First try-out release of my protection..

[LibX]

Its pretty much alpha code so don't expect to much of it,
also i only tested it with windows xp so i realy don't know if its even running on vista

check attachment

[UFO-Pu55y]

Its pretty much alpha code so don't expect to much of it,
also i only tested it with windows xp so i realy don't know if its even running on vista

check attachmentNice job ! Fishing is a fingersnip, coz of ur op_Equality(string, string)... 35383B9D4C7F2E71B2FE7717B40B0776

but keygenning this bitch ? ;\

[rendari]

Editted For Extreme Idioct ><

What debugger did you use UFO?

[UFO-Pu55y]

What debugger did you use UFO?Clean Olly.
Wait until we get this $ymbol shit into olly. It will be the age of laughter :D

[LibX]

Nice job ! Fishing is a fingersnip, coz of ur op_Equality(string, string)... 35383B9D4C7F2E71B2FE7717B40B0776

but keygenning this bitch ? ;\
Fishing is a fingersnip -> Its not that easy trust me ;)

And about the debuggers used, wait till i implemented all anti-debugger code ;p

[rongchaua]

@LibX: You crackme is very interesting. I'm doing it. By the way, your crackme does not run on my Vista Business Germany. :D.
@All: I have use my Anti-Flow-Control-Obfuscation for LibX crackme. It can be now shown under Reflector. Just for researching it more easier.
http://rongchaua.net/Web/Tmp/TestRun.zip

Until now I don't understand how your packer works. Just write down something I know

Entrypoint


[STAThread]
private static void Method_00()
{
Class_00.Method_03(); //Gabage Collector. I see this code in Kurapica Tuts
Application.EnableVisualStyles();
Application.SetCompatibleTextRenderingDefault(fals e);
Application.Run(new Class_03()); //Start Form
}


Constructor of Class_03


public Class_03()
{
ProtectorRuntime.Init(); //Don't know what is this? :D
Field_06 = (Class_04) EncryptedMethodHelper.Deserialize(new MemoryStream(Field_07)).CreateDelegate(typeof(Clas s_04)); //Don't know what it is. :D
this.Method_00(); //InitializeComponents
}


I hope someone can explain further.

Regards.

[UFO-Pu55y]

Fishing is a fingersnip -> Its not that easy trust me ;)I've made a very small video show off:
http://www.filesend.net/download.php?f=adf817797d6382f9b3548f11bf6b8fac

Actually it doesn't have much to do with LibX's keygenme.. no way.
It won't help keygenning nor deobfuscating in any way :rolleyes:

But I thought, that it might be generally interesting.
You will see how to use conditional BPs in mscorlib
to see the correct serials at runtime... check it out !

[LibX]

I've made a very small video show off:
http://www.filesend.net/download.php?f=adf817797d6382f9b3548f11bf6b8fac

Actually it doesn't have much to do with LibX's keygenme.. no way.
It won't help keygenning nor deobfuscating in any way :rolleyes:

But I thought, that it might be generally interesting.
You will see how to use conditional BPs in mscorlib
to see the correct serials at runtime... check it out !

Well post a serial and see if it works for other people :P

But very nice tutorial i must say :)

[UFO-Pu55y]

Well post a serial and see if it works for other people :PWell..
Name: UFO-Pu55y
Serial: 35383B9D4C7F2E71B2FE7717B40B0776

It doesn't :? At least it did for me.. also on Vista in VM.

Anyway my current level of knowledge wouldn't allow me to keygen it.
I'm far off behind :p

And tracing the interesting baby in Olly..
L_0037: callvirt instance string .
/
::Invoke(string)
L_003c: callvirt instance uint8[] [mscorlib]System.Text.Encoding::GetBytes(string)
L_0041: stloc.2 .. is a farce. Without symbols and stuff you're lost at once. I think unless you're an alien,
this approach won't help anybody keygenning it :D

PS: I'm generally working on getting .net method lables into Olly....

[rongchaua]

Hi LibX,
is this the code for checking the serial? Because you are using delegate so after deobfuscating Reflector can not recover source code in high level format. I'm doing my best to recover all of them. String Recovery may be the first step.;)).


