[µnKn0wn_H4CK3r]

Hi!

I had this idea a while ago. Let me explain myself.

You all know that we can decompile (even if the application is packed/obfuscated) and get the source of any Visual Basic or .NET managed applications. More or less easily, depends on which packer/obfuscator/technic you used.

The problem for VB/.NET developers is: protect the application to prevent it from a decompilation.

Also, maybe you know that the native C++ (or C or any other native language) is very harder (almost impossible?) to decompile than VB/.NET.

Ok.. Do you see where I want to drive you?

• You create a native (not .NET) C++ project
  


• You make a .NET program which will run the protected program (I'll explain below), and put it as resource in the C++ program. WE CALL THIS PROGRAM 'A'
  


• Still in a resource file, put the encrypted program (the one you want to protect) (like Convert.ToBase64String(IO.File.ReadAllBytes("MyFileToProtect.exe"))). WE CALL THIS PROGRAM 'B'
  


• The C++ exe will drop the program 'A' and run it with passing in arguments the 'B' program (encrypted program, the one you want to protect)
  


• The 'A' program will decrypt the 'B' program (like Convert.FromBase64String(Environment.GetCommandLineArgs(1)))
  


• Now, the 'A' program will use reflection to run the program you want to protect (like Spoiler (Click to View)
  Code

  Private Sub ManagedPE(ByVal Bytes As Byte())
    Dim myAssembly As Assembly = myAssembly.Load(Bytes)
    myAssembly.EntryPoint.Invoke(RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(myAssembly.CreateInstance(myAssembly.EntryPoint.Name))), New Object() {New String() {"1"}})
End Sub

Dim myThread As New Threading.Thread(AddressOf ManagedPE)
myThread.Start(DecryptedBytes)
  )

What do you think about it?

I think I'll try to code it during the holidays (in France: at the end of the week).

[BravoTwoZero]

Wow/Jeez you're creative but yeah would be an good idea, native resource loader.. Good idea :D

[µnKn0wn_H4CK3r]

Wow/Jeez you're creative but yeah would be an good idea, native resource loader.. Good idea :D

Thanks.
Yeah, and instead of always encrypt the file and manually create a rc file, we could use UpdateResource API for example (and make a program to automatically protect a program when you click a beautiful button 'Protect !' 😁).

[µnKn0wn_H4CK3r]

Sounds like a great idea, i hope you get this coded.

I'm sure it's possible. I'm not a C++ programmer but this section exists 😁 !
Also, if you want to help me with this little project.. Reply here or PM me.

[µnKn0wn_H4CK3r]

So if the c++ file is dropped, you just gotta unpack the ressources and bam here you got

And BAM read again my post.
The protected file is never dropped.

[BravoTwoZero]

It is like running the compiled form but covered in a native compiled box. Simple explanation = right?

[µnKn0wn_H4CK3r]

It is like running the compiled form but covered in a native compiled box. Simple explanation = right?

Not quite. The native compiled drop a .NET managed that will use reflection to show the .NET managed you want to protect (because the native exe can't do that).

[BravoTwoZero]

But the protected file will be running in the memory and not dropped right?

[µnKn0wn_H4CK3r]

But the protected file will be running in the memory and not dropped right?

Yep, you're right 🙂

[BravoTwoZero]

Phew.... Finally I got it.. It is very complicated at first thought!! :S

Thanks for teaching me !!

[µnKn0wn_H4CK3r]

Phew.... Finally I got it.. It is very complicated at first thought!! :S

Thanks for teaching me !!

You're welcome 🤝

More feedbacks 🙂 ?

[BravoTwoZero]

You're welcome 🤝

More feedbacks 🙂 ?

From me none!!

To Other : C'mon Comment... let's see

[µnKn0wn_H4CK3r]

You will still have to store your .NET file somewhere, and it could be decrypted/extracted from there. This won't work.

I'll store the encrypted .NET file in a resource file which will be compiled (C++). It can be decompiled, for sure, but not with a drag & drop..

I used a loader method with just .NET for world-net that read the bot from resources then decrypted and used reflection, but 98% of coders here won't know what to do with a C compiler.

Nice POC, baby. ✌ (no homo, I'm saying baby since its in your name)

Hm, ok. Thanks 🙂 .

But the protected file is a ressource of your C++ "Loader" and the Loader is dropped and there you go. Get the ressource of your C++ Loader and decompile

Harder than drag & drop a .NET file in Reflector, right?

if you would dump the file somewhere to the hdd the protection is just useless because it's somewhere at the hdd
and if its using runPE you can just attach a debugger to it and dumping the file and protection gone

probably the best way to protect it just like writing ur program in C#/VB whatever and only making prototypes like..
public void lol() { } and thats it... and at the C++ side ull just hook the function 'lol' and putting in there some code for example

MessageBoxA(NULL, "this came from C++", "", MB_OK);

so when people even would be able to decompile ur .net program those functions will be empty 👍

I won't dump the protected file anywhere. For the 'RunPE', I'm ok.

Then, if you only write the prototypes in C# and you implement the functions in C++, just write the entire program in C++..

[µnKn0wn_H4CK3r]

I added a pool. Please answer 🙂 !

[µnKn0wn_H4CK3r]

Ok, anyway, it's an old thread.
Closed.