吾爱破解 - LCG - LSG |安卓破解|病毒分析|www.52pojie.cn

 找回密码
 注册[Register]

QQ登录

只需一步,快速开始

查看: 3990|回复: 26
收起左侧

[UnPackMe] 最新C#双重加密高手来试试!!!!2022-8-30

[复制链接]
16200 发表于 2022-8-30 19:06
CM是什么?Crackme是什么?这是什么东西?楼主发的什么?
他们都是一些公开给别人尝试破解的小程序,制作 Crackme 的人可能是程序员,想测试一下自己的软件保护技术,也可能是一位 Cracker,想挑战一下其它 Cracker 的破解实力,也可能是一些正在学习破解的人,自己编一些小程序给自己破解,KeyGenMe是要求别人做出它的 keygen (序号产生器), ReverseMe 要求别人把它的算法做出逆向分析, UnpackMe 是要求别人把它成功脱壳,本版块禁止回复非技术无关水贴。




可以爆破密码  但是主要还是要还原代码!!!!!!
混淆了代码然后还有WinLicense加密  应该不容易被干了!!!
你们可以试试
下载地址
https://wwm.lanzoub.com/i7Z1A0akpzja

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?注册[Register]

x

免费评分

参与人数 3吾爱币 +2 热心值 +2 收起 理由
lgc81034 + 1 谢谢@Thanks!
神威 + 1 用心讨论,共获提升!
coder9527 + 1 + 1 热心回复!

查看全部评分

发帖前要善用论坛搜索功能,那里可能会有你要找的答案或者已经有人发布过相同内容了,请勿重复发帖。

BlackHatRCE 发表于 2022-8-31 02:27
本帖最后由 BlackHatRCE 于 2022-8-31 03:10 编辑


LET'S START THE DECRYPTION





STEPS -

  • I downloaded the File and It was very Big in Size = approximately - 23 MB (My mood was off when I saw such a big Unpack Me)
  • I ran the "CrackMeRun" and did a memory Dump as you used "Winlicense" as Native Wrapper.
  • It is absolutely a worst Idea to use Protector like "Winlicense/Themida/Enigma/Obsidium" over C#/.NET file as they just increase the size and don't contribute anything in protection unless used with SDK and licensing in a proper way.


  • I got the Original "CrackMeRun" file (Posted above) with "CrackMeMain" file (posted below).



Question - Why did you use "Temp" folder to drop a "RunDLL" exe with a ".cs" code ? --> It made this 'Unpack Me" like a Malware.

  • I got a random name generated folder in "Temp" though the .cs file having code can be seen in "CrackMeMain" as well.
  • I see a "RunDLL" exe in Temp folder too along with A .cmdline file.


  • Anyways, I decrypted "CrackMeMain" file from ConfuserEx.
  • Now I bypassed Anti-debugging and Ran the "CrackMeMain" file and saved "CrackMe" file from memory.
  • I fixed the dumped File of "CrackMe" and I saw that It also have the ConfuserEx so I unpacked it.

How did I unpack ConfuserEx?
  • Unpack Anti Tamper via Module.cctor
  • Unpack Cflow. It is a basic One.
  • Unpack Proxy Calls.
  • Deal with Anti Invoking and Decrypt Strings. Strings int value is Mutated. You can do some Math Mutations to get final Result.
  • Now I fixed the Type Scrambler, Renamed methods.
  • I decrypted base64 of "CrackMeMain" to get the same code posted above which is similar to .cs file in "Temp" folder.

  • After unpacking ConfuserEx from "CrackMe" We can clearly see the Code.
  • I used my modified Renamer to rename it properly and made it 100% like original.



As You can see, It is properly Unpacked and restored like Original unprotected File.

Tip : Don't make un-necessary larger size Unpack Me. Don't use coding style which looks like a Virus/Dropper otherwise People won't check it.

Difficulty : 1.5/10 (0.5 for Math Mutations added on String Encryptions) that's it.



If anyone knows English and Chinese both language,
He can translate it properly for everyone.
I do not know Chinese so I can not type in Chinese language (may be I am not smart enough to learn it).


本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?注册[Register]

x

免费评分

参与人数 24吾爱币 +29 热心值 +24 收起 理由
gfhfhoo + 1 + 1 Very impressing, I like your articles!
非凡公子 + 1 + 1 我很赞同!
HAINING + 1 + 1 大佬啊,真是大佬,能出点 视频不
5151diy + 1 + 1 我很赞同!
火之国 + 1 + 1 来这几年了遇到真人了膜拜
wobushiafa + 1 + 1 我很赞同!
Jimmy_hop + 1 + 1 Brilliant!
Light紫星 + 2 + 1 谢谢@Thanks!
evea + 1 + 1 谢谢@Thanks!
iNIC + 1 + 1 谢谢@Thanks!
我心飘野 + 1 + 1 Great!!!
Tonyha7 + 1 + 1 谢谢@Thanks!
xiaoAmie + 1 + 1 我很赞同!
lichunfeng + 1 + 1 GOOD JOB
610100 + 3 + 1 欢迎分析讨论交流,吾爱破解论坛有你更精彩!
991547436 + 2 + 1 我很赞同!
CrazyNut + 1 + 1 我很赞同!
scncrenyong + 1 + 1 我很赞同!
李玉风我爱你 + 2 + 1 我很赞同!
qweasdasd + 1 + 1 You are very good.
lantian21 + 1 + 1 我很赞同!
Hou + 1 + 1 我很赞同!
16200 + 1 + 1 我很赞同!
Sorryks + 1 + 1 用心讨论,共获提升!

查看全部评分

igb 发表于 2022-8-30 19:23
991547436 发表于 2022-8-30 19:33
 楼主| 16200 发表于 2022-8-30 21:07

能否 还原代码!!!
luqian5588 发表于 2022-8-30 22:01
回想当年,我也曾经是个程序员啊^_^
落红护花 发表于 2022-8-30 22:05
这样的加密应该不适用于较大型程序,混淆还好,再套WinLicense会大幅降低运行效率
 楼主| 16200 发表于 2022-8-31 07:36
BlackHatRCE 发表于 2022-8-31 02:27
LET'S START THE DECRYPTION




大佬 厉害了。。。。
liyajojo 发表于 2022-8-31 08:13
BlackHatRCE 发表于 2022-8-31 02:27
LET'S START THE DECRYPTION




膜拜大佬
smilencetion 发表于 2022-8-31 09:13
BlackHatRCE 发表于 2022-8-31 02:27
LET'S START THE DECRYPTION




Are you a native English speaker?
您需要登录后才可以回帖 登录 | 注册[Register]

本版积分规则 警告:本版块禁止回复与主题无关非技术内容,违者重罚!

快速回复 收藏帖子 返回列表 搜索

RSS订阅|小黑屋|处罚记录|联系我们|吾爱破解 - LCG - LSG ( 京ICP备16042023号 | 京公网安备 11010502030087号 )

GMT+8, 2024-3-28 23:28

Powered by Discuz!

Copyright © 2001-2020, Tencent Cloud.

快速回复 返回顶部 返回列表