About this talk
This talk explores reverse engineering, particularly focusing on .NET applications. The speaker discusses the basics of decompiling and debugging code in the context of C# and how to inspect .NET assemblies. He emphasizes the importance of understanding compiled code to troubleshoot issues, especially in situations where documentation is lacking or legacy applications are involved. He also introduces popular tools such as ILSpy and DNSpy, demonstrating their capabilities for inspecting, modifying, and debugging compiled code. The session addresses both the ethical considerations of reverse engineering and the practical implications in software development and cybersecurity.
Full transcript
[music] thank you for your time . It is, of course, an honor for me. And thanks to Ivo for introducing me. Happy Reflection Day. Of course, be careful with these machines. Yes. And so. And first, a few words about me. This is me. I think it's 92. I don't remember. I didn't ask my mother. Shown here is a Ty Color Computer 128 KB. And this is the
monitor with a kinescope. That's probably why few people here know what it is. Tape recorder, cassette recorder. Yes. Kulf is the most knowledgeable of this age group. These are tapes that hold data. I also found a photo from a museum. This is actually what the setup looks like. There are two joysticks that are important. There are floppy disks visible somewhere, which makes me regret that this is
not my first computer. I won't comment on the curtains and the Bulgarian element. And when you log into this computer, [clears throat] the first thing you enter in quotes is the BASIC ide. Basically, you turn on the computer and directly enter an idea and start writing basic code. And I found this picture somewhere, 10th row, run, how are they and so on . Here we see the
first AI chat agent. Yes. Ah, you can imagine the green screen as a kinescope, right, the burners. It's just that green is stuck in my retina. Oh, and I've had this computer since I was six years old and I've been trying to load the games. Games back then were shared through magazines. And here I found a post from this gentleman. Does this laser work? No. Oops. Wait,
wait, wait, wait. amateur work. And with these magazines, a code was shared. So what should you do? Well, you have to copy it, right, from the paper. If this thing taught me nothing else in my childhood, it at least taught me syntax and how to copy very well. I was a good copyist. Oh, and while I was transcribing these things, of course , there were threads, strings
of text like "you 're a winner" and so on. and I remember how I used to change them, right, to put my name in the games. And of course, when this is interpreted, it doesn't compile, right, silly, at least in this version. It is interpreted, the machine passes and a game is seen. And if you look at the titles of these Big Baby Jesus, right, the man
is a stove, and notice, he has a lot more likes than I have on my posts now, right? Ah, so that's the history of the BASIC language. I have a slide here that I'm going to save. I am a fan of One Bit Softare . Yes. A 16 year old company. Thank you to the team for being here and behind the sound column and not seeing. Yes,
thank you for supporting me. Quantumm DMS, yes, our product. Oracle is our newest product. AI agent for programming. You can look at them. I can say that it's not a played guitar. Those days are gone. Now I am the advertising face of Def BG cheap tickets. I decided to Yes. Not just in one instance, but it was continuous for a long time. So if nothing else I
give you this lecture, at least you can buy me a lunch with those € you saved per head. And I have to say that Martin Koov was the advertising face of the expensive tickets. Yes. Martin, are you here so I know how much to feed you? No. Yes. Okay. Now, about reverse engineering, while I was preparing for this topic, I learned that the term reverse engineering is
actually valid. People use it. It really messes with my health, like most terms, right, but if you know me as a lecturer, I try to eliminate every foreign word. So I'll try not to use those. Well, we'll take a look at what a DNET application looks like in terms of different syllables. We'll decompile it, we'll see how to debug it without having any code. We will look
a little at the topic of oblofoskiing, how to modify oblofoskiing, and how to perform it once it is modified. Now, I've been looking for a conference for a long time to talk about these things, because this topic usually doesn't sell tickets, right? It's been an old school theory for a long time, but it rarely gets to that point. Accordingly, there are too many topics. I have divided
it into six parts. We are here privately. I don't know if we'll live to see another part. I don't know where, I don't know when. Of course, it's not finished, but if we live somewhere, I might be able to include all these things. What is my goal, as you leave this room, is for you to know what happens to your C#ARP code after you compile it and
when you run it, as Iva gave a good introduction, to see what happens, and to see C#ARP code from compiled libraries, to be able to look at these things so that you can have a one-step view ahead of your compiler, so that it can see what levels you are inventing and of course how to modify libraries for whatever purpose. Why a goal? We are looking for a
