C# [C#] ILBlock - Block C#/VB.NET, IL code view in .NET Reflector

[C#] [C#] ILBlock - Block C#/VB.NET, IL code view in .NET Reflector - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] [C#] ILBlock - Block C#/VB.NET, IL code view in .NET Reflector (/showthread.php?tid=1571288)

Pages: Pages 1 2

[C#] ILBlock - Block C#/VB.NET, IL code view in .NET Reflector - d3c0mpil3r - Aug 7, 2011

When I was working on my obfuscator, I figured out how we can fool .NET Reflector and stop it from showing our code both in C#, etc or IL language...so just throwing a simple tool made 5mins ago (not protected you can take a look at the source, if you want)

Basically, we are adding an invalid call to a method which doesn't exist in the ASSEMBLY! That's it.

Pics:
Spoiler (Click to View)

Download:
http://uppit.com/gm15fdyjyhhu/ILBlock.rar

Enjoy!🤝

* - Zeroゼロ - Aug 7, 2011

Thanks. Shall take a look now :)

* - ubbelol - Aug 7, 2011

And it doesn't complain at runtime? If not that's nice, did you find it out yourself?

* - d3c0mpil3r - Aug 7, 2011

(Aug 7, 2011 01:17 AM)UbbeLoL Wrote: And it doesn't complain at runtime? If not that's nice, did you find it out yourself?

At runtime? What do mean? Its just adding a invalid call but the execution isn't altered (a jump at the start ^^)
and yes :)

* - ubbelol - Aug 7, 2011

(Aug 7, 2011 01:19 AM)d3c0mpil3r Wrote: At runtime? What do mean? Its just adding a invalid call but the execution isn't altered (a jump at the start ^^)
and yes :)

Ah sorry, stupid moment by me.. I thought you actually let the instruction execute at runtime. :p

* - Programmer101 - Aug 7, 2011

i was play with it and it would only let me block one function.

i was play with it and it would only let me block one function.
Thank you

* - TheDubWubCub - Aug 7, 2011

yea, same with porgrammer101, it only lets you block 1 function...

* - d3c0mpil3r - Aug 8, 2011

Sorry guys but I deleted the project so can't really fix it. It was more of a POC to let others know how its done and not actually meant to protect my EXEs.
I will soon fix few remaining things in my obfuscator and release it.

* - The-One - Aug 8, 2011

(Aug 8, 2011 04:26 AM)d3c0mpil3r Wrote: Sorry guys but I deleted the project so can't really fix it. It was more of a POC to let others know how its done and not actually meant to protect my EXEs.
I will soon fix few remaining things in my obfuscator and release it.

You can archive it by changing a byte value right? I remember reading something about this.. not sure if you used the same method though. Thanks for releasing anyway.

* - d3c0mpil3r - Aug 8, 2011

(Aug 8, 2011 04:48 AM)The-One Wrote: You can archive it by changing a byte value right? I remember reading something about this.. not sure if you used the same method though. Thanks for releasing anyway.

I think you are referring to this.
If yes, then no this method is different. You are creating an invalid call to a method hence preventing .NET Reflector to read both C# or IL code.

* - Ethereal - Aug 8, 2011

Isn't there a way to do this with (native) or something, by changing the Magic number?

Just a question, looks good.

By the way, you missed an 'f' in the title.

* - The-One - Aug 8, 2011

(Aug 8, 2011 05:28 AM)d3c0mpil3r Wrote: I think you are referring to this.
If yes, then no this method is different. You are creating an invalid call to a method hence preventing .NET Reflector to read both C# or IL code.

Yes, that's what I meant, but I saw it on another site a few years back. Nvm, thanks anyway!

* - d3c0mpil3r - Aug 8, 2011

(Aug 8, 2011 05:33 AM)Ethereal Wrote: Isn't there a way to do this with (native) or something, by changing the Magic number?

Just a question, looks good.

By the way, you missed an 'f' in the title.

I really have no idea what so ever.
and thanks for the correction LOL

(Aug 8, 2011 05:45 AM)The-One Wrote: Yes, that's what I meant, but I saw it on another site a few years back. Nvm, thanks anyway!

Ah, no problem :P

* - ubbelol - Aug 8, 2011

(Aug 8, 2011 05:33 AM)Ethereal Wrote: Isn't there a way to do this with (native) or something, by changing the Magic number?

Just a question, looks good.

By the way, you missed an 'f' in the title.

But wouldn't windows recognize it as another sort of file then? (In this case native :P) and not a .NET assembly.

I guess it'll keep it from reflector but windows as well x)

* - Ethereal - Aug 8, 2011

(Aug 8, 2011 05:53 AM)UbbeLoL Wrote: But wouldn't windows recognize it as another sort of file then? (In this case native :P) and not a .NET assembly.

I guess it'll keep it from reflector but windows as well x)

There's a way around it, I remember m4x talking to me about it to prevent memory dumps.