Reverse Engineering RET Homepage RET Members Reverse Engineering Projects Reverse Engineering Papers Reversing Challenges Reverser Tools RET Re-Search Engine Reverse Engineering Forum Reverse Engineering Links

Go Back   Reverse Engineering Team Board > Reverse Engineering Board > .NET Reverse Engineering
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Display Modes
  #1  
Old 07-06-2010, 01:45 PM
lns2000 lns2000 is offline
Junior Member
 
Join Date: Jun 2010
Posts: 4
Default Patch .NET app please help me

Hi bro,

I see a software which encoded by Dotfuscator. So how to find a string "Unregisted copy" in this app? Thanks in advance,


Reply With Quote
  #2  
Old 07-06-2010, 02:05 PM
Kurapica Kurapica is offline
Senior Member
 
Join Date: May 2006
Location: Archives
Posts: 357
Default

Use the search function in Reflector, but if you are unlucky the strings will be encrypted.
__________________
Life can only be understood backwards but It must be read forwards.
Reply With Quote
  #3  
Old 07-11-2010, 02:09 PM
lns2000 lns2000 is offline
Junior Member
 
Join Date: Jun 2010
Posts: 4
Default

As you see in the 2nd image, text strings are encrypted. Any solutions for this situation?
Reply With Quote
  #4  
Old 07-11-2010, 04:32 PM
bball0002 bball0002 is offline
Senior Member
 
Join Date: Mar 2009
Posts: 72
Default

Post the exe please?
Reply With Quote
  #5  
Old 07-19-2010, 01:44 PM
lns2000 lns2000 is offline
Junior Member
 
Join Date: Jun 2010
Posts: 4
Default

@bball0002: Yes, this is one of enormous examples.

Code:
http://www.mediafire.com/download.php?cli88v5uydbv2vp
You need to "bypass" the step checking a license. It check through the Internet (it use IP address, not domain nname). So I think you must patch this soft to use it.

Thanks for your help,

Last edited by lns2000 : 07-19-2010 at 01:50 PM.
Reply With Quote
  #6  
Old 07-19-2010, 02:46 PM
bball0002 bball0002 is offline
Senior Member
 
Join Date: Mar 2009
Posts: 72
Default

Quote:
Originally Posted by lns2000 View Post
@bball0002
You need to "bypass" the step checking a license.
Well, "you" need to bypass the license check .

Here is your exe with all strings decrypted, and most control flow restored:
Code:
http://www.sendspace.com/file/qi9nfu
I also attached an exe with just strings decrypted, that should be perfectly runnable. Good luck.
Reply With Quote
  #7  
Old 07-20-2010, 12:32 AM
lns2000 lns2000 is offline
Junior Member
 
Join Date: Jun 2010
Posts: 4
Default

@bball0002. It's perfect. Thank you very much.

I'm interested to know how you decrypt those strings or how you make FaceWizard.stringsDecrypted_runnable.exe file? Can you share documents or websites or topics to help me do that?

Thanks a lot,

Last edited by lns2000 : 07-20-2010 at 12:34 AM.
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump





Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2020, Jelsoft Enterprises Ltd.