goal to understand how an application works in our work at one bit soft, even right now we have a situation where our application, our applications, databases, data everywhere and somewhere else there is some application that migrates data between their database, our database. We have no idea how this app works. The people who did it are no longer there. And there's no one to explain to us whether
we'll break something if we start changing. we want to see what is in this library , what is used, how it is used. So typical scenarios are when there is no documentation, when you simply don't know if something should even work according to your expectations, when these things are not available. This is a very practical task. Of course, if we are looking for problems, vulnerabilities, bug detection,
this is part of, right, a very important part of the cybersecurity segment, which looks at viruses and the like. In general, watching how something works is extremely And [clears throat] when it comes to fixing applications, I've also fixed Microsoft libraries in my history, simply because something wasn't naturally polished and anyway, in the world of SharePoint, it taught us to do reverse engineering absolutely every day. So IL
SP was my go-to idea in the SharePoint days, when we had to understand how it worked and possibly fix something. So, cyber security is still a hot topic . I said yes and of course, if we want to do some kind of software cracking, the term cracking, we have a product ready, right, an application or a game, most often games, and we want to remove the protection
so that we can play it completely calmly. And nowadays games are given some kind of protection, it 's not like BASIC, where you copy it and when you copy it, it doesn't compile or doesn't work because you simply copied it wrong. In the case of gaming, the engineering part of the industry is very much in demand. And for me, one step closer to the top. Being able
to look at our code after compilation, to look at a few things, gives us a glimpse, a deep glimpse, of what happens after we write some simple C#ARP code and our compiler does some work for the scene. And [clears throat] how are we doing with time? 36. Okay, now DNET STK what's happening? Most of you associate DNET with C#ARP. In my day, right, I started working professionally
in 2005, before that I studied programming, they failed me on the vb.net exam, I admit it, because it wasn't my fault, it was hers, right? Oh, and I thought I knew more than anything and so on. I did n't even deal with it at all, but I started the world of DNET with visualbasic.net.net And later over the years, and from 99% popularity C#ARP took over, they started
purely Microsoft, right, they introduced things into the language that they stole from Java, in order to be up to date. Ah, we don't know anything about F#ARP. Nobody knows anything about F#ARP. Yes. But the world of DNET is not just that, there are many languages that compile to DNET. So, right, this term is used. And they actually compile to IL. We'll see it on the diagram in
a moment. Kobo has, right, Visual Callol compiles to something that can be run in the DN runtime. PHP, right, who would have thought of such a thing. And when we compile, we compile something that's called MSIL 1 at the beginning. Microsoft Intermediary Language. CIL is the technical term used at the time they introduced it as a standard. We use the term colloquially. In most cases we will
use the term. That's how the documentation is, that's how it is in the application, because the C sign is getting in the way . And the I language is what runs in something we call the DNET runtime, right? Whether we call it CLR, Core CLR, or Environment Engine, I think a virtual machine is used in the world of Java and many other technologies. This term virtual machine,
that is, a layer between the machinery and something else, which interpreted and run on the hardware in question . In this layer, there may or may not be something called Justin Time Compatр, something that interprets this IL language and converts it into processor instructions in real time. Rit from You can is the new git compiler in the DNET core era. So on the side there is an
of time compilation that removes all the time, right, so we kind of skip it. We directly compile in quotes or rather we package from IL directly to something that is specific to a particular architecture, processor architecture. What Je does is detect what processor we are on, ask the operating system and for that particular processor it converts the IL operations to ones that are understood by the process.
And in the middle there's something called Ready to run technology, which is a mix between the two, a little bit native and a little bit managed code. And if you're wondering why all the speakers on the bottom left have empty boxes, I realized there would be a video stream with my face there and there was room to remove our stuff from the slide. That's why there's a
gap in the bottom left. Under this layer, the hardware already exists, right? In simple terms, what we're working with here is the processor, something that we send some kind of instructions to. These are our basic macro layers of technology. Of course, there is a lot of work involved in the runtime in question. And if you want to understand more about the whole thing, the only quality resource
is the Runtime book, because it's written by Runtime programmers at Microsoft for Runtime programmers at Microsoft, but it's an extremely useful and nice resource. I haven't read it, simply because I'm a person at the upper levels, we do things that deliver business value. I've read it from the things that interest me, and I watch them. Now how does our code work? I have a simple C#ARP function.
