Hack Forums
[.NET] [FREE] DexScator 2 - .NET obfuscator - Native stub - JIT code decryption - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] [FREE] DexScator 2 - .NET obfuscator - Native stub - JIT code decryption (/showthread.php?tid=2225089)

Pages: Pages 1 2 3


[FREE] DexScator 2 - .NET obfuscator - Native stub - JIT code decryption - hgdfhsdgdfgdfh - Feb 18, 2012

ALPHA VERSION: MAY NOT BE COMPATIBLE WITH SOME ASSEMBLIES (actually its incompatible with lots of assemblies, have to work hard to solve these problems), PROTECTOR FAILS FREQUENTLY (doesnt encrypt method bodies: you dont see any method encryption on output), PROTECTED FILE CRASHES SOMETIMES (will be fixed later)

[img]http://img205.imageshack.us/img205/9169/tmpbde3.png[/img]

Features
- Free
- Supports 32-bit assemblies, runs of course also on 64-bit OS
- Native stub written in pure C++
- Supports .NET 2.0 <-> 4.0 runtime
- Wrap assembly inside native stub
- Anti-debug
- Some anti-dump
- Encrypt assembly - multiple layers
- Decrypt method bodies on runtime on demand
- Something unique (at least havent seen on other obfuscators): Move lots of constants (including strings) from assembly to native stub to further confuse crackers. Contants are encrypted of course

Usage
- Download
- Download ILMerge.exe from microsoft and put it into same directory with other files
- Copy the file you want to protect into SAME folder with obfuscator
- Drag&drop file from same folder to dexscator.console.exe
- Pray it doesnt crash and that protected file works :P

Feel free to use for any purpose EXCEPT for malware: doesnt help, this already has false AV detections: using this to reduce malware detections is therefore pretty useless and will make AVs think this is malware..

Please report bugs and give suggestions. Also give your opinion :P

AV FALSE POSITIVES!
DOWNLOAD:
http://www.mediafire.com/?gr5ngty4768mai1


* - Silicon - Feb 18, 2012

https://hackforums.net/showthread.php?tid=2218681
Why don't you just update the existing thread?
And this still doesn't seem to work on my system. It's Windows 7 x86.


* - hgdfhsdgdfgdfh - Feb 19, 2012

You have ILMerge in same folder? If yes, and it even starts try running multiple times. If no, please tell me what exactly happens.
And I created new thread because now this has maybe the most important feature added: code decryption on demand.


* - DragonHunter - Feb 19, 2012

nice work ^_^

But too bad it's not really like CodeVeil like that methods are empty 100% and a really simple program just gave errors

Simple app compiled with this
Code
namespace DeleteMe
{
    class Program
    {
  static void Main(string[] args)
  {
    Console.WriteLine("k... i ran ;3");
    Process.GetCurrentProcess().WaitForExit();
  }
    }
}

in .net reflector it shows
Code
private static void Main(string[] args)
{
    Console.WriteLine(NativeStubInjection.LoadString(0));
    Process.GetCurrentProcess().WaitForExit();
}

oh well keep working on it and it will be good hopefully ^^


* - hgdfhsdgdfgdfh - Feb 19, 2012

(Feb 19, 2012 03:49 AM)DragonHunter Wrote:  nice work ^_^

But too bad it's not really like CodeVeil like that methods are empty 100% and a really simple program just gave errors

Simple app compiled with this
Code
namespace DeleteMe
{
    class Program
    {
  static void Main(string[] args)
  {
    Console.WriteLine("k... i ran ;3");
    Process.GetCurrentProcess().WaitForExit();
  }
    }
}

in .net reflector it shows
Code
private static void Main(string[] args)
{
    Console.WriteLine(NativeStubInjection.LoadString(0));
    Process.GetCurrentProcess().WaitForExit();
}

oh well keep working on it and it will be good hopefully ^^

Thanks.
You dumped that from the native stub or didnt it apply the native stub at all?
And I'm gonna move methods to different location like codeveil :P


* - DragonHunter - Feb 19, 2012

(Feb 19, 2012 03:52 AM)0xDEADDEAD Wrote:  Thanks.
You dumped that from the native stub or didnt it apply the native stub at all?
And I'm gonna move methods to different location like codeveil :P
All I did was drag/drop the simple.exe at DexScator.Console.exe and than i took simple.exe.obfuscated.exe and drag/dropped it into .net reflector lol

oh ye and this also happens
[img]http://img838.imageshack.us/img838/3866/lolvz.png[/img]

With ilmerge.exe in same folder this happens
[img]http://img521.imageshack.us/img521/7986/lol2svu.png[/img]


* - hgdfhsdgdfgdfh - Feb 19, 2012

I guess it failed then :D Have ILmerge on same folder? You need to put that, I think ILMerge license prohibits redistribution so I didnt include it. Try again until you see at least one of these "RVA... FAT/TINY size ..." lines pop up :P

You have your test exe in same folder with all protector files? And if you do, try few times if it happens to work :D


* - DragonHunter - Feb 19, 2012

(Feb 19, 2012 03:56 AM)0xDEADDEAD Wrote:  I guess it failed then :D Have ILmerge on same folder? You need to put that, I think ILMerge license prohibits redistribution so I didnt include it. Try again until you see at least one of these "RVA... FAT/TINY size ..." lines pop up :P
look at my prev post it contains some screenies but ye i dunno what im doing wrong :P


* - hgdfhsdgdfgdfh - Feb 19, 2012

You have your test exe you are trying to protect in same folder with obfuscator files? Otherwise it fails I think.
And also try few times again if it helps at all :P And if you have AV enabled, it can maybe block the access to some files because it detects them as false positives?
ILmerge is the latest?


* - DragonHunter - Feb 19, 2012

(Feb 19, 2012 04:01 AM)0xDEADDEAD Wrote:  You have your test exe you are trying to protect in same folder with obfuscator files? Otherwise it fails I think.
And also try few times again if it helps at all :P And if you have AV enabled, it can maybe block the access to some files because it detects them as false positives?
ILmerge is the latest?
Doesn't matter even ilmerge failed lol
I'm curious how u ever got this program get running because it's giving shitload of errors 🤣

[img]http://img822.imageshack.us/img822/1662/lol3h.png[/img]


* - hgdfhsdgdfgdfh - Feb 19, 2012

Lol I forgot to add "" to ilmerge command line paths so it fails if path has space on it -.-
Gonna fix it but can you try putting everything to path without any space on it?


* - maruata - Feb 19, 2012

Work fine but some application has problem after encrypting! Can get what's wrong with them yet!


* - hgdfhsdgdfgdfh - Feb 19, 2012

If its console app which doesnt work after protecting: I know that problem and will fix it.
If its winforms app, please tell me more details and maybe take screenshots of protector screen + possible errors, thanks.


* - li0nsar3c00l - Feb 19, 2012

pretty good, now gonna test it. thanks for publishing


* - hazeleekaizera - Feb 20, 2012

can you make the usage tutorial with picture ? :)
i always fail to protect my project :(