+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] [Preview free release] DexScator 2 - Native stub protector/obfuscator (/showthread.php?tid=2218681)
Pages: Pages
1
2
[Preview free release] DexScator 2 - Native stub protector/obfuscator - hgdfhsdgdfgdfh - Feb 16, 2012
Just a preview.
May not work with all programs and have other problems.
What it does:
- Protects 32-bit .NET assembly with native stub coded in C++.
- Strips some stuff from assembly and moves it to native stub to make it harder to restore assembly
You must download ILMerge.exe and put it into same directory with all other files.
AND ALSO: when protecting, drag&drop files from same folder or it will complain about runtimestub dll missing.
Usage: Drag&drop file to protect to dexscator.console.exe.
Please tell your opinion, I'm not 100% sure if I'm going to continue developing this.
And also at the moment protected files can have false positive AV detections.
DOWNLOAD:
https://lh.rs/Kj71cpB0gAhf
* - Silicon - Feb 16, 2012
Any 64-bit support on the way?
Also, does the builder compile the native stub or add resources to it?
Either way, looking good - well, outstanding - from you, as always. Why can't you stop thinking of awesome ideas and give us a chance? D:
* - ubbelol - Feb 16, 2012
Awesome protection! :D You should definitely continue developing this.
* - Gh0st-Zer0 - Feb 16, 2012
False/Positives may also come from UPX packaging....
* - Immortal - Feb 16, 2012
i say stick to it :D false postives from upx looks like.
* - Zeroゼロ - Feb 17, 2012
I'm working on something similar too :)
What method are you using?
I chose to host the CLR separately, I initially thought of using C++/CLI to "bridge" the 2 worlds. ^^
* - CyNecx - Feb 17, 2012
but dumping the assembly is possible or ??
* - hgdfhsdgdfgdfh - Feb 17, 2012
Of course its possible, and its pretty easy. But it can be made more difficult and this protector also moves some stuff from assembly to native stub. So atm if you dump the assembly, it doesnt work without some work.
Zero:
Im using CorBindToRuntimeEx on pure C++ executable with some COM. So no C++/CLI :P
* - Ingenuity - Feb 17, 2012
Categorically yes, keep on developing, this looks really, really nice!
* - hgdfhsdgdfgdfh - Feb 17, 2012
I just got encrypted methods working. They are decrypted on runtime :P
Next gonna move them from original locations.
Crackme protected with this: https://hackforums.net/showthread.php?tid=2221170
[img]http://img72.imageshack.us/img72/1498/tmpf983.png[/img]
But I'm still thinking whether or not release this. Scared of ppl using obfuscator to FUD malware -> AV start detecting as malware.
* - Immortal - Feb 17, 2012
I would use it for something non malware related, but it's up to you i like it. I like all your releases
* - hgdfhsdgdfgdfh - Feb 17, 2012
Ok, atm features are (not on downloadable version, its just native stub + string removal):
- Native stub
- Anti debug
- MSIL encryption, decrypt on runtime like on other obfuscators (codeveil)
- Removal of strings and ints from assembly, they are moved to native stub
Features coming/probably coming if I can figure out how to implement:
- Move MSIL bodies to different location = methods on assembly are empty
- Anti-dump
- Less CPU intensive protection
- Move primitive array initializers to native stub like strings & ints, do same also for other primitive types
- Some obfuscation on IL/.NET side like normal obfuscators
- Move resources to native stub
- Better compatibility with different assemblies, atm its a problem
If I decide to release this completely, at least those features will be included. Otherwise you can still use this preview version because it works, just with less features.
And also I have been planning of creating a licensing system based on this: licensing logic is in native loader and C# has verification class which communicates with native stub to exchange license data.
* - Zeroゼロ - Feb 17, 2012
I haven't got the time to try yet, does it work if you try to run a 64bit .Net assembly within a 32bit native program using the COM interfaces (_AppDomain, _Assembly etc...)?
* - hgdfhsdgdfgdfh - Feb 18, 2012
Havent tried that but I doubt it works. I'm pretty sure you must create a separate 64-bit loader executable for 64-bit assemblies.
* - li0nsar3c00l - Sep 3, 2012
i hate crashing your threads but all of your links are down. please reup this too