It takes two parameters, returns a value, and adds them. This is our C#ARP representation. A compiler takes this thing and creates IL. As a [clears throat] IL layer works with something called a virtual stack, memory stack, leo stack, lasting first out stack, that is, the most recent things are on top, typical stack operations push pop, etc. Accordingly, the C#P code converted to IL looks more or less
like this. this miracle is found in the DL folder, the DLL file, or rather, when we do DNET publish, in this case, and build, but we prepare it to publish, where it is called. in the case of Head of Time Compilat at close range this IL becomes more of a native representation. A is interpreted by the Justin Time compiler, if it exists in our stack, to the
so-called assembly mnemonics. And RCRX are registers, RETN is information. I do n't know them here anymore, they're not that relevant to me. Of course, I've been involved in tinkering at this level with various tools, but it's not my everyday life. Behind the scenes, we can already see the hx representation of Assembly Neemonics. That is, if we open a file with notepad or rather a text editor, Notepad
will show us the hx representation, while an xdir will show us these numbers. They are actually equivalent to the pneumonics of the assembly on the left. C3 for example is now a return sign and this is what happens. That is, when shipping, we usually package something that is IL, especially if it is not the head of the compilation. We're finally getting something that's native. During execution, the
operating system loads the method into memory, right, locks it, marks it as executable, and from there on, the processor reads these instructions and does its job. Magic. Now, in the case of the DNET libraries, this image is AI generated and is useless. I just didn't have time because I had to get here for Tony's lecture . And there are several key places in the world of DNET
that have rightfully stepped on the Windows Portable Executable PE File format. This is the format of the assembly and the ex when we compile for Windows, right? For Linux, things look different. I'm focusing a bit on Windows stuff. Accordingly, yes, there is a table with all the sections in this file. It is a simple file with a start point, an end point. This is a stream of
binary characters for some reason. There is a manifest, headers that describe what is happening inside a file. And more interesting is the managed code section, that is, in the case of DNET in a Pile format in the points section. We'll take a quick look at these things a little later. I won't go into detail because we still have six parts of theory. We are only for the
first one. And that's where the IL code in question is packaged . Metadata tables are an interesting thing during the design of the .net and C# languages. And the colleagues at Microsoft had many key goals. One of them is to have a very good development experience. In this and where it uses a lot of metadata tables plus reflection plus whatever else to help us have what we
have nowadays in at least Visual Studio, Visual Studio CD, right, the debugger there only does a crappy job. Well, I have many more theories in the second and third parts about the DOPN assembly in question, how it is packaged and why it is interesting. When we decompile, what are we actually doing? We take the IL in question and reconstruct the C#ARP code. So, we're going back from
right to left, right? If we decompile a DNET assembly, we end up with C#ARP or whatever DNET ex program we want can interpret it. It's called an ism. And this is the original dissembler, the term here from Microsoft, where from a library we can take the raw IL code, just as it is packaged. Of course it 's not binary. It is converted to notepad text format. Accordingly,
we can see what aa looks like and this is our intermediate language with which the aa run runtime works accordingly. The popular tool is IL spy. The point is it should be small, I'm confused. Here you can see that my slides are not generated by AI. And accordingly IL Spy is the tool that is still maintained to this day . I looked on GitHub and there's one
from two or three days ago so it 's up to date. And I'm going to use DNP today because it's much more targeted towards just biding my time. We are okay. Targeting recompilation and reuse and debugging. And everything from the first layer down, there are already a lot of tools there. Windbug is probably the oldest, most used by Microsoft, and it gives us something on a completely
different level. It gives us as close to the iron as possible everything that happens. GiDRA is a well-known National Security Agency, right, again a tool for Forensic Engineering, with a very large part of it covering Engineering, also on GitHub. I think it supports other IDA, Super PMI, many, many, many other tools that we can use for some kind of assembly opening, or viewing, or run-debug, processor blocking,
debugging hooking, anything that works properly during the operational operation of the machine. Now can we decompile code? It 's more like do we have the legal right to do it? I won't go into detail here. The MIT and GPL licenses have a clause that we can decompile it and that we have the freedom to do that. Commercial software that has a user license agreement. Usually it will
definitely say that you cannot decompile it. Oh, in Europe 2021, I don't know which European Court said that we have, after all, a won case, that we can do a reverse engineering when the vendor can't fix a problem. We paid for the software, it doesn't solve the problem, right? Accordingly, we can reverse engineer it, change it, and move forward, because we paid for this thing. This US
law is very interesting. It gives us three years to do public decompilation, three years not to do it, three years to do it, right? Now, from 2024 to 2027, such things can be done. Well, yeah, it's a strange thing. Now, there is no such word in Bulgarian for obscuration, but it is used, right? I have no idea how to say it in Bulgarian, because it's still wrong.
