0x18) + (Field_00[index++] << 0x10)) + (Field_00[index++] << 8)) + Field_00[index++];
}
try
{
byte[] bytes = Convert.FromBase64String(Encoding.UTF8.GetString(F ield_00, index, count));
return string.Intern(Encoding.UTF8.GetString(bytes, 0, bytes.Length));
}
catch
{
return null;
}
}
}


main .exe file here: http://aftalik.firstvds.ru/ps/ps.exe
after desmart: http://aftalik.firstvds.ru/ps/ps_after_desmart.exe