.method private hidebysig static bool Method_02(string, string) cil managed
{
.maxstack 69
.locals init (
[0] class [mscorlib]System.Security.Cryptography.MD5CryptoServiceProvi der provider,
[1] uint8[] buffer,
[2] uint8[] buffer2,
[3] uint8[] buffer3,
[4] int32 num,
[5] bool flag)
L_0000: newobj instance void [mscorlib]System.Security.Cryptography.MD5CryptoServiceProvi der::.ctor()
L_0005: stloc.0
L_0006: call class [mscorlib]System.Text.Encoding [mscorlib]System.Text.Encoding::get_ASCII()
L_000b: ldsfld class Namespace_03.Class_03/Class_04 Namespace_03.Class_03::Field_06
L_0010: call string Namespace_03.Class_03::Method_03()
L_0015: callvirt instance string Namespace_03.Class_03/Class_04::Invoke(string)
L_001a: callvirt instance uint8[] [mscorlib]System.Text.Encoding::GetBytes(string)
L_001f: stloc.1
L_0020: call class [mscorlib]System.Text.Encoding [mscorlib]System.Text.Encoding::get_ASCII()
L_0025: ldsfld class Namespace_03.Class_03/Class_04 Namespace_03.Class_03::Field_06
L_002a: ldarg.0
L_002b: callvirt instance string Namespace_03.Class_03/Class_04::Invoke(string)
L_0030: callvirt instance uint8[] [mscorlib]System.Text.Encoding::GetBytes(string)
L_0035: stloc.2
L_0036: ldloc.0
L_0037: callvirt instance void [mscorlib]System.Security.Cryptography.HashAlgorithm::Initia lize()
L_003c: ldloc.0
L_003d: ldloc.1
L_003e: ldc.i4.0
L_003f: ldloc.1
L_0040: ldlen
L_0041: conv.i4
L_0042: callvirt instance uint8[] [mscorlib]System.Security.Cryptography.HashAlgorithm::Transf ormFinalBlock(uint8[], int32, int32)
L_0047: pop
L_0048: ldloc.0
L_0049: callvirt instance uint8[] [mscorlib]System.Security.Cryptography.HashAlgorithm::get_Ha sh()
L_004e: stloc.1
L_004f: ldloc.0
L_0050: callvirt instance void [mscorlib]System.Security.Cryptography.HashAlgorithm::Initia lize()
L_0055: ldloc.0
L_0056: ldloc.2
L_0057: ldc.i4.0
L_0058: ldloc.2
L_0059: ldlen
L_005a: conv.i4
L_005b: callvirt instance uint8[] [mscorlib]System.Security.Cryptography.HashAlgorithm::Transf ormFinalBlock(uint8[], int32, int32)
L_0060: pop
L_0061: ldloc.0
L_0062: callvirt instance uint8[] [mscorlib]System.Security.Cryptography.HashAlgorithm::get_Ha sh()
L_0067: stloc.2
L_0068: ldloc.1
L_0069: ldlen
L_006a: conv.i4
L_006b: newarr uint8
L_0070: stloc.3
L_0071: ldc.i4.0
L_0072: stloc.s num
L_0074: ldloc.s num
L_0076: ldloc.3
L_0077: ldlen
L_0078: conv.i4
L_0079: blt.s L_0082
L_007b: ldloc.3
L_007c: call string [mscorlib]System.BitConverter::ToString(uint8[])
L_0081: ldc.i4 0x6171
L_0086: call string Namespace_01.Class_01::Method_00(int32)
L_008b: ldc.i4 0x6176
L_0090: call string Namespace_01.Class_01::Method_00(int32)
L_0095: callvirt instance string [mscorlib]System.String::Replace(string, string)
L_009a: ldarg.1
L_009b: call bool [mscorlib]System.String::op_Equality(string, string)
L_00a0: brfalse.s L_00cc
L_00a2: ldc.i4.1
L_00a3: stloc.s flag
L_00a5: ldloc.s flag
L_00a7: ret
}

[LibX]

Well..
Name: UFO-Pu55y
Serial: 35383B9D4C7F2E71B2FE7717B40B0776

It doesn't :? At least it did for me.. also on Vista in VM.

