viernes, 31 de enero de 2014

[ Cracking ] DriverEasy is possible to crack?

Hello!
Searching for some to crack, I found DriverEasy which looks a great target. Then seeking for the Key and "IsValid" property to edit it, I found a message from the creator:


I just ignored that but searching in detail you will find this:

So this just looks that you need to put some key to be validated. But seeing what uses the "Key" property I found that the Serial is checked by the server to return the drivers.


So the answer is: YES! You can simply buy a sample serial and insert it into the application. Example: 1234 my valid serial:

GetMyStuff("1234") instead of GetMyStuff(lic.Serial).

But without buying is impossible.




viernes, 17 de enero de 2014

[.NET] How to extend trial on a SmartAssembly v6.x protected assembly?

Hello!
SmartAssembly's protected assemblies shows a nag screen if you haven't activated it.


So I wanted show how to extend the trial days of an SmartAssembly v6.x protected assembly without any need of getting a S/N for SmartAssembly and also without deobfuscating.

SmartAssembly puts a method which returns True or False if the PC is different or the date of 15 free days has been passed. So we just need to patch the date and also the PC check (which is just a registry key on ...\Reflector\SoftwareName).

So follow this instructions to patch the Date check:

And to patch the PC check:

Don't forget! You don't need to deobfuscate it so it's difficult to find the methods without looking the good code.

See you!
LordCoder//REiS

domingo, 12 de enero de 2014

[.NET Reflection] How to rename correctly to get a working assembly?

Hello!
Maybe you are trying to do an obfuscator/deobfuscator. You got all the types and the methods and you're applying .Name = "My new name". But the symbol renaming has some rules to get again a working assembly.

The renaming rules for types.
It mustn't be...

  • <Module> class.
  • "Runtime".
  • "RuntimeSpecialName".
  • Contain "Resources" or "__".
  • Be an Enum.
For some types you also need to edit the resources. For example in a "System.Windows.Forms.Form" it creates a resource which is "Project_Name.FormName.resources". If you edit the name, it won't run anymore. The solution is to rename also the resource with:
"Project_Name.NewFormName.resources". Just that.

The renaming rules for methods.
It mustn't be...
  • contructor (.ctor and .cctor).
  • "Runtime".
  • "RuntimeSpecialName".
  • "Virtual".
  • "Abstract"
  • No "Overrides" of that method.
  • "PInvokeImpl" of any library.

All of this have a reason. Mostly because of the calling from other methods. For example, if any method is with PInvokeImpl which means it calls to an external function on a DLL you can't rename it.

In some cases, you also need to forget "InitializeComponent". But it depends on the assembly.


I hope this helps as in the internet there is no good documentation about symbol renaming.

See you,
LordCoder//REiS

[.NET Reflection] Adding "SuppressIldasmAttribute" with Mono.Cecil

Hello,
"Mono.Cecil" is a fantastic library for editing the .NET applications which are already compiled. I'm going to show how to add the "SuppressIldasmAttribute" which does this:


















This can be easily done putting "<Assembly: SuppressIldasm()>" on the top of any class. But what about putting it with Mono.Cecil for an assembly we don't have the source code?
Follow this instructions:
1º Load with "AssemblyDefinition" any file or Byte[] and put it on a variable.
Dim my_sample As AssemblyDefinition = AssemblyDefinition.ReadAssembly("A file/Byte[]")
 2º We need to get the contructor of "SuppressIldasmAttribute" on "System.Runtime.CompilerServices". So do this:
Dim constructor As MethodReference = a.MainModule.Import(GetType(SuppressIldasmAttribute).GetConstructor(New System.Type() {}))
3º Add this constructor (.ctor) to the "CustomAttributes" of the assembly:
my_sample.CustomAttributes.Add(New CustomAttribute(constructor))
Now it's done! It will appear the avobe message when anyone try to dissassemble with IlDasm.

Enjoy!
LordCoder//REiS