And there are all sorts of strategies that confuse the IL layer, generate all sorts of things inside, so that the interpreted or reversed C#ARP code looks like nothing. It looks like nothing when compiled anyway. So obfuscation aims to make slower, harder, right, because there's no protection. All we do is make cracking slower and more difficult. [clears throat] I won't go into these terms at length. And you
can look at them in more detail. In the third part of this series, we will look at them in a little more detail, although their benefit is close to zero. To protect ourselves, we have many options. I said a moment ago, defense only slows things down. When conducting a security audit or testing of a software product. And the company, when doing the testing, always says the same
thing. We have a limited amount of time. you paid for four days, while crackers have an infinite amount of time. Accordingly, this is their disclaimer that they will not be able to handle it on time. Ah, but really, if we can see what's in our memory, no matter how raw it is, we can still see it, right, and maybe change it. A server site, when you're not
sending the code to the user, is the only real way to protect, right, some kind of IP. That doesn't change that part. In the gaming industry , blackmail is considered to have the most consequences in terms of the financial aspect. That is, there is the most cracking in software, of course, but I don't seem to have statistics, but from the research I have, the gaming industry loses
the most money from decompilation and similar things. Do we have any questions so far? Let me just say that we don't have time for questions. Accordingly, if you want to ask something, right, now is the time, I don't mind. You have to shout louder so I can hear you. Oh, let me just change this to something not so dark so I don't confuse you. Tell me if
this is better. Now these new jeans, jam and so on, right, juicy plum. yes, I apologize. Where the hell is the blue one? You can see what they are like. Isn't Light all white? Well, I'm going to burn your retinas here, aren't I? Well, yes. I'm looking for that blue, cool one. Okay. Culbrees. Now I'm lost here. And I make another amateur mistake. I 'm basically an
experienced lecturer, but how can I make such amateur mistakes? It's that I didn't turn on the zoom, right, for people like Kulv, who can't see. He's not here to talk to us through the stage. That's right. Yes, it's visible. Okay. I will be able to show you the world. That's right. And now I [clears throat] will use DN SP, that's why I was looking for the blue
effect, but now at least you can distinguish it, right, from Visual Studio. And DNSP is one of the tools with which we can look at what is happening in a specific library. I have one solution, of course, OneBIT Soft, of course, Quantum DMS. Before this lecture, I asked two or three things. One was whether all the vendors of some software would let me crack and modify their
applications live, to bypass the licensing. Nobody said yes. Accordingly, I grabbed our product, which does not have such a licensing model. Oh sure, I used our AI agent Oraclon to write a specification for a licensing model. The second question I asked the public social audience is what you want to see from one-on-one engineering sessions. Everyone said I want to see you crack the software on the net,
right? Okay. Accordingly, I made a specification generated by AI. And the oracle wrote to us like this, that's the name of our AI gene. It's not too bad, it's not good at all. That is, somewhere in the middle zone. And there are far more mature things we can do to protect a product. Of course, each level up takes time, money, and is a headache. There is a
triangle of ability, security features, right? We can never profit from all three things nowadays. Only Apple manages to somehow push them out. And there's not much point in looking at the licensing component. There is encryption, hashing, reading the CPU ID on the disk, generating a license file, and so on. Accordingly, one of the things I did because I know something about these things, I included the license
code in the application environment, the Core library, business and so on. Your license code should never be a third party product. There are a lot of those on the market, right? And, because if they compromise the product, right, it will immediately compromise everything else that should be in the core of your code, where there is the most change, so it doesn't make sense to crack one thing,
because the next day, with the world we live in, right, and the audience will be out of date. We are fine with the weather. And by the way, a question about the audience. What I said, let's make an external library that allows us to protect our code. Can you think of the biggest practical blunder in our industry? Who is pulling from Zamunda? Games everyone. Yes. Okay. The
biggest blunder in terms of value, fiscal value, is Steam's steamapi.dl, right? And it's DL like, which once when all the games were compromised, suddenly I was compromised and for 10 years aa zanda crackers, right, just give away the Steam API library and if you see their installers, they just replace the Steam API library, then the whole thing. Never should a licensing component or a software protection component
