.NET Reactor discussion

[karlranseier]

sounds good but what do you think about .net reactor? it seems to offer more protection techniques but costs less.

[LibX]

sounds good but what do you think about .net reactor? it seems to offer more protection techniques but costs less.
.NET Reactor is fully build on stolen on GPL code (code u can't use in a closed source project) on top of that its the most crappy packer i have ever seen.

[karlranseier]

could you proof it?
i am interested in the protection technique. you could you post links the the source code .net reactor is based of?

[Andu]

Hello folks,

my question also regards .net Reactor. First I agree that the application mode protection is crap because it has been shown many times that it is possible to circumvent the protection in less than 5 minutes!

I have also seen a paper which seems to describe the basic principle, which .net Reactor seems to be based on (don't know if you refer to this paper with the gpl code, a link is very much appreciated).

But the Reactor offers two protection modes: application (which is easy to crack) and library mode, which I'm not shure off.

As I haven't seen any crackmes regarding library-mode-protected assemblies or tutorials on that topic my question is if anyone has tried to break this protection with activated necro bit. It seems to be tougher at first glance.
And a second thing: .net Reactor also offers a strong name removal protection. What do the experts think about this?

Regards,

Andu

[LibX]

could you proof it?
i am interested in the protection technique. you could you post links the the source code .net reactor is based of?
Its using code from Mono.Cecil, old versions uses code from first releases of .NET Reflector, it has a copy of the hurricane cipher in it also opensource (its a delphi unit), also QuickLZ is used and more .

[LibX]

Hello folks,

my question also regards .net Reactor. First I agree that the application mode protection is crap because it has been shown many times that it is possible to circumvent the protection in less than 5 minutes!

I have also seen a paper which seems to describe the basic principle, which .net Reactor seems to be based on (don't know if you refer to this paper with the gpl code, a link is very much appreciated).

But the Reactor offers two protection modes: application (which is easy to crack) and library mode, which I'm not shure off.

As I haven't seen any crackmes regarding library-mode-protected assemblies or tutorials on that topic my question is if anyone has tried to break this protection with activated necro bit. It seems to be tougher at first glance.
And a second thing: .net Reactor also offers a strong name removal protection. What do the experts think about this?

Regards,

Andu

About the strong name protection i managed to remove it once, after that i lost interest in reversing since its more of the same every time with just minor changes

[Andu]

Thanks for your answers. What's about library mode contra the weak application mode?

[LibX]

Thanks for your answers. What's about library mode contra the weak application mode?
Its just as crappy ;) specialy the so called necrobits protection is the biggest joke of all

[Andu]

Could you please expand on this? Is there a tutorial available?

What's the point with necroBit after all? How does it help to protect the assembly?

[LibX]

Could you please expand on this? Is there a tutorial available?

What's the point with necroBit after all? How does it help to protect the assembly?
I don't have time to write any tutorial sorry i hardly have some free time left for myself

and about the necrobits they restore function pointer at runtime, so basicly it doesn't help at all
its just a decoy

[Andu]

Thanks LibX!

One last question: What do you think is the best or most advanced protector or protection method for .net assemblies?

[LibX]

Thanks LibX!

One last question: What do you think is the best or most advanced protector or protection method for .net assemblies?
For regular protection: Just use a obfuscator, sure it won't help against cracking but nothing will realy ;) if u want it cracked u can do it at least they don't have ur source code then my favorite over all is smartassembly, its fast and i never had a single protected output that was not working (would be nice though if it was a little more tunable)

And for hardcore protection: I think the method iam working on is pretty good but far from finished, its based on dynamic encrypted code with a source level implementation with a mixture of native code (still fully non unsafe compilation) and debugger protection, but its far from finished, and ofcource a fully custom VM to run code in is the perfect sollution but there are no fully working implementations of that yet.
Also i think SecureLM from microsoft is pretty good but also its not doing everything that they promise, iam sure i can get the original code back (no iam not going to publish details since i don't want a witch hunt ;p)

Regards
LibX

[Kurapica]

What tool do you guys use for dumping and assembly from memory to harddisk?
and how can i view the obfuscated sourcecode of .net reactor protected assemblies? when i open it with lutz roeders .net reflector, i get exception from roeders reflector.

thanks
You can find a nice tutor on .NET Reactor in rongchaua site or follow this link

http://rongchaua.net/content/view/109/30/

[karlranseier]

You can find a nice tutor on .NET Reactor in rongchaua site or follow this link

http://rongchaua.net/content/view/109/30/

these articles are vietnamese. do you have any other information?

