[µnKn0wn_H4CK3r]

Hi!

I had this idea a while ago. Let me explain myself.

You all know that we can decompile (even if the application is packed/obfuscated) and get the source of any Visual Basic or .NET managed applications. More or less easily, depends on which packer/obfuscator/technic you used.

The problem for VB/.NET developers is: protect the application to prevent it from a decompilation.

Also, maybe you know that the native C++ (or C or any other native language) is very harder (almost impossible?) to decompile than VB/.NET.

Ok.. Do you see where I want to drive you?

• You create a native (not .NET) C++ project
  


• You make a .NET program which will run the protected program (I'll explain below), and put it as resource in the C++ program. WE CALL THIS PROGRAM 'A'
  


• Still in a resource file, put the encrypted program (the one you want to protect) (like Convert.ToBase64String(IO.File.ReadAllBytes("MyFileToProtect.exe"))). WE CALL THIS PROGRAM 'B'
  


• The C++ exe will drop the program 'A' and run it with passing in arguments the 'B' program (encrypted program, the one you want to protect)
  


• The 'A' program will decrypt the 'B' program (like Convert.FromBase64String(Environment.GetCommandLineArgs(1)))
  


• Now, the 'A' program will use reflection to run the program you want to protect (like Spoiler (Click to View)
  Code

  Private Sub ManagedPE(ByVal Bytes As Byte())
    Dim myAssembly As Assembly = myAssembly.Load(Bytes)
    myAssembly.EntryPoint.Invoke(RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(myAssembly.CreateInstance(myAssembly.EntryPoint.Name))), New Object() {New String() {"1"}})
End Sub

Dim myThread As New Threading.Thread(AddressOf ManagedPE)
myThread.Start(DecryptedBytes)
  )

What do you think about it?

I think I'll try to code it during the holidays (in France: at the end of the week).

[BravoTwoZero]

Wow/Jeez you're creative but yeah would be an good idea, native resource loader.. Good idea :D

[µnKn0wn_H4CK3r]

Wow/Jeez you're creative but yeah would be an good idea, native resource loader.. Good idea :D

Thanks.
Yeah, and instead of always encrypt the file and manually create a rc file, we could use UpdateResource API for example (and make a program to automatically protect a program when you click a beautiful button 'Protect !' 😁).

[Entrepreneur]

Sounds like a great idea, i hope you get this coded.

[µnKn0wn_H4CK3r]

Sounds like a great idea, i hope you get this coded.

I'm sure it's possible. I'm not a C++ programmer but this section exists 😁 !
Also, if you want to help me with this little project.. Reply here or PM me.

[imi-tat0r]

So if the c++ file is dropped, you just gotta unpack the ressources and bam here you got

[µnKn0wn_H4CK3r]

So if the c++ file is dropped, you just gotta unpack the ressources and bam here you got

And BAM read again my post.
The protected file is never dropped.

[BravoTwoZero]

It is like running the compiled form but covered in a native compiled box. Simple explanation = right?

[µnKn0wn_H4CK3r]

It is like running the compiled form but covered in a native compiled box. Simple explanation = right?

Not quite. The native compiled drop a .NET managed that will use reflection to show the .NET managed you want to protect (because the native exe can't do that).

[BravoTwoZero]

But the protected file will be running in the memory and not dropped right?

[µnKn0wn_H4CK3r]

But the protected file will be running in the memory and not dropped right?

Yep, you're right 🙂

[BravoTwoZero]

Phew.... Finally I got it.. It is very complicated at first thought!! :S

Thanks for teaching me !!

[µnKn0wn_H4CK3r]

Phew.... Finally I got it.. It is very complicated at first thought!! :S

Thanks for teaching me !!

You're welcome 🤝

More feedbacks 🙂 ?

[BravoTwoZero]

You're welcome 🤝

More feedbacks 🙂 ?

From me none!!

To Other : C'mon Comment... let's see

[H3x0S]

You will still have to store your .NET file somewhere, and it could be decrypted/extracted from there. This won't work.