Exetools - How to patch .NET DLLs?

Page 2 of 2

Show 40 post(s) from this thread on one page

Exetools (https://forum.exetools.com/index.php)

- General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)

- - How to patch .NET DLLs? (https://forum.exetools.com/showthread.php?t=7022)

SystemeD

03-11-2005 01:25

Quote:

Originally Posted by newbie_cracker

As jjhsd said, in case of obfuscated, decompiling and compiling again, may not possible sometimes.

It's not completely true...
Probably you are saying this because ildasm crashes while dumping, but this only means that obfuscator inserted some invalid metadata. So:
1 - If you find and remove this metadata you are still able to decompile/recompile.
2 - Future version of ILDASM will be able to manage invalid metadata so it would not be a problem anymore.

Quote:

Originally Posted by zacdac

...but for an asp.net assembly you will need to also patch the strong named attribute which is stored as meta data before the RAS key.

It's true, I tried it by myself. I made some experiments and finally I found the way to do that. Well, you have to patch the Strong Name length as for Win apps and than patch this (again 80h to 00h):

Code:

00012140   0E 0E 04 20 01 01 02 03  20 00 01 80 A0 00 24 00   ... .... ..€ .$.

00012150   00 04 80 00 00 94 00 00  00 06 02 00 00 00 24 00   ..€..��........$.

00012160   00 52 53 41 31 00 04 00  00 01 00 01 00 CD 62 12   .RSA1........&#205;b.

00012170   05 0E 7C CD 6F 51 AF 2C  41 FD CC 65 44 AC E3 CF   ..|&#205;oQ&#175;,A&#253;&#204;eD&#172;&#227;&#207;

Recompile the app that use the dll and... enjoy! ;)

Newbie_Cracker

03-13-2005 01:46

SystemeD
I patched byte you've shown and sent patched DLL to my friend to test it.
This time .NET compiler said : "Invalid program" (or something like this).
May its because of joining your method and method of patching 80 at offset 102C.

Tonight, I played with a simple file compiled with and without Strong Name. I noticed after compiling with KEY, 80 A0 and PublicKey are the major differences between two files. So my suggestion is : Patching whole PublicKey and 2 bytes before it to 00.

I must test it again.

And...
Present version of ILDASM (.NET SDK 1.1) crashes at decompiling time and the produced file is uncompilable. Do you decompile and recompile the mentioned dll successfully?

SystemeD

03-14-2005 18:30

Quote:

Originally Posted by newbie_cracker

I patched byte you've shown and sent patched DLL to my friend to test it.
This time .NET compiler said : "Invalid program" (or something like this).
May its because of joining your method and method of patching 80 at offset 102C.

It's exactly what you have to do. I checked it again and it works. Be carefully because the code I posted may be different from yours (you have to look at the position of the bytes), because I downloaded the latest version of the app for testing.

Quote:

Originally Posted by newbie_cracker

Tonight, I played with a simple file compiled with and without Strong Name. I noticed after compiling with KEY, 80 A0 and PublicKey are the major differences between two files. So my suggestion is : Patching whole PublicKey and 2 bytes before it to 00.

Probably it would work too, I didn't try it...

Quote:

Originally Posted by newbie_cracker

Present version of ILDASM (.NET SDK 1.1) crashes at decompiling time and the produced file is uncompilable. Do you decompile and recompile the mentioned dll successfully?

In my previous post I talked about future versions, try ILDASM from SDK 2.0 Beta... ;)

PS: I suggest you to patch only the strong name infos at first. Test if the assembly works and after apply all other cracking patches.

jjhsd

03-16-2005 20:34

what i have encoutered is ildasm does work, but the output file it produces contains a lot of ascii characters(not a-z). then ilasm will have problem to compile it back.

SystemeD

03-16-2005 21:34

Can you point me to your target?

jjhsd

03-17-2005 08:42

RedGate SQL Bundle - "RedGate.Licensing.Client.dll"

i ran ildasm, dumped everything. then couldn't compile it back (without changing any il code)

hxxp://www.red-gate.com/downloads/bundle.exe

TQN	03-17-2005 10:32

Did you try it with Reflector. If in Reflector, you only see garbage function names, member variables, the dll used obfuscation, and ILASM can failed when recompiling.

SystemeD

03-17-2005 17:20

jjhsd:

Funny! I just played with it few months ago but I don't remember what I did exactly...
I think it's time to take a look at the new version... :D

jjhsd

03-17-2005 17:38

SysteMD:

the software's protection can be defeated by other ways, but not using decompiling.

TQN:

yeah, i have tried and can see garbage function names from there.

SystemeD

03-17-2005 19:40

It's not completely true, I tested it and, for example, I succeded to decompile/remove Strong Name Signature/recompile the assembly named "RedGate.Licensing.Client.dll".
The only problem I encountered is that Ildasm produced a resource file with an invalid name ("똁.resource"). So I renamed it in "a.resource" and modified the dump to point to the new resource file. I recopiled the assembly and it worked.
I don't know if it is the problem you had but I would use decom/recomp technic for this target too.

JMI	03-17-2005 23:24

jjhsd and SystemD:

PAY ATTENTION AND STOP USING THE "QUOTE" BUTTON WHEN A "QUOTE" IS NOT NECESSARY.

You just add to the burden of the database and I'm gettig tired of fixing your posts.

Regards,

jjhsd

03-18-2005 08:34

yes, it works. I didn't change resource file name in the dump, that's why it failed.
thank you. : )

Newbie_Cracker

09-26-2005 03:58

StrongName Signature Remover

1 Attachment(s)

Last night I saw a little tool for removing StrongName Signature from .NET applications in Woodman forum.
Little description of this tools is :

SNRemove v1.00
Copyright (c) 2005 Nir Sofer
Web Site: http://www.nirsoft.net

But it didn't fix SN Signature in ASP .NET Applications.
So I created this patcher to solve this for all .NET Applications. It's the result of this topic. :)

Best regards.

Unforgiv3N

09-26-2005 04:52

Nice Job, Thanks!
NeWBiE_Cracker ;)

All times are GMT +8. The time now is 18:20.

Page 2 of 2

Show 40 post(s) from this thread on one page