[rongchaua]

@karlranseier:
Here is the link. They are written in English. Please register, login to view the article. I have problem with Google so I must private all links.
http://rongchaua.net/tip/how-to-unpack-.net-reactor-3.6.html

[Andu]

A question for the pros:

Are there any plans on writing a .net Reactor deprotector especially for library mode?
I'll not believe it's defeated before there is a deprotector or tutorial for library mode ;)

Regards,

Andu

[LibX]

A question for the pros:

Are there any plans on writing a .net Reactor deprotector especially for library mode?
I'll not believe it's defeated before there is a deprotector or tutorial for library mode ;)

Regards,

Andu
Yes and when people are done writing this u can send the result to:

S********* 35
S*******, D-00000, DE
phone: +00 000000000

[Andu]

Ok, seems I have to look for something else ;)

[LibX]

Ok, seems I have to look for something else ;)
Not funny if someon is posting ur home address isn't it Denis Mierzwiak? ;)

(for the people who just missed the point Andu is the developer of .NET Reactor)

[Andu]

No, I'm not :D

I'm just a concerned developer who wants to protect his property as good as possible and evaluating my options.

I whish however that Mr. Mierzwiak is reading this and makes his protection better.

Or that you write the mega Protector (maybe even open source and free ;) ).

(Don't know what makes you think that I'm the developer. Please read my posts again and you'll see that I'm fair and neutral (well, at least I tried to be).

Regards,

Andu

[LibX]

(maybe even open source and free ;) ) <-- u mean so Mr. Mierzwiak can steal my code also, no thank u

[Andu]

lol :D

Do you already have marketing plans?
If so, in what price segment will be your solution and when will it be available (aprox.)?

Regards,

Andu

[bigmouse]

A question for the pros:

Are there any plans on writing a .net Reactor deprotector especially for library mode?
I'll not believe it's defeated before there is a deprotector or tutorial for library mode ;)

Regards,

Andu
it can be unpack by reflection.
also can be unpack by jithook.

i'll open a new thread for this test.

[LibX]

For the people who are interested here is a copy of the REZiriz unpacker sourcecode

http://download.yousendit.com/65788BB11A144456

[karlranseier]

i guess releasing it as open source would endanger the security of this protector.
it would be cool if you release it for a low price or for free (maybe for members of this forum?)

[Andu]

It depends. If the solution is really secure it could be released as open source like cryptographical algorithms. But in the case of .net Protectors I think that closed source is better, too.

[rendari]

Huh? .Net Reactor is insecure by nature. Censoring any unpacking methods for it will do nothing to contribute to its security.

[karlranseier]

It depends. If the solution is really secure it could be released as open source like cryptographical algorithms. But in the case of .net Protectors I think that closed source is better, too.

you can use aproved algorithms like AES but you still have to hide the key somewhere. and once the key is entered (by user or the program uses the hidden key itself) the whole assembly lies unprotected in memory.

i don't know a single exe protector (native or .net) which has not been broken.

i don't know if it is realistic but i think the only secure way to protect source code is a new layer of the operating system which encrypts the whole RAM with a unique key that is generated at the installation of the OS. only the programs which stores data in ram (and maybe also system processes) can read their own data.

[bigmouse]

you can use aproved algorithms like AES but you still have to hide the key somewhere. and once the key is entered (by user or the program uses the hidden key itself) the whole assembly lies unprotected in memory.

i don't know a single exe protector (native or .net) which has not been broken.

i don't know if it is realistic but i think the only secure way to protect source code is a new layer of the operating system which encrypts the whole RAM with a unique key that is generated at the installation of the OS. only the programs which stores data in ram (and maybe also system processes) can read their own data.

as libx's protector implement at MSIL level, the runtime's

source code is still available to reversers.
there must be at least one unprotected method, which is needed

to decrypt and execute the first encrypted method.
so reversers can start with this method, step into...
after all runtime's method been decrypted, the protector is

defeated.

but at least, It would slow them down.

a better way ,is use a native layer to implement per method

protection. such as remotesoft protector, clisecure, maxtocode,

dnguard.

but remotesoft protector and clisecure only implement a simple

jit wrap, can be easily unpack by using jithook.
also clisecure not really encrypted the ilcode, so static unpack

is very possible.

maxtocode not only wraped jit, but also hooked into mscorwks.
but no matter for jithook.
the problem is it's runtime protected by themida, we must bypass

themida's anti.
maxtocode itself also implement anti-hook(especial for jithook),

so simple jithook would't work.
bypass it's anti , we can also unpack this by using jithook.
by reason of all it's antis, Re-Max 3.34 can't work on virtual

.net framework environment yet.

