allumette
09-13-2009, 06:40 PM
Hello ^^
I've got a .net software, protected by Xenocode, which create an emulate env in memory after the main exe was launched (sorry 'bout my engl. and if it seems a strange way to resume the thing)
This software is Timelimited, 15days using. At the startup of the main exe a window appear, where you need to click on Register or any other buttons, in our case <Try>.
After that we reach in the app', where we launch an auto import of data (in some specific directory on the system).
Well, to trick Xenocode 2008 Postbuild, i'd not reach result with WinDbg and Ollu, (humm yes we're talkin about .net no C, but i ve catch it after a brief approach :P), i'd try a method that seem to me more simple : LordPE
HowTo(i did :) ): in a VM VirtualBox type, XP 32Bits, no specific softwares loaded in memory (antivirus/spywares/etc...)
-Installing application
-Launching application
- Click on TRY to reach the main app
- Launching LordPE and Using Active Dump Engine >InteliDump
- Seekin for Dll's and the main exe of the app which are there grouped to be in the emulated environment by Xenocode (if i'm not on the wrong way)
- Finding the usefull Dll's needed for the execution of .exe and dump them Right click > Dump Full
Afterwhat i've :
Application's executable
Secondary executable (the one i launch when launching "import" fonction of the main app) and which is not present as file in application directory
Usefull Dll's for executing exe's
Everything seems to be right, cause after i can use Reflector to observe sourcecode
BUT the problem : the exe's and Dll's seems to be corrupted, cause i can't launch them or use them (Application can't successfully initialised (?! +-) (0x00007b) etc etc..)
So i let's try to rebuild with LordPE : it tried to manipulate headers or things, but nothing change.
Things: i don't use BR when i do Full dump with LordPE, maybe it's necessary ?
While dumping, the Dll's and Exe which are in the emulated env., i may apply some correction to get them workin in an "out of Xenocode" env.
In case, i can put dumped dll's and exe's if you want,
thank you for your point of view or any ideas or solutions, even if you may burn me inplace cause i said too many crap stuff in this thread ! ;):rolleyes:
anyones ? :(
I've got a .net software, protected by Xenocode, which create an emulate env in memory after the main exe was launched (sorry 'bout my engl. and if it seems a strange way to resume the thing)
This software is Timelimited, 15days using. At the startup of the main exe a window appear, where you need to click on Register or any other buttons, in our case <Try>.
After that we reach in the app', where we launch an auto import of data (in some specific directory on the system).
Well, to trick Xenocode 2008 Postbuild, i'd not reach result with WinDbg and Ollu, (humm yes we're talkin about .net no C, but i ve catch it after a brief approach :P), i'd try a method that seem to me more simple : LordPE
HowTo(i did :) ): in a VM VirtualBox type, XP 32Bits, no specific softwares loaded in memory (antivirus/spywares/etc...)
-Installing application
-Launching application
- Click on TRY to reach the main app
- Launching LordPE and Using Active Dump Engine >InteliDump
- Seekin for Dll's and the main exe of the app which are there grouped to be in the emulated environment by Xenocode (if i'm not on the wrong way)
- Finding the usefull Dll's needed for the execution of .exe and dump them Right click > Dump Full
Afterwhat i've :
Application's executable
Secondary executable (the one i launch when launching "import" fonction of the main app) and which is not present as file in application directory
Usefull Dll's for executing exe's
Everything seems to be right, cause after i can use Reflector to observe sourcecode
BUT the problem : the exe's and Dll's seems to be corrupted, cause i can't launch them or use them (Application can't successfully initialised (?! +-) (0x00007b) etc etc..)
So i let's try to rebuild with LordPE : it tried to manipulate headers or things, but nothing change.
Things: i don't use BR when i do Full dump with LordPE, maybe it's necessary ?
While dumping, the Dll's and Exe which are in the emulated env., i may apply some correction to get them workin in an "out of Xenocode" env.
In case, i can put dumped dll's and exe's if you want,
thank you for your point of view or any ideas or solutions, even if you may burn me inplace cause i said too many crap stuff in this thread ! ;):rolleyes:
anyones ? :(