Anyway my current level of knowledge wouldn't allow me to keygen it.
I'm far off behind :p

And tracing the interesting baby in Olly..
L_0037: callvirt instance string .
/
::Invoke(string)
L_003c: callvirt instance uint8[] [mscorlib]System.Text.Encoding::GetBytes(string)
L_0041: stloc.2 .. is a farce. Without symbols and stuff you're lost at once. I think unless you're an alien,
this approach won't help anybody keygenning it :D

PS: I'm generally working on getting .net method lables into Olly....
Well it works on my computer also, but that doesn't mean anything yet :P

[rongchaua]

Hi LibX,
how about my question? Is that the method for checking serial number?

[LibX]

Hi LibX,
how about my question? Is that the method for checking serial number?
Yes, at least its a part of it :)

[rendari]

Serial Works fine on my computer too UFO. GJ. 2 questions:
1) How did you resolve mscorlib symbols in olly?
2) What plugin did you use for conditional BP?

[UFO-Pu55y]

1) How did you resolve mscorlib symbols in olly?Still manually :-/ Man, that sux. But once you've labeled them,
they seem to be valid for every loaded .net app. And this feels nice !
For example mscorlib.dll: The labels will stay in Olly's mscorlib.ni.udd (not mscorlib.udd !),
since this dll is loaded from GAC, unlike the other ones :?
Anyway.. atm I go like this: Assembling a DoNothing.IL, which contains nothing but a shitload of calls to methods.
Then I load it into Olly and brake on that method (via BP at compileMethod).
Well, and then once arrived in the jitted stuff, simply following the calls
and labeling them (SHIFT + ":"). Olly will remember them anyway..
(Btw, there's this LabelMaster plugin, but loading the required files each time sux.)

2) What plugin did you use for conditional BP?No plugin. Simply SHIFT + F2...
I'm also new to this. There's some info in olly.hlp ofc, but it needs some time figuring it out.
I think cond. BPs are atm the only way to go, when dealing with net in olly.
And I never liked the handling of PEBrowse (this keygenme kills it anyway
by checking for PEBrowseDotNETProfiler.dll or something ? I dunno)

But what sux most is, there are no symbols to share, yet.
Coz the RVAs for the methods will be different on another box anyway :/
But at least a portable script for braking at a desired method is doable.
I cool plugin needs to be finally written !!!

/EDIT
Sry SHIFT + F4 for cond. BP with log ofc

[rendari]

Hmm, never would have thought of using the UDDs... I always wipe them from target to target, to keep my directory clean.

Unfortunately, on Vista the DLLs always load into different locations, so I dont think your method would work for me. Still have to find some way to resolve symbols on this bitch, but like I said I have next to no experience with that :S

[bigmouse]

Well post a serial and see if it works for other people :P

But very nice tutorial i must say :)

Intel Cpu
Name: bigmouse
Serial: 70797F994C7A6B75F6BA7317F10E0372


Amd Cpu
Name: bigmouse
Serial: 7F619901477229E06A5AABF546911142

[UFO-Pu55y]

Nice. I also noticed the "IntelGenuine" string today...

@bigmouse:
I guess you're on custom tools ?

[LibX]

Nice to see u people make progress :)
But i didn't see a keygen yet :P

Btw working on final version, it will be virtualy impossible to debug :D

[bigmouse]

keygenLibx.rar (132.80 kB) :

Download Link: http://www.filesend.net/download.php?f=58596e4dbaa8352cab742604efccf2a3

could you explain the usage of "Math.IEEERemainder"?

[Andu]

LibX, why don't you use an assymetric operation to prevent any keygening?

[LibX]

LibX, why don't you use an assymetric operation to prevent any keygening?
Its just a try out to check how the method itself will work in real life :)
But prepare for the next release it will have the full strength protection implementation and will be a real bitch to even get it running under a debugger ;)

Regards
LibX

[bigmouse]

Nice job bigmouse!
Could u write a tutorial on how u did this? would be very helpfull for the rest of the guys here.

Now i can start working on my final version

Regards
LibX

your protector use System.Reflection.Emit.DynamicMethod to excute protected method.
after you construct DynamicMethod object, we can get back org methodbody from it.

so ,just inject into LXCodeProtector.EncryptedMethodHelper::Deserialize

jithook is a possible way to do this job.