DNGuard seems to does better, it's not only a simple jit wrap,

but also implement some functions of jitter.
by using jithook, i can't get back full methoddata.
it's runtime eat part of methoddata,and process this part data

itself, never passed to original jitter.

i think it must be possible to get back this part data by hook

into it's runtime. how to hook and where to hook is another

subject, i'v no idea yet.

i never got any hvm protected samples, i'm not sure about HVM

Technology.
i guess it maybe implement more functions of jitter.

The biggest problem for those protectors is compatibility.
but for obfucators or protector like libx's,compatibility is

little problem.

[LibX]

as libx's protector implement at MSIL level, the runtime's

source code is still available to reversers.
there must be at least one unprotected method, which is needed

to decrypt and execute the first encrypted method.
so reversers can start with this method, step into...
after all runtime's method been decrypted, the protector is

defeated.

but at least, It would slow them down.

a better way ,is use a native layer to implement per method

protection. such as remotesoft protector, clisecure, maxtocode,

dnguard.

but remotesoft protector and clisecure only implement a simple

jit wrap, can be easily unpack by using jithook.
also clisecure not really encrypted the ilcode, so static unpack

is very possible.

maxtocode not only wraped jit, but also hooked into mscorwks.
but no matter for jithook.
the problem is it's runtime protected by themida, we must bypass

themida's anti.
maxtocode itself also implement anti-hook(especial for jithook),

so simple jithook would't work.
bypass it's anti , we can also unpack this by using jithook.
by reason of all it's antis, Re-Max 3.34 can't work on virtual

.net framework environment yet.

DNGuard seems to does better, it's not only a simple jit wrap,

but also implement some functions of jitter.
by using jithook, i can't get back full methoddata.
it's runtime eat part of methoddata,and process this part data

itself, never passed to original jitter.

i think it must be possible to get back this part data by hook

into it's runtime. how to hook and where to hook is another

subject, i'v no idea yet.

i never got any hvm protected samples, i'm not sure about HVM

Technology.
i guess it maybe implement more functions of jitter.

The biggest problem for those protectors is compatibility.
but for obfucators or protector like libx's,compatibility is

little problem.

Well basicly its not the biggest problem that u can get code back, as long as ur licensing system implementation combined with the protector is good it will be a insane job to crackit (i will post a crackme that needs patching later on ;))
DNGuard has been worked on for 2 years or more, my protector only 1 week its insane to put so much time into simple code protection when its easy to just patch a protected app afterwards.
my code protector isn't that good since its easy to use in memory reflection, but still it took u guys 3-4 days to come up with the solution and thats far longer than it would take to reverse obfuscated code

But thats just my optnion :)

regards
LibX

[bigmouse]

Well basicly its not the biggest problem that u can get code back, as long as ur licensing system implementation combined with the protector is good it will be a insane job to crackit (i will post a crackme that needs patching later on ;))
DNGuard has been worked on for 2 years or more, my protector only 1 week its insane to put so much time into simple code protection when its easy to just patch a protected app afterwards.
my code protector isn't that good since its easy to use in memory reflection, but still it took u guys 3-4 days to come up with the solution and thats far longer than it would take to reverse obfuscated code

But thats just my optnion :)

regards
LibX
yes, your protector is better than obfucator, but also obfucation is necessary. without obfuscate, your protector can be easily reversed.

after i got your sample run on a xp machine, i spend several hours to get code back, it's much more hard than obfuscation.

waiting for your new crackme.

regards

[Andu]

Hi bigmouse,

interesting analysis of current protectors. Thank you.

At the moment I'm trying out Themida respectively WinLicense and it seems running nicely. However, do you (or other members of this forum) know something about the protection strength of this packer or its weaknesses?
I'm especially interested if it does something to the .net code so that the original code is not reproducable. There seems to be no obfuscation in place, which could prevent this.

Any information on this protection and its strength is highly appreciated.

Regards,

Andu

[LibX]

Hi bigmouse,

interesting analysis of current protectors. Thank you.

