Помощь по коду anti-debugging

***********************************************************************************************************************************
*************************************************** ------- 1 ------- *************************************************************
***********************************************************************************************************************************
Anti decompiling
 
Запускаем ILdasm, открываем нашу сборку exe. Делаем dump (Show progress bar лучше выключить), сохраняем файл дампа в ту же папку.
Закрываем ILdasm. Открываем файл *****.il в блокноте (лучше использовать Notepad++).
Ищем начало интересующего нас метода который мы хотим спрятать, и вставляем в него нижеприведенную строчку. (между { и //Code size).
Сохраняем изменения в файле. И компилируем *****.il код обратно в *.exe, через Ilasm.
 
// Anti decompiling:
.custom instance void  [System]System.ComponentModel.EditorBrowsableAttribute::.ctor(valuetype  [System]System.ComponentModel.EditorBrowsableState) = ( 01 00 02 9 9 9  9  00 00 00 00 00 )
.custom instance void [mscorlib]System.Diagnostics.DebuggerHiddenAttribute::.ctor() = (01 00 00 00)
.custom instance void [System]System.ComponentModel.EditorBrowsableAttribute::.ctor(valuetype [System]System.ComponentModel.EditorBrowsableState) = (01 00 02 00 00 00 00 00)
.custom instance void [mscorlib]System.STAThreadAttribute::.ctor() = (01 01 00 00 00)
 
?????
.custom instance void [mscorlib]System.Runtime.CompilerServices.SuppressIldasmAttribute::.ctor() = ( 01 00 00 00 )
.custom instance void [mscorlib]System.Runtime.CompilerServices.CompilationRelaxationsAttribute::.ctor(int32) = ( 01 00 08 00 00 00 00 00 )
.custom instance void [mscorlib]System.Runtime.CompilerServices.RuntimeCompatibilityAttribute::.ctor() = ( 01 00 01 00 54 02 16 57 72 61 70 4E 6F 6E 45 78   // ....T..WrapNonEx
63 65 70 74 69 6F 6E 54 68 72 6F 77 73 01 )       // ceptionThrows.
  .hash algorithm 0x00008004
  .ver 0:0:0:0
  
  
 
// Anti re-compileing:
.custom instance void [Microsoft.VisualC]Microsoft.VisualC.DebuginfoinPDBAttribute::.ctor()
.custom instance void [mscorlib]System.Runtime.CompilerServices.NativecppClassAttribute::.ctor()
.custom instance void [mscorlib]System.Runtime.CompilerServices.UnsafeValueTypeAttribute::.ctor()
.custom instance void [Microsoft.VisualC]Microsoft.VisualC.MiscellaneousBitsAttribute::.ctor(int32) = {int32(0x41)}
 
// ?????
 
[MD](0x80131B0A): Error: Interface is marked Sealed. [token:0x0200000D]
[MD](0x80131B0A): Error: Interface is marked Sealed. [token:0x0200001B]
[MD](0x80131B0A): Error: Interface is marked Sealed. [token:0x0200001E]
[MD](0x80131B18): Error: Class implements interface but not method(class:0x02000010; interface:0x0200000b; method:0x06000028).[token:0x09000004]
[MD](0x80131B18): Error: Class implements interface but not method(class:0x02000010; interface:0x0200000b; method:0x06000029).[token:0x09000004]
[MD](0x80131B18): Error: Class implements interface but not method(class:0x02000010; interface:0x0200000b; method:0x0600002c).[token:0x09000004]
[MD](0x80131B18): Error: Class implements interface but not method(class:0x02000010; interface:0x0200000b; method:0x0600002d).[token:0x09000004]
 
 
 
***********************************************************************************************************************************
*************************************************** ------- 2 ------- *************************************************************
***********************************************************************************************************************************
Anti ILDASM
 
Suppress disassembly to IL using the ildasm.exe tool by applying the SuppressIldasmAttribute from the System.Runtime.CompilerServices namespace:
   [assembly: SuppressIldasm()]
 
Внутри проекта в Visual Studio открываем папку Properties, и затем файл AssamblyInfo.cs
Добавляем новый компонент перед:
[assambly: AssamblyTitle("Blablabla");
 
[assembly: SuppressIldasm]
 
Или добавить прям в *.il код перед:
.custom instance void [mscorlib]System.Reflection.AssemblyTitleAttribute::.ctor(string) =
 
 
.custom instance void [mscorlib]System.Runtime.CompilerServices.SuppressIldasmAttribute::.ctor() = ( 01 00 00 00 ) 
 
///////////////////////////////////////////////////////////2
 
Follow these steps to protect the assembly from getting disassembled
 
Step1: Generating IL ILDASM Class1.exe /out=Class1.il 
 
Step2: Setting the owner option ILASM /owner=abc Class1.il 
 
This will create the assembly Class1.exe with the owner as "abc", not try to open this assembly with ILDASM utility.
 
