Reverse Engineering RET Homepage RET Members Reverse Engineering Projects Reverse Engineering Papers Reversing Challenges Reverser Tools RET Re-Search Engine Reverse Engineering Forum Reverse Engineering Links

Go Back   Reverse Engineering Team Board > Reverse Engineering Board > .NET Reverse Engineering
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Display Modes
  #1  
Old 01-19-2012, 01:23 PM
Marton Marton is offline
Member
 
Join Date: Nov 2011
Posts: 7
Default Can't "return" from function - HELP!

Hi all, I'm dealing with this function:

http://cablemodem.fibertel.com.ar/marton79/func.txt

It is called like this:

Code:
private void btnOK_Click(object sender, EventArgs e)
{
    ClientSessionManager.Instance.SaveAndSetServerInfos(this.serverInfos);
    if (ActivationHandler.Activator.GetStrongestEdition(new Product(Product.ProductTypes.prApplication)) == null)
    {
        MessageBox.Show(this, ApplicationResourceManager.Instance.GetString("Project.ActivationForm.NeedActivtion.Text"), ApplicationResourceManager.Instance.GetString("Project.ActivationForm.NeedActivtion.Caption"), MessageBoxButtons.OK, MessageBoxIcon.Asterisk);
    }
    base.Close();
}
Why, WHY I can't just return 1 or any needed result from the GetStrongestEdition funcion? If I do that, I get a General Error on program launch and it closes. If I patch the last return, the message box still shows up, but the return is executing because if I nop it out, the program crashes.
I spent many hours trying to figure this out but it is beyond my knowledge. I could make a donation to anyone who could help me achieve the goal

TIA
Reply With Quote
  #2  
Old 01-19-2012, 02:31 PM
Git Git is offline
Super Moderator
 
Join Date: Oct 2007
Location: Torino
Posts: 1,797
Default

Donations not allowed here, unless to charity.

It sounds like the program has verification in the form of CRC or hashing of some kind. Disassemble near the start of the program and you should find it. It may help to run a crypto/hash detector on the exe.

Git
Reply With Quote
  #3  
Old 01-19-2012, 04:49 PM
kao kao is offline
Senior Member
 
Join Date: Sep 2007
Posts: 184
Default

Sure you can do it, you just need to be extremely careful when patching your program. The crashes you see most likely come from .NET framework detecting invalid IL code or type.

The proper code should look like this:
Code:
edition = new Edition(Edition.EditionTypes.edApplicationServerStandard);  // or whatever edition you like
return edition;
The hard part is to nop out all the useless code and fix all the try/catch/fault blocks. Since your program seems to be mixed-mode assembly, almost none of the usual tools will work properly.

I'd use hex editor/CFF for patching and ILDASM/PEVERIFY to verify that I didn't mess up.

Last edited by kao : 01-19-2012 at 04:53 PM. Reason: added suggested tools.
Reply With Quote
  #4  
Old 01-20-2012, 11:54 AM
Marton Marton is offline
Member
 
Join Date: Nov 2011
Posts: 7
Default

Thanks for the tips!
I'll try manually coding it with the hex editor and try to get it as kao suggests. Is it OK to fill the rest of the function with nops till the end, or something else is required?
Will post the results
Thanks again!
Reply With Quote
  #5  
Old 01-24-2012, 08:54 AM
DotNetResearcher2 DotNetResearcher2 is offline
Member
 
Join Date: Sep 2011
Posts: 6
Default

Quote:
Originally Posted by kao View Post
I'd use hex editor/CFF for patching and ILDASM/PEVERIFY to verify that I didn't mess up.
On a related but tangential note, I've been enjoying using UltraEdit as a hex editor - for anything other than a single edit, it's better than CFF.

DNR
Reply With Quote
  #6  
Old 01-29-2012, 03:46 PM
bball0002 bball0002 is offline
Senior Member
 
Join Date: Mar 2009
Posts: 72
Default

I think it's very easy to edit methods with CFF explorer. You can go to the methods table and highlight instructions, right click -> nop. You can also edit branches this way.
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump





Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2020, Jelsoft Enterprises Ltd.