Log in

View Full Version : Unknown .Net protection?


braces
02-23-2009, 07:31 AM
Hello!
There is a program Articulate Studio '09 http://www.articulate.com
Is .Net program but packed/obfuscate.
What protection is?
Thank you!

http://rapidshare.com/files/201650681/Quizmaker.exe.html
MD5: 7AB94F513DC199B6C8F999424C6C4612

Thanks in advance!

Kurapica
02-23-2009, 10:47 AM
Can you just post the main exe ?

we don't want to download the entire package !!

braces
02-23-2009, 12:43 PM
Can you just post the main exe ?

we don't want to download the entire package !!

Thanks!
In this Studio '09 are four program Presenter '09, Quizmaker '09, Engage '09 and Video Encoder '09.
This main is from Quizmaker '09 - Quizmaker.exe.
http://rapidshare.com/files/201623176/Quizmaker.exe.html
MD5: 7AB94F513DC199B6C8F999424C6C4612
Thanks In Advance!

braces
02-23-2009, 01:27 PM
Thanks in advance!
http://rapidshare.com/files/201638922/Quizmaker.exe.html
MD5: 7AB94F513DC199B6C8F999424C6C4612

Kurapica
02-23-2009, 03:13 PM
You must be kiddin me !! right ?

There is no damn protection in this exe, even names obfuscation is not there.

at least read the tutors before asking such question again.

sirp
02-25-2009, 06:27 AM
hmm look into Articulate.Runtime.dll there u find the obfuscated stuff ,) .. i just had a look into that app .. and it uses DeployLX bah

void DeployLX.Licensing.v3.LicenseKeyAttribute::.ctor(s tring) = { string('$m|+m#}}R43)p4kGY6EQ%6T?B4]6mbjqW]w4BAw/t+H4]\u00b6&roBYhB.siKJ!yjs?C/%wt\'F6\'YSpiUXf\'38v.9Hdo`.]ab^I$7Q)N(lZ*-mNC\u00a7Y1ce(G#G-\u00a7;Sl^hNBz*#(r6(ml^gI+SZ-QsJW+$9b\u00a7AcpLdZ3Yd0UWQ+TH~%;7DeSX!W6yI&kN\u00a7fg0BfW9vA\u00b6[0cW2;MKx.dG6}DWl@+4}$|x\u00a7Ev\u00a7EsTw[&,P9jh;3Zs?_TrG6o\u00b6F[yX(HnH=)3=Oc-\u00a7]AQiw0N`W3)Pcn=fI!A\'oLajGbh?Jkr@_2W@#5kA1g84k_oope n$ne@iCeP}l`qE*+Uk*/I6KcG7&)^NWK~/OM\u00a74|NY/wkYZo66CWD?68?czo$3kdh+_8%^Ba\u00a75\u00b6f\u00a72 l~j:EIC6}s!I(vmd0{3&3|gN);an`tFYV-AXRSE8\u00a7|\u00a7K\'z}ljCFXUrrN{-z=#{f!4v/\'aL,Fk*)=o:i_x6EVz.m[O~vzA`;f^FPrYPZHk,*PlhgJi;e=P-XPO5iZ=K;h6%ZJUKZ\u00b6R1x?Nph(typr5eN&qPPUM5W1[1LhfZAU(r6QWO7@R,\u00b6w3`UW}DC|P:SEEyqr') }

braces
02-25-2009, 03:31 PM
hmm look into Articulate.Runtime.dll there u find the obfuscated stuff ,) .. i just had a look into that app .. and it uses DeployLX bah

void DeployLX.Licensing.v3.LicenseKeyAttribute::.ctor(s tring) = { string('$m|+m#}}R43)p4kGY6EQ%6T?B4]6mbjqW]w4BAw/t+H4]\u00b6&roBYhB.siKJ!yjs?C/%wt\'F6\'YSpiUXf\'38v.9Hdo`.]ab^I$7Q)N(lZ*-mNC\u00a7Y1ce(G#G-\u00a7;Sl^hNBz*#(r6(ml^gI+SZ-QsJW+$9b\u00a7AcpLdZ3Yd0UWQ+TH~%;7DeSX!W6yI&kN\u00a7fg0BfW9vA\u00b6[0cW2;MKx.dG6}DWl@+4}$|x\u00a7Ev\u00a7EsTw[&,P9jh;3Zs?_TrG6o\u00b6F[yX(HnH=)3=Oc-\u00a7]AQiw0N`W3)Pcn=fI!A\'oLajGbh?Jkr@_2W@#5kA1g84k_oope n$ne@iCeP}l`qE*+Uk*/I6KcG7&)^NWK~/OM\u00a74|NY/wkYZo66CWD?68?czo$3kdh+_8%^Ba\u00a75\u00b6f\u00a72 l~j:EIC6}s!I(vmd0{3&3|gN);an`tFYV-AXRSE8\u00a7|\u00a7K\'z}ljCFXUrrN{-z=#{f!4v/\'aL,Fk*)=o:i_x6EVz.m[O~vzA`;f^FPrYPZHk,*PlhgJi;e=P-XPO5iZ=K;h6%ZJUKZ\u00b6R1x?Nph(typr5eN&qPPUM5W1[1LhfZAU(r6QWO7@R,\u00b6w3`UW}DC|P:SEEyqr') }


Thanks sirp!
Is there a tutorial to unpack it?

sirp
02-27-2009, 04:06 AM
hmm i started the .dll in olly and then i tryed to dump it with winhex ..but still u cant use it properly in reflector
would be nice if someone got an tip ,)
neither u cant open the dll file with ida it crashes

Kurapica
02-27-2009, 07:42 AM
No need to unpack this Licensing DLL, all you have to do is to learn patching to the max, keep reading and trying till you become up to DeployLX !! all you have to do is to patch where the license classes are called, no other solution.

sirp
02-27-2009, 08:28 AM
yep ... i just tryed a bit of patchin in the runtime.dll .. after that the strongname was broken for sure ,) ... but that dll is only for the reg and about stuff .. only the lill error window pops up about strong name but app runs on lol
so ----> as kurapica says i think too : all you have to do is to patch where the license classes are called, no other solution.

braces
02-27-2009, 03:48 PM
yep ... i just tryed a bit of patchin in the runtime.dll .. after that the strongname was broken for sure ,) ... but that dll is only for the reg and about stuff .. only the lill error window pops up about strong name but app runs on lol
so ----> as kurapica says i think too : all you have to do is to patch where the license classes are called, no other solution.

One guy says that he has a keygen for thi and it send serial if you promote his site? How to make keygen without unpack it?!!