At the moment I'm trying out Themida respectively WinLicense and it seems running nicely. However, do you (or other members of this forum) know something about the protection strength of this packer or its weaknesses?
I'm especially interested if it does something to the .net code so that the original code is not reproducable. There seems to be no obfuscation in place, which could prevent this.

Any information on this protection and its strength is highly appreciated.

Regards,

Andu

The runtime is protected with Themida, not the il code

[bigmouse]

Hi bigmouse,

interesting analysis of current protectors. Thank you.

At the moment I'm trying out Themida respectively WinLicense and it seems running nicely. However, do you (or other members of this forum) know something about the protection strength of this packer or its weaknesses?
I'm especially interested if it does something to the .net code so that the original code is not reproducable. There seems to be no obfuscation in place, which could prevent this.

Any information on this protection and its strength is highly appreciated.

Regards,

Andu
themida/winlicense support .Net assemblies, but it use whole assembly encrypte protection.
so you know.......

but also like reactor's library mode.
it's wiped some peheader value.

[Andu]

So it is as bad as .net Reactor or did I get something wrong...?

[bigmouse]

So it is as bad as .net Reactor or did I get something wrong...?
i'm not sure, maybe i remember something wrong.
at least, assemblies can be rebuild by using reflection.

[LibX]

themida/winlicense support .Net assemblies, but it use whole assembly encrypte protection.
so you know.......

but also like reactor's library mode.
it's wiped some peheader value.

My own generic .net unpacker dumps it just fine, .net protection from themida/winlicense sucks bigtime

[LibX]

yes, your protector is better than obfucator, but also obfucation is necessary. without obfuscate, your protector can be easily reversed.

after i got your sample run on a xp machine, i spend several hours to get code back, it's much more hard than obfuscation.

waiting for your new crackme.

regards
Final version will have build in control flow obfuscation also :)

[karlranseier]

Final version will have build in control flow obfuscation also :)

any plans about pricing or a free version yet?

[LibX]

any plans about pricing or a free version yet?
Iam not going to awnser any questions about this sorry, when its done its done, if its free its free

[Andu]

My own generic .net unpacker dumps it just fine, .net protection from themida/winlicense sucks bigtime

Well, that was to be expected, but thank you anyway. If it's possible to unpack this protection with a generic unpacker then there is no protection.

Anyway I looked into DnGuard. Although they've worked on it for over two years, the interface looks really crapy and if I were them I would polish it in the first place. Also their site is obviously down and I had to test an older version from 2007.
But what counts is what it does, right? And so far I'm really impressed. It's working fast and all function-bodies are gone.

Is there a method or a tool to unprotect DnGuard protected assemblies or is it the only protection that has not been broken so far?

Regards,

Andu

[LibX]

Well, that was to be expected, but thank you anyway. If it's possible to unpack this protection with a generic unpacker then there is no protection.

Anyway I looked into DnGuard. Although they've worked on it for over two years, the interface looks really crapy and if I were them I would polish it in the first place. Also their site is obviously down and I had to test an older version from 2007.
But what counts is what it does, right? And so far I'm really impressed. It's working fast and all function-bodies are gone.

Is there a method or a tool to unprotect DnGuard protected assemblies or is it the only protection that has not been broken so far?

Regards,

Andu

Err i don't think its about the interface, its about if the protection is working yes or no.
Even seen the Dotfuscator interface? well it looks like shit but the obfuscator itself works prefectly specialy if u enable advanced overloading.
BTW aspack has the same crapy interface and has been used for years by tons of people ;)

[bigmouse]

Well, that was to be expected, but thank you anyway. If it's possible to unpack this protection with a generic unpacker then there is no protection.

Anyway I looked into DnGuard. Although they've worked on it for over two years, the interface looks really crapy and if I were them I would polish it in the first place. Also their site is obviously down and I had to test an older version from 2007.
But what counts is what it does, right? And so far I'm really impressed. It's working fast and all function-bodies are gone.

Is there a method or a tool to unprotect DnGuard protected assemblies or is it the only protection that has not been broken so far?

Regards,

Andu
for its trial version, not really encrypted ilcode, rongchahua have done a tool.
but for other edition, can not yet.

[bigmouse]

Final version will have build in control flow obfuscation also :)

very nice :p

[Hannibal]

Greetings all -

I stumbled across this thread while doing some google research on .NET reactor; I am trying to find a software which does some code protection, but more importantly, hardware based licensing (with a trial period) for a small .NET application that I've written. I thought I had pretty much settled on Eziriz; but after reading this thread... it would seem that isn't the best choice.

