My protection try-out

[LibX]

Its pretty much alpha code so don't expect to much of it,
also i only tested it with windows xp so i realy don't know if its even running on vista

Regards
LibX

[Marcello]

Its pretty much alpha code so don't expect to much of it,
also i only tested it with windows xp so i realy don't know if its even running on vista

Regards
LibX
Hi LibX,

.Net is a vulnerable platform! Better wait a native compiler from Microsoft :)

I appreciate you because at least you try to find a solution to the problem of decompilation of our .NET application. Perhaps you can sell your "idea" to some company ;)

You implements an your protection software but uses other tools to obscure your code? :eek: See here (http://www.cantelmosoftware.com/download/testrun_unpacked.zip)

best regards,
Marcello Cantelmo
www.cantelmosoftware.com

[LibX]

And maby u should check the code for real this time and find out one of the functions is totualy converted to a VM stucture and u didn't unpack anything the code is still encrypted ;)
The obfuscation is just there to prevent easy analyzing.

Basicly u didn't do anything yet :P

[LibX]

Ow and i forgot this:
<removed>

Its ur obfuscator totualy deobfuscated (control flow only renaming doesnt help anyway it just makes it easyer to save to a file) copy of ur obfuscator

Regards
LibX

[Marcello]

Ow and i forgot this:
<removed>

Its ur obfuscator totualy deobfuscated (control flow only renaming doesnt help anyway it just makes it easyer to save to a file) copy of ur obfuscator

Regards
LibX

good work mr. cracker! ;)

regards,
Marcello Cantelmo
www.cantelmosoftware.com

[LibX]

good work mr. cracker! ;)

regards,
Marcello Cantelmo
www.cantelmosoftware.com
hehe thx ;)
Now go and own my protection i wanna see code :P

[bigmouse]

seems to like what slm does, even simple .
slm use a vm to execute protected method,decrypted at instruction level.

your protector use System.Reflection.Emit.DynamicMethod to excute protected method.
after you construct DynamicMethod object, we can get back org methodbody from it.

[rendari]

Hmm, never knew about that protection method. Seems like I got a lot to learn. I'll take a look at it if I get time :S

[LibX]

seems to like what slm does, even simple .
slm use a vm to execute protected method,decrypted at instruction level.

your protector use System.Reflection.Emit.DynamicMethod to excute protected method.
after you construct DynamicMethod object, we can get back org methodbody from it.
Basicly they both use the same, but microsoft has the great advantage they have access to all internal sources ;p so they made a far easyer to handle DynamicMethod, but about the VM part its not realy a VM (at least for as far i got analyzing the protection)

About the methodbody, u wont get the original methodbody back ;) but u will find out soon enough

regards
LibX

[bigmouse]

DynamicMethod object is enough for me to get back the original methodbody .

i can't get your testsample run on the following OS.
Win98 + .Net V2.0.50727 [VMWare]
WinMe + .Net V2.0.50727 [VMWare]
Win2000 + .Net V2.0.50727 [VMWare]
Win xp + .Net V2.0.50727 [VMWare]
Win2003 + .Net V2.0.50727 [my pc]

[LibX]

DynamicMethod object is enough for me to get back the original methodbody .

i can't get your testsample run on the following OS.
Win98 + .Net V2.0.50727 [VMWare]
WinMe + .Net V2.0.50727 [VMWare]
Win2000 + .Net V2.0.50727 [VMWare]
Win xp + .Net V2.0.50727 [VMWare]
Win2003 + .Net V2.0.50727 [my pc]

Everything < windows 2000 won't be supported anyway, but it should run just fine on windows xp, maby it has something todo with vmware

[bigmouse]

also can't run on my PC.

[LibX]

also can't run on my PC.
It should be working just fine on windows 2003 just checked, but maby its detecting something and then crashes ;)

[bigmouse]

i'v test on windows 2003 server standard edition(sp2) and enterprise edition(sp2).
both can't run.
i closed all other program.

[bigmouse]

"detecting something and then crashes " any tips to avoid?

[LibX]

"detecting something and then crashes " any tips to avoid?
Hmm il check this out, but again its pretty much alpha code so don't expect to much of it yet :(
but il put it on my todo list for sure thx for testing it :)

[bigmouse]

my os:
windows 2003 jap
only installed visual studio 2008, visual basic 6, office 2003.
are you detect visual studio?!

[LibX]

my os:
windows 2003 jap
only installed visual studio 2008, visual basic 6, office 2003.
are you detect visual studio?!
lol no iam not that paranoid :D
i didn't test it on any unicode paged OS, can't think of why it should fail but maby thats the problem :(

[bigmouse]

keygenLibx.rar (132.80 kB) :

Download Link: http://www.filesend.net/download.php?f=58596e4dbaa8352cab742604efccf2a3

could you explain the usage of "Math.IEEERemainder"?

[LibX]

keygenLibx.rar (132.80 kB) :

Download Link: http://www.filesend.net/download.php?f=58596e4dbaa8352cab742604efccf2a3

could you explain the usage of "Math.IEEERemainder"?
Nice job bigmouse! :D
Could u write a tutorial on how u did this? :) would be very helpfull for the rest of the guys here.

Now i can start working on my final version ;)

Regards
LibX

[LibX]

Please continue the discussion in the new .NET reversing forum.