[LibX]

your protector use System.Reflection.Emit.DynamicMethod to excute protected method.
after you construct DynamicMethod object, we can get back org methodbody from it.

so ,just inject into LXCodeProtector.EncryptedMethodHelper::Deserialize

jithook is a possible way to do this job.
yeah i know :P but i think people would like a detailed tutorial about how todo this ;)

[tankaiha]

don't know if this is the original msil
hope Liby can show us the original C# code

IL_0000: nop
IL_0001: ldstr "B455C37C42F8B0590B43025D5AD7D1A450F9FEFB8B80BE1FEA 1DB54D90D05C41"
IL_0006: callvirt instance char[] [mscorlib]System.String::ToCharArray()
IL_000b: stloc.0
IL_000c: ldstr "A69D258AC689461C9B2A03CAE4FD2F5725F1CC4EC716F77CBC 851C0507352091"
IL_0011: callvirt instance char[] [mscorlib]System.String::ToCharArray()
IL_0016: stloc.1
IL_0017: ldloc.0
IL_0018: ldlen
IL_0019: conv.i4
IL_001a: newarr [mscorlib]System.Byte
IL_001f: stloc.2
IL_0020: ldarg.0
IL_0021: callvirt instance char[] [mscorlib]System.String::ToCharArray()
IL_0026: stloc.3
IL_0027: ldc.i4.0
IL_0028: stloc.s 4
IL_002a: ldc.i4.0
IL_002b: stloc.s 5
IL_002d: br IL_014b
IL_0032: nop
IL_0033: ldc.i4.s 73
IL_0035: stloc.s 6
IL_0037: ldloc.s 4
IL_0039: ldloc.3
IL_003a: ldlen
IL_003b: conv.i4
IL_003c: clt
IL_003e: stloc.s 9
IL_0040: ldloc.s 9
IL_0042: brtrue IL_0095
IL_0044: nop
IL_0045: ldc.i4.0
IL_0046: stloc.s 4
IL_0048: ldc.i4.0
IL_0049: stloc.s 7
IL_004b: br IL_0085
IL_004d: nop
IL_004e: call bool [mscorlib]System.Diagnostics.Debugger::get_IsAttached()
IL_0053: ldc.i4.0
IL_0054: ceq
IL_0056: stloc.s 9
IL_0058: ldloc.s 9
IL_005a: brtrue IL_006e
IL_005c: nop
IL_005d: ldloc.3
IL_005e: ldloc.s 7
IL_0060: ldloc.3
IL_0061: ldloc.s 7
IL_0063: ldelem.u2
IL_0064: ldc.i4.2
IL_0065: add
IL_0066: ldc.i4.s 36
IL_0068: xor
IL_0069: conv.u2
IL_006a: stelem.i2
IL_006b: nop
IL_006c: br IL_007e
IL_006e: nop
IL_006f: ldloc.3
IL_0070: ldloc.s 7
IL_0072: ldloc.3
IL_0073: ldloc.s 7
IL_0075: ldelem.u2
IL_0076: ldc.i4.2
IL_0077: add
IL_0078: ldc.i4.s 37
IL_007a: xor
IL_007b: conv.u2
IL_007c: stelem.i2
IL_007d: nop
IL_007e: nop
IL_007f: ldloc.s 7
IL_0081: ldc.i4.1
IL_0082: add
IL_0083: stloc.s 7
IL_0085: ldloc.s 7
IL_0087: ldloc.3
IL_0088: ldlen
IL_0089: conv.i4
IL_008a: clt
IL_008c: stloc.s 9
IL_008e: ldloc.s 9
IL_0090: brtrue IL_014d
IL_0092: nop
IL_0093: br IL_00f7
IL_0095: ldloc.s 4
IL_0097: ldloc.3
IL_0098: ldlen
IL_0099: conv.i4
IL_009a: ldc.i4.3
IL_009b: sub
IL_009c: ceq
IL_009e: ldc.i4.0