I'm a rather new C# developer; and I can't afford to spend thousands of dollars on a protector / licensing system. I was also considering Xheo DeployLX Express -- but I wasn't real wild about having to buy a second "sales only" edition to give another person the ability to generate keys.

Can you make any recommendations? I've read rongchaua's review of .NET Reactor 3.6, and since that release they've claimed they improved necrobit and obfuscation. The overall review gave it a 6 out of 12... but then again, none of the other completed reviews were any higher than that. I would appreciate any and all suggestions / feedback.

Thanks,
Hannibal

[Andu]

Hi Hannibal,

seems we're sitting in the same boat. As you may have read I'm also searching for a reliable .net protection.

Although my software is not ready yet I think it is a good point in time to look for a solution.

Well, what I have learned so far is that most approaches are not secure. Other's seem to have at least potential and are not broken until now. A protectot which belongs to the second category is DnGuard. However, it has two disadvantages. First: it's extremly pricy. Second: I would have no good feeling buying this software. There are several reasons for this:

-Strange: DnGuard (not cracked), CliSecure (cracked) and MaxToCode (cracked) all share parts of their descriptions. Look at their websites and you know what I mean.
- Also they seem to use nearly the same technology (if you believe their slogans) and all are from china. What is the point with that? Personally that gives me a strange feeling. Are they the same or did they start as a team or did they steal one from another.... just my personal thoughts, nothing more.
- Where is the free obfuscation feature in DnGuard? Is it really there or did they just copy the whole passage from CliSecure?
- What's about the licensing component in DnGuard? How do I integrate it in my source code?

So there are concerns regarding DnGuard and these chinese protectors in general. However, I will look at it again when my program is finished.

Another protector (or better obfuscator) I consider is the spices obfuscator, which does a good job (in my opinion) for a reasonable price (if you choose the command line version). The licensing component is not too hard to write in .net and you can customise and harden it (not a single call like in .net reactor).

Back to .net Reactor: there still isn't a tutorial to unprotect library mode protected assemblies. Are the experts investigating it already?

Regards,

Andu

[rongchaua]

@Andu: It seems very interesting when reversing a library protected by .net reactor. I'm trying to reverse it. Hope I will finish it in next days.

There is also a tutorial for unpacking .net reactor 3.7 here http://rongchaua.net/tip/how-to-unpack-.net-reactor-3.6.html#josc52 . Look at comment section. Although it was written in vietnamese but it is a video tutorial. I think it is easy to understand. ;)

[Hannibal]

It seems like standard protection in most protectors does nothing, as it's unencrypted in memory... That tutorial was pretty straight forward, it was the same as the 3.6 tutorial except for that version stuff at the end.

[rendari]

.NET reactor is too easy to crack. Might as well not protect your software if that's what you use. Same goes for Xheo Codeveil (Kurapica wrote a tut for it at beginning of this thread). DNGuard and Maxtocode both have:

a) Compatibility issues
b) Takes several months for them to make notable changes (took a couple of months for DNGuard to have Vista support, and even then you have to reprotect and redistribute your assemblies)
c) are Chinese (you might get stiffed)

Oh, and Clisecure and Maxtocode both crash outright on my Vista machine here.

Remotesoft Salamander protector has a security hole in it that allows people to recover original IL code from it when you to native compile. Even if you do remove IL code, the app is still possible to crack using Ollydbg (wrote a tut on that on my blog).

Only options I see for you guys are:
1) Something custom
2) Ask LibX nicely
3) Microsoft SLM Code protector (very pricey!)
4) I've been working on a .NET protector, but its still in beta, and a tut is coming soon on how to crack it. So, I have to see how my protector is getting cracked, fix that, and then rerelease it when I have time. It works on Vista, but not on x64 bit Vista. So I cannot recommend my own protector with a clear conscience.

I think you guys would be better off making complex serial routines with various tricks in them than using a protector.

[bigmouse]

Hi Hannibal,

seems we're sitting in the same boat. As you may have read I'm also searching for a reliable .net protection.

Although my software is not ready yet I think it is a good point in time to look for a solution.

