+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] Assembly.Load(byte[]).EntryPoint.Invoke(null, null); Question (/showthread.php?tid=5623525)
Assembly.Load(byte[]).EntryPoint.Invoke(null, null); Question - DelusionalGhost - May 15, 2017
Okay, so im working on a packer called .NET Squeezer and im struggling.. ive made an Anti-Dump, yet it still dumps the files from Assembly.Load(byte[]).EntryPoint.Invoke(null, null); So i got thinking and thgouht, hmm.. mabie i can make a PE for .NET, so i worked on that, and it STILL Dumped, so i cringed and got pissed. Anyone know any kind of method or a way i can prevent Dumping while creating an instance with reflection?
* - cawkre - May 15, 2017
Look at confuserex it has an anti dump
Read the source and see how it works
* - HFDone - May 15, 2017
google c# anti dump and you should find the answer
* - w4zt3d - May 15, 2017
Code
//just in case ur to lazy to google - idk where i got this from its old.
[DllImport("kernel32.dll")]
public static extern IntPtr GetModuleHandle(string lpModuleName);
[DllImport("kernel32.dll", SetLastError = true)]
static extern int VirtualProtect(uint lpAddress, int dwSize, int flNewProtect, uint lpflOldProtect);
[DllImport("Kernel32.dll", EntryPoint = "RtlZeroMemory", SetLastError = false)]
static extern void ZeroMemory(IntPtr dest, IntPtr size);Code
uint dwOld = 0;
sbyte pBase = (sbyte)GetModuleHandle(null);
VirtualProtect((uint)pBase, 4096, 0x04, dwOld);
ZeroMemory((IntPtr)pBase, (IntPtr)4086);* - dzvtkfuqqe - May 16, 2017
(May 15, 2017 07:20 AM)DelusionalGhost Wrote: Okay, so im working on a packer called .NET Squeezer and im struggling.. ive made an Anti-Dump, yet it still dumps the files from Assembly.Load(byte[]).EntryPoint.Invoke(null, null); So i got thinking and thgouht, hmm.. mabie i can make a PE for .NET, so i worked on that, and it STILL Dumped, so i cringed and got pissed. Anyone know any kind of method or a way i can prevent Dumping while creating an instance with reflection?
I'm basically parroting what others on their thread have said but looking at ConfuserEX is a worthwhile option. It's open-source and gives valid examples of how multiple confusion techniques are done.. IE protection against dumping. Head over to yck1509's git. I would link you but I can't post links. And I'd rather not incur a report for attempting to bypass this rule.
* - DelusionalGhost - May 16, 2017
(May 16, 2017 06:22 AM)dzvtkfuqqe Wrote: I'm basically parroting what others on their thread have said but looking at ConfuserEX is a worthwhile option. It's open-source and gives valid examples of how multiple confusion techniques are done.. IE protection against dumping. Head over to yck1509's git. I would link you but I can't post links. And I'd rather not incur a report for attempting to bypass this rule.
Thanks man, i appreciate your help!