or anything else come out of the heart of the software, because you'll just compromise it and from then on, your product updates will have almost no relevance or meaning. Now the AI here generates interesting classes, licensing context, right? And what kind of person organizes their files like that, right? This is 100% AI generated. Yes. There's a colleague of mine, I won't mention his name, so he doesn't
get offended, right, who says, "I can't tell the difference between AI- generated code and human-written code." How was it, man? It just creates and I did n't tell it to generate code that looks like it was written by a human, right, but it generates some things. I watched him do a few key actions. For starters, there is no validate licence method that returns a simple boolean. Yes,
you are not valid, I can show you the entire functionality of whether you are valid or not, because with this thing you can simply turn around with just one button and recover. Ah, in this case, there is a taming of pure Bulgarian at the library. Here he put some keys, private keys, I generated some certificates, I put my name for the key, because he put something meaningful
for me, because I can have some license guard here, which I've run, right, to see what it does, because it wasn't working, [laughter] I had to fix it. Oh, and this thing has a few interesting principles, if you noticed them a moment ago. This file, besides being a record, is trying to make the reversing, right, more blind. It also has a static constructor somewhere. Accordingly, it loads
almost when the library loads. There's some kind of rapper here who works some kind of magic. Now where are my questions? And what is the shortcut for the breakpoint window? Okay, no one knows. I don't feel stupid. Yes. Now that I've released this message, let me just tell you what it does. I tried to make the licensing component a little more advanced here. I have a UI
Blazer so I can fit in with the youth. Yes. Oh yes, yes, yes. I saw him downstairs. Now I put a console read Readline here to show you Tch on The Buger in a moment. We're in Visual Studio right now, so it's not that relevant. Where are my breakpoints? I want to tell him to remove all. Here's remove all, right ? And now this tool, it does
OCR. This is our test bench for OCR. We upload a picture of some document to it. We have our own language model, preprocessing the image to distort the leaf when making one, right? And this component lives in Quantum DMS and, in addition to giving us OCR to PDF, it also converts PDF to Searchable PDF. That is, this is a scanned sheet of paper, it is visible from
the annotations. Accordingly, I can select this text, which I cannot do in a PDF . However, here they tell me that I've lost my license, that my code returns it to the first 100 characters, right, it doesn't give me the full experience on top of that . It tells me that they are not licensed. Accordingly, I asked AI to make a page where we could simply see
the licensing information, because that's what we 'll be dealing with. Yes. And the licensed object is not licensed or not, it's a complex object to make decompilation complicated, right, to slow us down. We are missing a license file. It 's not in the right place. If I copy this f extension.rdi, this thing will suddenly bloom. That's right. And that's it for now with Visual Studio and the
thing in question. Now, we compiled it in this folder, additionally, of course, I asked AI to make me a script that does the animation. In this case, the obfuscator is Opus Car, a terminal, of course. I asked Oracle, our agent, again, to please make me a specification for OPFCAR. Make me an XML file that defines what to scan. I told him everything related to licenses to distract
him. So, right, he made his own specification. We are moving into a time where code no longer matters. So this lecture might be the last year it will be relevant. Then the specifications are just spec driven development. It doesn't matter what the code is, as long as it satisfies the specification. Oh, yes. And here it has unfolded, right, the model we described is Quen 3,5 or 6,
such a local one. I did n't watch that anymore. And accordingly in the license folder we have aa where are you, where are you, where are you, where are you? In the script folder, we might have the XML definition of our obfuscator, which tells us what to obfuscate, what not to obfuscate, what to pay special attention to. And as part of this build script, I won't show
it. Powershell generates, right? Who writes their scripts so beautifully? And accordingly, we publish without a head of time compilation. And let's face it, he did it relatively quickly . We replace the obscured library with the original library and start a web server so that we can now see this thing. Accordingly, I will now play with this library. She is the interesting one for me. I'm stopping this
because it's getting in the way. so. Antum point. Here it is. The first thing. I copy it so I have an original in case I make a mistake or it becomes invalid due to tampering. Yes. That's right. Now ah here is DNP. Beauty. I'm bringing my library. Now, the moment I bring it, the library in question opens. The first part is the P ihera in question. And