Well, what I have learned so far is that most approaches are not secure. Other's seem to have at least potential and are not broken until now. A protectot which belongs to the second category is DnGuard. However, it has two disadvantages. First: it's extremly pricy. Second: I would have no good feeling buying this software. There are several reasons for this:

-Strange: DnGuard (not cracked), CliSecure (cracked) and MaxToCode (cracked) all share parts of their descriptions. Look at their websites and you know what I mean.
- Also they seem to use nearly the same technology (if you believe their slogans) and all are from china. What is the point with that? Personally that gives me a strange feeling. Are they the same or did they start as a team or did they steal one from another.... just my personal thoughts, nothing more.
- Where is the free obfuscation feature in DnGuard? Is it really there or did they just copy the whole passage from CliSecure?
- What's about the licensing component in DnGuard? How do I integrate it in my source code?

So there are concerns regarding DnGuard and these chinese protectors in general. However, I will look at it again when my program is finished.

Another protector (or better obfuscator) I consider is the spices obfuscator, which does a good job (in my opinion) for a reasonable price (if you choose the command line version). The licensing component is not too hard to write in .net and you can customise and harden it (not a single call like in .net reactor).

Back to .net Reactor: there still isn't a tutorial to unprotect library mode protected assemblies. Are the experts investigating it already?

Regards,

Andu

DnGuard , CliSecure, remotesoft protector and MaxToCode are similar ,but not same.
CliSecure and remotesoft protector 's runtime seems to implement with same technology.

if you look into maxtocode and dnguard, you will found, they really did a different way, and different from each other.

[bigmouse]

.NET reactor is too easy to crack. Might as well not protect your software if that's what you use. Same goes for Xheo Codeveil (Kurapica wrote a tut for it at beginning of this thread). DNGuard and Maxtocode both have:

a) Compatibility issues
b) Takes several months for them to make notable changes (took a couple of months for DNGuard to have Vista support, and even then you have to reprotect and redistribute your assemblies)
c) are Chinese (you might get stiffed)

Oh, and Clisecure and Maxtocode both crash outright on my Vista machine here.

Remotesoft Salamander protector has a security hole in it that allows people to recover original IL code from it when you to native compile. Even if you do remove IL code, the app is still possible to crack using Ollydbg (wrote a tut on that on my blog).

Only options I see for you guys are:
1) Something custom
2) Ask LibX nicely
3) Microsoft SLM Code protector (very pricey!)
4) I've been working on a .NET protector, but its still in beta, and a tut is coming soon on how to crack it. So, I have to see how my protector is getting cracked, fix that, and then rerelease it when I have time. It works on Vista, but not on x64 bit Vista. So I cannot recommend my own protector with a clear conscience.

I think you guys would be better off making complex serial routines with various tricks in them than using a protector.
Compatibility issues is the bigest problem for those protectors.
which can resovle this problem , it would be the good one.

frequently update is not necessary.stable is important.
to follow each update, you will need to reprotect and redistribute your assemblies.
especially, if protector's udpate period close to your product's , i will be very nice.

only protectors which offen been cracked need to update frequently.

[Andu]

Thanks fpr your comments and clarifing the interna bigmouse.

@rongchaua,

thanks for pointing to the video. I think I know it already (if it shows breaking application mode). It's shocking how easily it can be done.

It's nice you're investigating library mode. How difficult is it to break in your opinion?

What interests me most is if it is possible to unpack it statically and if a tool can be written to do this. Because if that would be the case the protection is completely gone.
On the other hand, if it has to be done by hand and one has to fix a lot of things it could be unpractical for normal projects (and not little crackme's ;)).
What do you think about the strong name removal protection? Can it provide any more security?

Yeah, and because im personally interested in protections myself it would be nice if you could share some details.

Seems like DnGuard is the way to go at the moment... I'll see if it still is uncracked as my release date comes closer.

I think the biggest problem is that there is (or seems at least) no cracked DnGuard version available with full protection so you guys can't test it...

Regards,

Andu

[bigmouse]

@Andu
you can post a library mode sample here.

if you want to try out dnguard.
here has dnguard Standard Editon V2.6 's sample.
http://www.tuts4you.com/forum/showtopic=14132

you can also try it newest trial version v2.9.
as its standard edition really encrypt the ilcode, so forgot to search ilcode from assembly module.

here i post a way to bypass DNGuard trial's 30 days limit
http://jithook.blogspot.com/2008/04/bypass-dnguard-trials-30-days-limit.html

in my opinion obfuscation is enough for most .net product.
for most large companys ,they even didn't need obfuscation.

[Andu]

Hi bigmouse,

you can post a library mode sample here.