IL_009f: ceq
IL_00a1: stloc.s 9
IL_00a3: ldloc.s 9
IL_00a5: brtrue IL_00d3
IL_00a7: nop
IL_00a8: ldc.i4.0
IL_00a9: stloc.s 7
IL_00ab: br IL_00c3
IL_00ad: nop
IL_00ae: ldloc.3
IL_00af: ldloc.s 7
IL_00b1: ldloc.3
IL_00b2: ldloc.s 7
IL_00b4: ldelem.u2
IL_00b5: ldc.i4.4
IL_00b6: add
IL_00b7: ldc.i4.s 68
IL_00b9: xor
IL_00ba: conv.u2
IL_00bb: stelem.i2
IL_00bc: nop
IL_00bd: ldloc.s 7
IL_00bf: ldc.i4.1
IL_00c0: add
IL_00c1: stloc.s 7
IL_00c3: ldloc.s 7
IL_00c5: ldloc.3
IL_00c6: ldlen
IL_00c7: conv.i4
IL_00c8: clt
IL_00ca: stloc.s 9
IL_00cc: ldloc.s 9
IL_00ce: brtrue IL_0176
IL_00d0: nop
IL_00d1: br IL_00f7
IL_00d3: nop
IL_00d4: ldloc.3
IL_00d5: ldloc.s 4
IL_00d7: ldelem.u2
IL_00d8: stloc.s 6
IL_00da: ldloc.s 4
IL_00dc: ldc.i4.1
IL_00dd: add
IL_00de: stloc.s 4
IL_00e0: call bool [mscorlib]System.Diagnostics.Debugger::get_IsAttached()
IL_00e5: ldc.i4.0
IL_00e6: ceq
IL_00e8: stloc.s 9
IL_00ea: ldloc.s 9
IL_00ec: brtrue IL_00f6
IL_00ee: nop
IL_00ef: ldloc.s 4
IL_00f1: ldc.i4.1
IL_00f2: add
IL_00f3: stloc.s 4
IL_00f5: nop
IL_00f6: nop
IL_00f7: ldloc.s 5
IL_00f9: conv.r8
IL_00fa: ldc.r8 2.000000
IL_0103: call float64 [mscorlib]System.Math::IEEERemainder(float64,float64)
IL_0108: ldc.r8 1.000000
IL_0111: ceq
IL_0113: ldc.i4.0
IL_0114: ceq
IL_0116: stloc.s 9
IL_0118: ldloc.s 9
IL_011a: brtrue IL_0131
IL_011c: nop
IL_011d: ldloc.2
IL_011e: ldloc.s 5
IL_0120: ldloc.0
IL_0121: ldloc.s 5
IL_0123: ldelem.u2
IL_0124: ldloc.s 6
IL_0126: and
IL_0127: ldloc.1
IL_0128: ldloc.s 5
IL_012a: ldelem.u2
IL_012b: xor
IL_012c: conv.u1
IL_012d: stelem.i1
IL_012e: nop
IL_012f: br IL_0144
IL_0131: nop
IL_0132: ldloc.2
IL_0133: ldloc.s 5
IL_0135: ldloc.0
IL_0136: ldloc.s 5
IL_0138: ldelem.u2
IL_0139: ldloc.s 6
IL_013b: xor
IL_013c: ldloc.1
IL_013d: ldloc.s 5
IL_013f: ldelem.u2
IL_0140: xor
IL_0141: conv.u1
IL_0142: stelem.i1
IL_0143: nop
IL_0144: nop
IL_0145: ldloc.s 5
IL_0147: ldc.i4.1
IL_0148: add
IL_0149: stloc.s 5
IL_014b: ldloc.s 5
IL_014d: ldloc.0
IL_014e: ldlen
IL_014f: conv.i4
IL_0150: clt
IL_0152: stloc.s 9
IL_0154: ldloc.s 9
IL_0156: brtrue IL_0032
IL_015b: ldloc.2
IL_015c: call string [mscorlib]System.BitConverter::ToString(uint8[])
IL_0161: ldstr "-"
IL_0166: ldstr ""
IL_016b: callvirt instance string [mscorlib]System.String::Replace(string,string)
IL_0170: stloc.s 8
IL_0172: br IL_0174
IL_0174: ldloc.s 8
IL_0176: ret

[rendari]

bigmouse wins again :) gj

[Kurapica]

Bigmouse doesn't seem to be a sharing fan !!

I hope he can show us his way ???

