Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact

C# 

FacelessDebugger || MSIL Emulator / Sandbox

I havnt released anything in a while and ive had this lying around for a bit so here ya go.

Download: Github


Currently only works with console applications. Will try to get forms eventual when i feel motivated enough.
Here is an example gif of the dummy app running (source on the github):

Spoiler (Click to View)

Note: The application is not being "executed". Its bytecode is being emulated by the debugger.
Here is an example of editing calls on the fly:

Spoiler (Click to View)

Yeah I know the GUI is hideous.

Any contribution to the project through the github is appreciated.
If you do choose to contribute, please keep all the "core" emulation/debugging things in the "Faceless.Core" project.
Lotta blood to let, peace to make, give a fuk about a check
This is awesome. Good job bananaboi.
[Image: Syr3DlV.png]
good release. first i thought its done with pure c# but when i take alook i saw you using dnlib.
i guess its much easy then using MethodBuilder.CreateMethodBody.
[Image: bitcoin.png] Be Nice For Once 15hVUVz7xA4kazHdk2BuErENGCskVwjYXP
If you add some randomization to the VM, this could make a powerful anti-virus and protection toolkit.

I found a similar code on github a few month back, but yours is much nicer to read.

https://github.com/neurosystemeu/Virtual-Machine/
(Feb 14, 2018 04:22 AM)HFDone Wrote:  good release. first i thought its done with pure c# but when i take alook i saw you using dnlib.
i guess its much easy then using MethodBuilder.CreateMethodBody.

MethodBuilder.CreateMethodBody Still requires that you have the bytes for each method.
dnlib is being used to parse the executable. I dont think CreateMethodBody is a substitute.
Lotta blood to let, peace to make, give a fuk about a check
(Feb 14, 2018 02:21 PM)BahNahNah Wrote:  MethodBuilder.CreateMethodBody Still requires that you have the bytes for each method.
dnlib is being used to parse the executable. I dont think CreateMethodBody is a substitute.

https://msdn.microsoft.com/en-us/library....110).aspx
[Image: Syr3DlV.png]
(Feb 14, 2018 04:10 PM)gigajew Wrote:  https://msdn.microsoft.com/en-us/library....110).aspx

That gave me an idea.
I might have a go at migrating over to using Assembly.ReflectionOnlyLoad

edit:
yeah, i dont think reflection is gonna cut it.
I need to load an assemblys bytes so that i can read the IL instructions of each method.
Loading it with reflection, then using MethodBuilder to load each methods bytes is gonna fuck up the reference to methods within the assembly.

So using the dummy app as an example, the entrypoint isnt gonna be able to find the "fib" and "reverse" methods.
Fixing the calls to point to the correct method is in option but you still gotta read the IL to ever get to that stage.

I think dnlib is the best approach at the moment.
Lotta blood to let, peace to make, give a fuk about a check
(Feb 14, 2018 04:43 PM)BahNahNah Wrote:  That gave me an idea.
I might have a go at migrating over to using Assembly.ReflectionOnlyLoad

edit:
yeah, i dont think reflection is gonna cut it.
I need to load an assemblys bytes so that i can read the IL instructions of each method.
Loading it with reflection, then using MethodBuilder to load each methods bytes is gonna fuck up the reference to methods within the assembly.

So using the dummy app as an example, the entrypoint isnt gonna be able to find the "fib" and "reverse" methods.
Fixing the calls to point to the correct method is in option but you still gotta read the IL to ever get to that stage.

I think dnlib is the best approach at the moment.

😉 "i guess its much easy then using MethodBuilder.CreateMethodBody."
with MethodBody.GetILAsByteArray you get the bytes of the method but you need to fix the tokens and other things to get it work.
Edit - but it will save you using dnlib
[Image: bitcoin.png] Be Nice For Once 15hVUVz7xA4kazHdk2BuErENGCskVwjYXP
(Feb 15, 2018 03:48 AM)HFDone Wrote:  Edit - but it will save you using dnlib

Whats wrong with dnlib?

Serious question, I never messed with it or used it.
(Feb 16, 2018 01:42 PM)Ninja Wrote:  Whats wrong with dnlib?

Serious question, I never messed with it or used it.

Nothing particularly, it's just very dense with a lack of any real documentation. So you basically have to teach yourself as there aren't many public examples.
(Feb 16, 2018 07:34 PM)debug Wrote:  ...

This is a very true statement.
Current task is trying to pry away from dnlib.

Currently porting the core things im unsung from dnlib (mainly this stuff) onto the faceless.pure branch.
Feel free to contribute wherever you can.
Lotta blood to let, peace to make, give a fuk about a check
Did a little bit of work on this project. Now can handle basic object creation/usage

[Image: kNuHrft.png]

The current mini-goal is to support emulation of winforms applications.
Lotta blood to let, peace to make, give a fuk about a check
(Sep 12, 2018 02:23 AM)BahNahNah Wrote:  Did a little bit of work on this project. Now can handle basic object creation/usage

[Image: kNuHrft.png]

The current mini-goal is to support emulation of winforms applications.

Very nice work, I saw this earlier (a few months ago) but forgot about it until now
Keep it up, really like that project. Also probably look at the project I posted on the first page if you need some inspiration


Possibly Related Threads...
Thread / Author Replies Views Last Post
[Shell] by Emre_May 30, 2020 05:10 AM 2 180 May 30, 2020 05:10 AM
Last Post: Emre_
[C#] by notahackermanApr 27, 2020 10:05 PM 14 342 Apr 27, 2020 10:05 PM
Last Post: Accord
[.NET] by TeeknofilSep 23, 2016 07:47 AM 12 1,030 Sep 23, 2016 07:47 AM
Last Post: DisguiserNET