I'd certainly do it if it wasn't against license terms :mad:

you can also try it newest trial version v2.9.
as its standard edition really encrypt the ilcode, so forgot to search ilcode from assembly module.

I did. But as you said, it doesn't encrypt the code and so it's protection has already been cracked.

But what's about this additional encryption anyway?
It can't be dumped as a whole from memory, ok, but it should be a symmetrical encryption and if you can find the key (which has to be somewhere) you can statically unpack it. Right?
So we can limit the problem on finding this key. Right?

here i post a way to bypass DNGuard trial's 30 days limit
http://jithook.blogspot.com/2008/04/...ays-limit.html (http://jithook.blogspot.com/2008/04/bypass-dnguard-trials-30-days-limit.html)

Interesting blog, bigmouse!

for most large companys ,they even didn't need obfuscation.

Why dou you think that? Without any protection at all, the're cracked in one day :rolleyes:

Regards,

Andu

[bigmouse]

I did. But as you said, it doesn't encrypt the code and so it's protection has already been cracked.

you didn't understand what am i mean.
suppose the methodcode was encrypted, don't intend to search methodcode from assembly module.


But what's about this additional encryption anyway?
It can't be dumped as a whole from memory, ok, but it should be a symmetrical encryption and if you can find the key (which has to be somewhere) you can statically unpack it. Right?
So we can limit the problem on finding this key. Right?

theoretically speaking, no protection is safe , right?

you can try to static unpack maxtocode protected assemblies.
as they used many encryption algorithms, choose random one to encrypt each method.
static unpack is not as easy as you think.

there program are native exe, also been protected.
it's very hard to analyse all it's encryption algorithms.

why .Net Reactor, xenocode studio protected assemblies been static unpacked?
1. themselves are .net program.
2. themselves been unpacked first.
a protector's soucecode is available to crackers, you can imagine what does its protection mean.


Why dou you think that? Without any protection at all, the're cracked in one day :rolleyes:

they use law to protect there right.

[Andu]

Hi bigmouse,

why .Net Reactor, xenocode studio protected assemblies been static unpacked?
1. themselves are .net program.
2. themselves been unpacked first.
a protector's soucecode is available to crackers, you can imagine what does its protection mean.

That makes sense.

they use law to protect there right.

They may be able to protect some routines by law, but they can't do anything against people using cracks...

[LibX]

I'd certainly do it if it wasn't against license terms :mad:


That doesn't matter, they can't sue u anyway if they do i have a shitload of proof they stole and used GPL and other free code while thats not alowed according to the license :P

[bigmouse]

.net reactor 3.7.1.0 unpacked
http://momupload.com/files/91593/dp_dot_Reactor.rar.html

itself can be easily unpacked.
if the library mode is more security, why they didn't use this to protect itself.

[Andu]

That doesn't matter, they can't sue u anyway if they do i have a shitload of proof they stole and used GPL and other free code while thats not alowed according to the license :P

Yeah, you're right :D

if the library mode is more security, why they didn't use this to protect itself.

Afaik they use it to protect itelf. If they'd use App. Mode you couldn't see anything in reflector.

[bigmouse]

Afaik they use it to protect itelf. If they'd use App. Mode you couldn't see anything in reflector.
that means its library mode also can be easily unpacked.:D

[Andu]

Maybe..... but can it be shown in Reflector?. Did you do the unpack?

[bigmouse]

download the unpacked file.
view in reflector.

[UFO-Pu55y]

I think the biggest problem is that there is (or seems at least) no cracked DnGuard version available with full protection so you guys can't test it...Don't forget to post a crackme, as soon as you buy a full version :D

[Andu]

download the unpacked file.
view in reflector.

Did you try viewing it in reflector? Maybe it doesn't work ;)

Don't forget to post a crackme, as soon as you buy a full version :D

:D

[bigmouse]

Did you try viewing it in reflector? Maybe it doesn't work ;)
:D
download, and use reflector to check this before post , ok?

[tankaiha]

my friend crack it soon after 3.7.1.0 released, but i don't know the details yet :P

[Andu]

download, and use reflector to check this before post , ok?

Somebody told me that the methods are not accessible in reflector.

[bigmouse]

Somebody told me that the methods are not accessible in reflector.

lol , somebody ? who?
why he/she told your? but not told me?

have you do test this yourself?