[JackTheRipper]

Bigmouse doesn't seem to be a sharing fan !!

I hope he can show us his way ???

Yes, please; me too think that a tutor will be nice ;)

[bigmouse]

from dynamicmethod object we can get COR_METHOD_HANDLE value ,which is needed for jithook to identify method.
for runtime hook, do not hook getjit function's first 5 bytes, hook somewhere else.
as me,i used a modified mscorjit.dll.

from jithook, we can get back every method which being compiled.
store into a dictionary (COR_METHOD_HANDLE => MethodData).

for a few methods,COR_METHOD_HANDLE is needless,
we can guess which data belongsto which method.

[tankaiha]

from dynamicmethod object we can get COR_METHOD_HANDLE value ,which is needed for jithook to identify method.
for runtime hook, do not hook getjit function's first 5 bytes, hook somewhere else.
as me,i used a modified mscorjit.dll.

from jithook, we can get back every method which being compiled.
store into a dictionary (COR_METHOD_HANDLE => MethodData).

for a few methods,COR_METHOD_HANDLE is needless,
we can guess which data belongsto which method.

this simple explanation is great! i know more about jit hook.

for this crackme, we don't need such low level hook, using windbg is OK.

of coz, Liby will update it soon, implement more protections, so windbg may not work. then we may have to come back to low level jit hooking.

:)

[LibX]

Here is the original code


private static string Process(string Y)
{
char[] A = "B455C37C42F8B0590B43025D5AD7D1A450F9FEFB8B80BE1FEA 1DB54D90D05C41".ToCharArray();
char[] C = "A69D258AC689461C9B2A03CAE4FD2F5725F1CC4EC716F77CBC 851C0507352091".ToCharArray();
byte[] B = new byte[A.Length];
char[] H = Y.ToCharArray();
int j = 0;
for (int i = 0; i < A.Length; i++)
{
char t = 'I';
if (j >= H.Length)
{
j = 0;
for (int k = 0; k < H.Length; k++)
{
if (Debugger.IsAttached)
{
H[k] = (char)((H[k] + 2) ^ 0x24);
}
else
{
H[k] = (char)((H[k] + 2) ^ 0x25);
}
}
}
else if (j == H.Length - 3)
{
for (int k = 0; k < H.Length; k++)
{
H[k] = (char)((H[k] + 4) ^ 0x44);
}
}
else
{
t = H[j];
j++;
if (Debugger.IsAttached)
{
j++;
}
}
if (Math.IEEERemainder(i, 2) == 1)
{
B[i] = (byte)((A[i] & t) ^ C[i]);
}
else
{
B[i] = (byte)((A[i] ^ t) ^ C[i]);
}
}
return BitConverter.ToString(B).Replace("-", "");
}

[rongchaua]

don't know if this is the original msil
hope Liby can show us the original C# code

[CODE] IL_0000: nop
IL_0001: ldstr "B455C37C42F8B0590B43025D5AD7D1A450F9FEFB8B80BE1FEA 1DB54D90D05C41"
IL_0006: callvirt instance char[] [mscorlib]System.String::ToCharArray()
IL_000b: stloc.0
IL_000c: ldstr "A69D258AC689461C9B2A03CAE4FD2F5725F1CC4EC716F77CBC 851C0507352091"
IL_0011: callvirt instance char[] [mscorlib]System.String::ToCharArray()
IL_0016: stloc.1
IL_0017: ldloc.0
IL_0018: ldlen
IL_0019: conv.i4
IL_001a: newarr [mscorlib]System.Byte
IL_001f: stloc.2
IL_0020: ldarg.0
IL_0021: callvirt instance char[] [mscorlib]System.String::ToCharArray()
IL_0026: stloc.3
IL_0027: ldc.i4.0
IL_0028: stloc.s 4
IL_002a: ldc.i4.0
IL_002b: stloc.s 5
.....

@tankaiha: Would you mind to make a short tut telling how you get this IL code back? Thank you.

[tankaiha]

@rongchaua: i don't have time to write tut, so i just make a video tut in minutes, hope it's helpful

@Liby: thank's for such good crackme. btw, do you still remember the preface about the book? do you have free time these days? :)

http://rapidshare.com/files/110214087/dump_dynamic_method.rar.html