You will get a message saying "Copyrighted Material- can not disassemble"
 
This assembly can only be viewed by supplying the owner
 
ILDASM /owner=abc Class1.exe 
 
Once the compilers come with the /owner option, protecting the assembly will be much easier.
 
 
 
***********************************************************************************************************************************
*************************************************** ------- 3 ------- *************************************************************
***********************************************************************************************************************************
Anti dump
 
Удаляет заголовок PE файла из памяти. 1-2
 
[DllImport("kernel32.dll", CharSet = CharSet.Auto)]
  public static extern IntPtr GetModuleHandle(string lpModuleName);
  [DllImport("kernel32.dll", SetLastError = true)]
  static extern bool VirtualProtect(IntPtr lpAddress, uint dwSize, uint flNewProtect, out uint lpflOldProtect);
  [DllImport("Kernel32.dll", EntryPoint = "RtlZeroMemory", SetLastError = false)]
  static extern void ZeroMemory(IntPtr dest, IntPtr size);
 
  static private void ErasePE()
  {
    UInt32 size = 0; 
    IntPtr BaseAddr = GetModuleHandle(null);
    VirtualProtect(BaseAddr, 4096, 0x04, out size);
    ZeroMemory(BaseAddr, (IntPtr)4096);
  }
  
  //////////////////////////////////// ----- 2 ----- /////////////////////////////////
[DllImport("kernel32.dll")]
public static extern IntPtr GetModuleHandle(string lpModuleName);
[DllImport("kernel32.dll", SetLastError = true)]
static extern int VirtualProtect(uint lpAddress, int dwSize, int flNewProtect, uint lpflOldProtect);
[DllImport("Kernel32.dll", EntryPoint = "RtlZeroMemory", SetLastError = false)]
static extern void ZeroMemory(IntPtr dest, IntPtr size);
 
public void AntiDump()
{
    uint dwOld = 0;
    sbyte pBase = (sbyte)GetModuleHandle(null);
    VirtualProtect((uint)pBase, 4096, 0x04, dwOld);
    ZeroMemory((IntPtr)pBase, (IntPtr)4086);
}
***********************************************************************************************************************************
*************************************************** ------- 4 ------- *************************************************************
***********************************************************************************************************************************
DLL
 
In this trick we are abusing the freedom of ilasm, making it compile a invalid array range(negative) 
thus crashing almost all decompilers including ildasm.
 
Создаем текстовый документ со следующим содержанием:
.assembly NAME_NAME {}
.module NAME_NAME.dll
.field static int32[-268435455 ... 268435456] NAME_NAME
 
Компилируем с помощью Ilasm.exe (не забываем указывать /dll). И наш файл не будет открываться в Ildasm и других программах.

///////////////////// Keyz World-Dev.com - to DDC Team //////////////////////
 
Unpacking confuser v1.9 max settings enabled.
first download the msil decryptor.
 
[url]http://uppit.com/irrah14pjhm6/Simple_MSIL_Decryptor.zip[/url]
[url]http://uppit.com/qinahamvavsw/1_msil_fix12.rar[/url]
Now Just browse the confused assembly... its important to check on the use loadlibrary, then click on decrypt..
 
You still cant browse on the methods when you open it on SAE dont use reflector coz that was a trash as simple as that.
 
So here's the next step..
 
Download this: universal fixer, if you dont have..
 
[url]http://uppit.com/tmkcdyz2fc2h/Universal_Fixer.zip[/url]
 
Browse the decryted assembly, then click on fix just use default.. wait for the tool to fix the program, remember that it will takes a longer time to do its job since we know that confuser sucks it also defend on the program size.. seeing on the statistic of the fixer that it successfully fixed and save the assembly on a directory signals us that it already done on its job...
 
open it on SAE and feel happy to browse on those methods and you gonna see those il codes... Smile
 
but the last problem is that it wont run.. Mad ?
 
so here's the solution... on SAE search for the word "broken file" it will be found by the decompiler and go to the first il code of that method,copy its RVA address.
 
open the fixed file on CFF EXPLORER..
 
[url]http://www.ntcore.com/exsuite.php[/url]
 
input the RVA ADDRESS on the rva box on the cff explorer and it will give you its offset address of the file, then change the bytes on that offset with this hex byte value 2A (IN SImple word, we ret that method, we just only use hexbyte patching.), and maybe wait also for my search and replace byte patcher to easily do this or someone can generate it or just program the tool.
 
run the file, and it will run now... so cheers..
 
the strings are still encrypted, but there is a tool named dotnet tracer, to help you crack easy as like you are blind.. Tongue
 
de4dot can also cleaned the fixed the running assembly, so newbie cracker will now wont have problem on confuser..
 
AND SO, CONFUSER WILL NOW ENDS.. Enjoy
Keyz / Jejus.