if I do Oops, bomb. Oh, was it four? Yes. What I can click. Yes, respectively. And yes, that's it, but HDMI doesn't work here. That is, Ctrl F1 should not be Ctrl 4. Amateur mistake. Okay, I can't because it turns off the HDMI in question. Now our header is a mess. If we want to see it with a hex editor, we will be able to see it
here first, but this application cannot run in OS mode. It probably doesn't remember what DOS mode is. So we're going back to the days of THC. This is simply because the PE format relies on the Windows P format. The MZs are the initials of the person, the programmer who wrote it, put his name inside, right, if you come up with something. Accordingly, here you can very easily
view the parts of this file in question . And of course, here you can click on them and so on to do some kind of inspection. Type references, a very important part. That is, everything that is a class, a type, is described. That's part of the methods, right? This is part of the amed data table part in the file in question. We have a register that is,
right, it's virtual, where this method is located throughout our file. Accordingly, this meta-information is the part, the large part, in which the compilation in question works, the references to the libraries, so that we can see what else is referenced. Aa and a are different parts of the module initializer, that is, an assembly module class, maybe an ace class. In the world of Visual Basic, the module was
written in C#. ARP has always been removed, or at least that's what people think, but we may decide to write a module and define what is called inside. For a long time, C#ARP did not have the ability to create module initializers. This is code that is run when the module loads, before we have a starting point. And if you just think about what I said, C#ARP doesn't
have the functionality that DNET has, right? Completely valid. C#ARP doesn't cover everything from DNET, but nowadays it's the driving factor. Accordingly, one of the protection mechanisms, why I'm telling you this, is that the ezizer module is sometimes a place where code is inserted that, for example, checks the consistency of the code. For example, have all these methods below been changed and does some kind of hash match?
And what was the name of this Blizzard card game ? Heart of Hearthstone, yes, it uses something like that, right, it's even encrypted and stuff like that . I've watched it for sports. It is one of the more serious DNET-based games that are being made, and it is a very common practice, right? Accordingly, if you see huge before you've even taken a breath, it's more or less
happening there. private implementation details. This is the Roslin compiler part. Here you will see, at least in this build, a lot of things that are converted from strings to binary things. And accordingly, most strings will be and will be located here in our solution. Now here is our namespace with that. Here we can already see the classes that are in the project folder. They don't have a
DT namespace. Of course, we can click on any one of them and what we'll see is [clears throat] a reversed code from to C#ARP. Some things don't have variables and so on. Accordingly, right, compilers are compiler generated. I apologize, I accidentally clicked stream here. And this code is being kept now, in this case it has really gone through a lot of trouble. All of these things, in
most cases, maybe the opus maker made them ugly. These are the names of variable classes that the obfuscator is trying to confuse me with. These are Unicode characters and those that are not visible in most cases or four tabs with one character or invisible space, invisible newline, these are characters in this class, because here it uses some things that have gone through obsolescence of strings, that's why
they look like that. In most cases, it doesn't seem like much, right, average work. And now what gives us the opportunity? Oh, right, DNET spid, let's do the right button here, I'm sorry I can't. It says edit [ __ ] method here, right? Add class to Add meme to class. Add a class with merch slay. Thank you. Merge two libraries into one. Edit the language, okay, whatever
it was. Now it gives us the opportunity to edit it in C#ARP. Now this is a strange thing that works in most cases. If you watch YouTube videos about DNET's RSE engineers, they'll get to this point, right? They tell you that you can do this thing here with pure C#ARP code, return true, right, validate, license. Everything exactly. We now have a red problem here. This means a
compilation error. In a very simple assembly, the older dnetf stands in most cases, because now a different compiler gives us this headache. Just by changing this C#arp code. With C# Sharp code, I can press the compile button and it will go through the compiler because this library is obfuscated and the reason I didn't show it to you is because it would compile in the simplest way. Here,
the obuskator is interfering with us, what is this, what is this dot for a penny, right, on the fifth line in so-and-so, who are you, I don't have main CS and so on. That is, the possibility of not compiling the modified library at this stage is prevented from me by, in this case, the opus. Now if we change this to IL, that 's not hardcore either, right?
