\n
![\"reflector\"](\"http:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2013\/02\/reflector.png\")
<\/a><\/p>\nThe 2 best plugins are Reflexil (http:\/\/reflexil.net\/), used for editing the IL code and Deblector (http:\/\/deblector.codeplex.com\/) which is an excellent .net debugger. <\/p>\n
Tool number 2 is DILE (http:\/\/sourceforge.net\/projects\/dile\/) Lastly the hardest method of the 3, is more than 1 tool. ilasm for assembling, ildisasm disassembling, and MDbg for debugging of .net assemblies. http:\/\/msdn.microsoft.com\/en-us\/library\/ms229861.aspx ilasm and mdbg are both CLI tools, but ildisasm isn’t. All 3 come with visual studio. I say its the hardest because of what’s involved. ===On with the show=== Loading up the licensing application with our .net decompiler, we see the application is just a stand alone app that feeds from external managed assemblies. The managed assembly in question is the SolarWinds.Licensing.Framework.dll. Loading that up, we see many methods, classes and function calls. As you can see, the function is what we’re looking for. We see what types the method takes: We know what we need to patch to make every license we pass valid. <\/p>\n Now, how do we do it? <\/p>\n ===The easy way=== Here, we load up the plugin and see the MSIL instructions in the bottom window. We right click and choose ‘replace all with code’. The mini .net compiler window pops up. Next we re-code the function to our liking. In this case, I am making the code always return true. We then hit the ‘compile’ button and our instructions window on the top right shows our new MSIL instructions. After pressing ‘ok’, the new instructions we compiled will be present in the lower right pane. All that’s left now is to save our changes. And that’s it. Easy as pie.<\/p>\n When we re-disassemble our managed assembly, the function now shows the code we patched seen here with ilspy: ===The hard way===<\/p>\n Sometimes you may night have the hundred bucks to shell out on Red Gate’s Reflector. You’re a hobbyist with not too much cash, but an interest to learn. There is hope though, provided you’re willing to re-code some stuff. DILE off of source forge offers a similiar experience for free. Problem is, the THING DONT WORK. At ALL. Maybe its because I’m running 64 bit windows and the version I have is inferior? Or maybe the project was abandoned in 2011. Either way, its fail. ===The harder way===<\/p>\n There is nothing wrong with this method. It does work. There are more steps, but at least its free. The tools come included with Visual Studio Express. <\/p>\n A brief run down: First we disassemble the binary \/ assembly to a .il file, then edit the code, save the file, then re-compile with ilasm, assuming you got the MSIL syntax correct (which isnt exactly easy to find reference wise). If you team this with something like ilspy, it will save a bunch of work of tracking down the method \/ class names.<\/p>\n We use the ildisassembler tool for this: Now we open the .il file (msil code) in notepad and look for the function we want. All we have to do now is replace the MSIL code with our other code that makes the code return true.<\/p>\n .method public hidebysig newslot virtual final Look familiar? ldc.i4.1, then ret? Yeah, same as our reflexil code. If you need to reference other code, I suggest reading up on MSIL syntax<\/a>. Another convenient method is to code something up in visual studio, then decompile it with the ildisasm tool and copy + paste. It works.<\/p>\n Now we need only re-assemble our code. Run the ilasm command against the saved .il file (you saved it right?) along with the proper command line arguments such as \/dll for managed assemblies.
\nI’m all for open source, however not when nothing works. Maybe its because I’m using the 64 bit version? Dile also supports a debugger, though once again, I never got it working.
\n<\/a><\/p>\n
\n<\/a><\/p>\n
\nToday we’re attacking Dameware’s Remote support, a suite of tools that allows remote administration of windows systems. I was checking this tool out the other day for its remote task manager capabilities and ease of use.<\/a>
\nThe binary is nothing special. In fact, the app isnt even made in .net at all. its a C++ application. The licensing application on the other hand is. <\/a><\/p>\n<\/a><\/p>\n
\nI’ve saved you from some digging and isolated the internal class ‘LicenseValidator’ and its method ‘IsLicenseValid’.
\n<\/a><\/p>\n
\nbyte[] licenseData, byte[] signature, byte[] nodeLockInfo, byte[] serialNumber, LicenseType type, byte licenseInterfaceRevision
\nWe see the return value – true or false.<\/p>\n
\nThe easiest way is with Red Gate’s .net reflector and its sister plugin reflexil.<\/p>\n
\n<\/a><\/p>\n
\n<\/a><\/p>\n
\n———
\nldci4.1
\nret
\n———
\nldc.i4.X\u2014loads a 32-bit constant (X from 0 to 8) onto the stack
\nret – return.
\nThis makes sense right? Load the value ‘4’ onto the stack and return. Unlike traditional assembly where one would assume to ‘push 1’ for the value of true, we are pushing 4. Why? I don’t know, .net is weird like that \ud83d\ude00<\/p>\n
\nThis is done by right clicking the assembly on the left, choosing the reflexil plugin, then choosing ‘save as’ which brings up a save window.
\n<\/a><\/p>\n<\/a><\/p>\n
\n<\/a>
\nI want to believe it works, but signs point to doubt on this one. <\/p>\n
\n<\/a>
\nClick file, then dump, then select a directory to place the disassebmled code in.<\/p>\n
\nWe already know we’re searching for the class LicenseValidator, and its method IsLicenseValid.
\n<\/a><\/p>\n
\ninstance bool IsLicenseValid(uint8[] licenseData, uint8[] signature, uint8[] nodeLockInfo, uint8[] serialNumber, valuetype SolarWinds.Licensing.Framework.LicenseType ‘type’, uint8 licenseInterfaceRevision) cil managed
\n {
\n \/\/ Code size 2 (0x2)
\n .maxstack 8
\n IL_0000: ldc.i4.1
\n IL_0001: ret
\n } \/\/ end of method LicenseValidator::IsLicenseValid<\/p>\n
\n<\/a><\/p>\n
\n<\/a>
\nAssuming all goes well and you didn’t make any syntax errors, you’re all done. The managed assembly or exe will be assembled in the same directory as the .il file. <\/p>\n