Aug 7, 2011 12:56 AM
(This post was last modified: Aug 8, 2011 05:50 AM by d3c0mpil3r.)
When I was working on my obfuscator, I figured out how we can fool .NET Reflector and stop it from showing our code both in C#, etc or IL language...so just throwing a simple tool made 5mins ago (not protected you can take a look at the source, if you want)
Basically, we are adding an invalid call to a method which doesn't exist in the ASSEMBLY! That's it.
Pics:
Download:
http://uppit.com/gm15fdyjyhhu/ILBlock.rar
Enjoy!🤝
Thanks. Shall take a look now :)
And it doesn't complain at runtime? If not that's nice, did you find it out yourself?
Probably coding some useless shit.
(Aug 7, 2011 01:17 AM)ubbelol Wrote: And it doesn't complain at runtime? If not that's nice, did you find it out yourself?
At runtime? What do mean? Its just adding a invalid call but the execution isn't altered (a jump at the start ^^)
and yes :)
(Aug 7, 2011 01:19 AM)d3c0mpil3r Wrote: At runtime? What do mean? Its just adding a invalid call but the execution isn't altered (a jump at the start ^^)
and yes :)
Ah sorry, stupid moment by me.. I thought you actually let the instruction execute at runtime. :p
Probably coding some useless shit.
i was play with it and it would only let me block one function.
i was play with it and it would only let me block one function.
Thank you
i was play with it and it would only let me block one function.
Thank you
yea, same with porgrammer101, it only lets you block 1 function...
Sorry guys but I deleted the project so can't really fix it. It was more of a POC to let others know how its done and not actually meant to protect my EXEs.
I will soon fix few remaining things in my obfuscator and release it.
(Aug 8, 2011 04:26 AM)d3c0mpil3r Wrote: Sorry guys but I deleted the project so can't really fix it. It was more of a POC to let others know how its done and not actually meant to protect my EXEs.
I will soon fix few remaining things in my obfuscator and release it.
You can archive it by changing a byte value right? I remember reading something about this.. not sure if you used the same method though. Thanks for releasing anyway.
(Aug 8, 2011 04:48 AM)The-One Wrote: You can archive it by changing a byte value right? I remember reading something about this.. not sure if you used the same method though. Thanks for releasing anyway.
I think you are referring to this.
If yes, then no this method is different. You are creating an invalid call to a method hence preventing .NET Reflector to read both C# or IL code.
Aug 8, 2011 05:33 AM
(This post was last modified: Aug 8, 2011 05:47 AM by Ethereal.)
Isn't there a way to do this with (native) or something, by changing the Magic number?
Just a question, looks good.
By the way, you missed an 'f' in the title.
(Aug 8, 2011 05:28 AM)d3c0mpil3r Wrote: I think you are referring to this.
If yes, then no this method is different. You are creating an invalid call to a method hence preventing .NET Reflector to read both C# or IL code.
Yes, that's what I meant, but I saw it on another site a few years back. Nvm, thanks anyway!
(Aug 8, 2011 05:33 AM)Ethereal Wrote: Isn't there a way to do this with (native) or something, by changing the Magic number?
Just a question, looks good.
By the way, you missed an 'f' in the title.
I really have no idea what so ever.
and thanks for the correction LOL
(Aug 8, 2011 05:45 AM)The-One Wrote: Yes, that's what I meant, but I saw it on another site a few years back. Nvm, thanks anyway!
Ah, no problem :P
(Aug 8, 2011 05:33 AM)Ethereal Wrote: Isn't there a way to do this with (native) or something, by changing the Magic number?
Just a question, looks good.
By the way, you missed an 'f' in the title.
But wouldn't windows recognize it as another sort of file then? (In this case native :P) and not a .NET assembly.
I guess it'll keep it from reflector but windows as well x)
Probably coding some useless shit.
(Aug 8, 2011 05:53 AM)ubbelol Wrote: But wouldn't windows recognize it as another sort of file then? (In this case native :P) and not a .NET assembly.
I guess it'll keep it from reflector but windows as well x)
There's a way around it, I remember m4x talking to me about it to prevent memory dumps.
|