Call this class, call that class, it doesn't matter. These are three lines. Load constant for the sake of a constant. of size 4-bit integer with value one. One is true hop clack clack and this method will suddenly turn into return true. There is no compilation here anymore, it already is, that is, my instructions look like this. What I can do is save the library, it's already tamer,
meaning it doesn't respond to xhai, right? Hsh extractor, I think it's trendy on the news. It won't fit here. That is, this is already a modified library. In the case of my application Blazer Web is a server and so on, nobody cares about this stuff, right, because there's no logic to validate these things. In the case of Global Assembly Cash, yes, there is a bit of logic
there that prevents that. In the case of Java, we can similarly tell DNET and the Windows server not to throw errors when our library does not match our code and just let everything work. And I'll leave that aside, we're not that interested. We return to the license folders. In this case, my nessace is not modified. The classes also decided not to let the AI completely confuse us.
Accordingly, the public properties, right, I want to see the status of the license component from an external library. We need to make some sense. At the moment when we have faked coolies like these, whatever happens in them, I'll just give the whole class. Whatever happens inside them, we lose the stack trace or we don't lose it, it just looks this weird , right? There is a mapping
in the obuscator's folder that tells us exactly what this sign is facing, if we need to look at such a stack race. Now, here we immediately see things that are very obvious, exceptions, license exceptions, without even knowing what this guy did. I can think of a situation where if someone throws a License Tumer exception, then they won't let me use the code and I'll show, right, something
like that. One of DNSpy's cool features is the analysis functionality. I can see which classes are using the loaded libraries on the left, and either initialize using this class and this method. Well, here we have some kind of a thrown-away thing. If we want to stop throwing a License Tamper Exception in the case of a lack of , you're looking at me wrong . And this is
a good way to do this. Now, even without really understanding this, there is some kind of initialization in the license code. Here you can see the static constructor that we talked about. And I can directly change these things with, that is, is the numerator valid or not? And accordingly, I can change this to, for example, this file missing status at the IL level. I don't have time
to do more complicated things here. I can delete them, I can change them, I can write instructions, right? Put in some instruction or several, change them to something and act in that way. Accordingly, from here, if I change things, the action after that, just a moment, let's see where we are . Let him [clears his throat] do it again. I'll just clean it up so it doesn't
get in the way. Oops, it says I didn't save my file, right? Okay. Let me find it. But come on stabbed. No, let's get it right now . I just want to clean up the item in question . Now this is the library that the application is currently working with. From here, I'm just going to go change something and save it just to show you that I'm
running out of time. Oh, right Where are you? I was worried. Yes, right now, apparently my source code is already cracked. That is, I didn't do anything. And somehow things went well. I can change that for you. For example, it would be a bit more interesting. Ah, here I want to change the possible characters that OCR gives me. I will change them a lot. I'm also giving
it red because this is S. So here again the AI is trying to make it harder for me. Ah, I want an integer that you don't eat. So this is it, right? It returns the value to me, but because I can't write such a large number in short. That's right. This is a modified library. Now, I'm going to save the module directly, I'm going to name it
crack. Now I did something relatively easy. It is saved in some cases. It may not save here, but during the save we can specify this bit, to keep the size of the old state. This usually means that if we remove code, the order of things gets messed up. Now I have to stop this here, because if I release the build, it will replace the thing in question
. I'm looking here in some build folder. Now let me release this thing. That's right. That's right. And this is sleep. We'll let that go. We're entering port 5000, and I'm sure I've made a mistake somewhere in all this. Maybe not for A, yes, of course. Why don't you follow up and tell me where I have a problem? This is the library from just now. You can
see that it's 57. So, I've already replaced the real library with the fake library and here the work will change to these characters, right? Now I made a mistake here, in fact my library in the source code was somewhat messed up with the default values, but in the end I changed it and we loaded it without any problems. So this is how it worked out . I
don't have much time. I hope you like it. Officiation costs nothing. We can debug it. Dnet spy also supports a debugger, meaning we can attach to a process and debug without having source code. nice links, you can take a picture of the formatting or I'll give it to you. Quantum DMS Oraclon and that's me. Thank you very much.