[Andu]

Man you won't get me, will you? :rolleyes: :D

[bigmouse]

.Net Reactor 3.7.1.0 unpacked and deflowed
now , can view C# source code in reflector

Download Link:
http://www.filesend.net/download.php?f=a01cffca430e7bb75d96e4131a7e7f7d

[bigmouse]

.Net Reactor v3.7.9.1 unpacked

dp_dotNET_Reactor.rar (1.37 MB)
Download Link: http://www.filesend.net/download.php?f=8a8fd65edc99cb04be7e8d91d8892519

deflowed
http://momupload.com/files/92305/dp_dotNET_Reactor-rb.rar.html

[MegaX]

.Net Reactor v3.8.0.0 BETA unpacked

dotNET_Reactor_unpacked.rar(1.85M)
Download Link:http://momupload.com/files/93802/dotNET_Reactor_unpacked.rar.html

[peterg]

Bigmouse,

could you tell me if the attached dll is using .Net Reactor?
I tried unpacking it using your tools but it didn't do it.

Thank you.

http://www.filesend.net/download.php? f=c923cd2b753807a3911fb47d41d90dad

[Kurapica]

Bigmouse,

could you tell me if the attached dll is using .Net Reactor?
I tried unpacking it using your tools but it didn't do it.

Thank you.

http://www.filesend.net/download.php? f=c923cd2b753807a3911fb47d41d90dad
How did you get this file ?
anyway it's protected with Reactor but I still think it's not the main file !? because it doesn't contain any useful code for Visual studio.

Try to post any other files too.

[peterg]

using Reflector almost at bottom there three main namespaces in the file
TheDNN.Menu.My
TheDNN.Menu.Module
TheDNN.Module.MenuConfiguration
TheDNN.SkinObject.Module
with classes inside readable only using IL code.

[Kurapica]

You'd better post a link to the target or post the main protected DLL

[peterg]

You'd better post a link to the target or post the main protected DLL

I zipped all the files I have, link below.

http://www.filesend.net/download.php? f=32813e5005bcddbb0ec1364939844b82

[peterg]

You'd better post a link to the target or post the main protected DLL

I zipped all the files I have besides the .ascx and aspx files, which I don't think they are relevant here, the module is used for DotNetNuke web site.

Thanks.

hxxp://www.filesend.net/download.php?
f=32813e5005bcddbb0ec1364939844b82

[Kurapica]

Obviously this target requires Visual web developer to be installed for testing, I usually test before going into protection details !!
The target is some kind of Menu control for websites.

I'm too lazy to install IIS on my box too because it takes much RAM and CPU time, anyway I don't think it's too hard, Just try again and tell us what happens.

[vscpp]

Anyone able to Reverse Engineer it?

[nodn]

Hi all.
Can someone help me with these programs?
They are protected with license files.

Progs\ProjectMaker\ProjectMaker.exe
Progs\ZennoPosterProject\ZennoPosterProject.exe

Prerequisites\HID.exe already have license file and no need to be unpacked. Maybe it will help you to unpack other programs.

http://www.filesend.net/download.php?f=7068591138451fc10747810a530272ff

[Yeorwned]

Anyone played with .NET Reactor 4.0.0.0 yet? Seems to have some pretty significant enhancements over previous releases.

[snippets]

Thread Up! :D

Hello. I've read the posts.

.NET Reactor receives bad comments.:eek:
But the posts were old.
Things changes.. =)

What .NET Protection do you recommend?:rolleyes:

[wyvernx]

I have not seen any recent .net reactor papers on unpacking, but I would love to read some if you find, please post for everbody.

[kao]

Who needs tutorials when we have Reactor Decryptor? :D But if you have a specific question about .NET Reactor 4, feel free to ask..

[LoCo]

It is really a very interesting topic, actually i've gone through all of the comments and i really think its one of the best discussions in this forums, but after several months have passed, and many versions have been released for .net reactor, is it still as crackable as it was before? ... I just made my own licensing server with some assymetric encryption (RSA) and 1024 bit encryption and bla bla bla.. and i just need to give crackers the hassle to crack my program... so they will take long (3-4 days) so it will be a test of how bad they want it cracked.

What protector / obfuscator should i really use to accomplish that...

is DNGuard still the way to go? or is there someone who has performed better in this market?

is it worth it? .. my code worths millions (at least for me lol)

and yeh.. its .net only maybe with some mysql.data dlls and other .net components .. heh

hope to hear from you guys...

LoCo

[lirikpas]

Hi all.
Can someone help me with these programs?

http://rghost.ru/14749561