Reverse Engineering Thread March 2012 - Developers

[QUOTE=OldFusion;34971904][url]http://www.rohitab.com/apimonitor[/url] [editline]3rd March 2012[/editline] Maybe we should make some reverse engineering Challenges, they would be pretty easy to make and fun to do.[/QUOTE] I'm down. Somebody cook something up

Is Virtualization 100% secure? as long as you have it configured properly

[QUOTE=Phreebird;34973477]I'm down. Somebody cook something up[/QUOTE] There was one a while back, I won about $5 from pointing out as it was, it was unsolvable (they threw away too much of the original data while encoding), I didn't win the redone version though.

[QUOTE=Phreebird;34973477]I'm down. Somebody cook something up[/QUOTE] I have an idea. I'll make the challenge unless anyone else [i]really[/i] wants to. [editline]3rd March 2012[/editline] [url]http://www.facepunch.com/threads/1167905[/url] Challenge created.

Does anyone know how to make your VM installs NOT eat at Micro$ofts activation limits?

[QUOTE=Se1f_Distruct;34988242]Micro$ofts[/QUOTE] So funny.

There isn't even an activation limit anyway, as far as I know. After a while they force you to activate by phone though, I think.

Whos in for a little self-made protector unpacking/cracking contest?

[QUOTE=Zeh Matt;34990584]Whos in for a little self-made protector unpacking/cracking contest?[/QUOTE] [url]http://www.facepunch.com/threads/1167605?p=34977318&viewfull=1#post34977318[/url]

Some stuff about reverse engineering network protocols should in the OP. Wireshark - [url]http://www.wireshark.org/[/url] Charles (If it's an HTTP/HTTPS API/whatever) - [url]http://www.charlesproxy.com/[/url]

[URL="http://www.ntcore.com/exsuite.php"]CFF Explorer[/URL] can edit PE and .NET headers, disassemble x86 (16bit), x86, x64 and MSIL, realign files, edit signatures and debug info, find dependencies, edit resources and imports and also is a hex editor. I used it to make an ILSpy32.exe that can debug 32bit-only assemblies on a 64bit system. [editline]6th March 2012[/editline] It's also freeware and can add itself as shell extension for .exe and .dll. [editline]6th March 2012[/editline] IDA (the free version) only works properly if you run it as admin at least once.

SO USEFUL!

[QUOTE=Soda;34970857]except searching for anything being far far slower. patching being more labor intensive. both are completely situational, and what you use depends on what you want to do.[/QUOTE] get a better computer noob

I have an antivirus impostor in the form of an exe if anybody wants to take a look at it. Also, will I get banned for linking to a virus download even if I warn first?

If you're interested in reverse engineering software as a hobby try this website: [url]http://crackmes.de/[/url] It's safe, think of it like the projecteuler of software reverse engineering. You basically download other peoples programs (full source code included) and each one has a level of difficulty, your task the majority of the time is to basically crack the software, and then patch it; however some of the harder/more complex ones require more work. There's a range of different languages used and various security techniques put in place. If you're up to it you can also post your own software for others to crack, and like project euler you can also download the solutions of problems by other people.

I tried. Is this just the email and password encrypted? Using bintext. [img]http://filesmelt.com/dl/fa.PNG[/img]

[QUOTE=TamTamJam;35114830]I tried. Is this just the email and password encrypted? Using bintext. [img]http://filesmelt.com/dl/fa.PNG[/img][/QUOTE] Tried reflector to see if it is .net? if so becomes a lot easier

[QUOTE=nekosune;35115597]Tried reflector to see if it is .net? if so becomes a lot easier[/QUOTE] Yeah it runs in reflector, I don't really know what to do now. I've searched for emails/passwords.

[QUOTE=TamTamJam;35115804]Yeah it runs in reflector, I don't really know what to do now. I've searched for emails/passwords.[/QUOTE] in reflector set the language to visual basic then just follow what the code does, especially look for the class NetworkCredentials being used.

[QUOTE=nekosune;35116141]in reflector set the language to visual basic[/QUOTE] Why not C#?

[QUOTE=Gran PC;35120655]Why not C#?[/QUOTE] The original language for most of theese uses VB, meaning it has that My. junk and other vb specific stuff , which looks a lot better when reflected back to VB rather then C# as in C# you get some weird syntax to do such.

It's still easier to read in C#

[QUOTE=nekosune;35120699]The original language for most of theese uses VB, meaning it has that My. junk and other vb specific stuff , which looks a lot better when reflected back to VB rather then C# as in C# you get some weird syntax to do such.[/QUOTE] Doesn't My just translate to this in C# though?

[QUOTE=Map in a box;35126360]It's still easier to read in C#[/QUOTE] Fair enough, I allways found it easier to read in original language myself, but I suppose thats just because I know both VB and C# [editline]13th March 2012[/editline] [QUOTE=sambooo;35127280]Doesn't My just translate to this in C# though?[/QUOTE] Not exactly

Me translates to this. "My" is just a kiddy wrapper around .NET's namespaces and classes. My.Computer.FileSystem => IO.File. Bet you a candy bar the compiler outputs the the same intermediate language in both cases.

Does anyone know how to unpack WinLicense?

[QUOTE=Kirth;35162661]Me translates to this. "My" is just a kiddy wrapper around .NET's namespaces and classes. My.Computer.FileSystem => IO.File. Bet you a candy bar the compiler outputs the the same intermediate language in both cases.[/QUOTE] It seems to output a My class into each executable. ie each and every exe you make with vb has this extra class added.

Messing around with a runescape one. This guy was semi intelligent about it. He has two emails, one he uses to send and the other he gets the user name and passwords in. I got into the sending account and changed everything, but I can't get into the receiving one. I couldn't guess where his mother was born.. Edit: Right, I checked the "Sent mail" and got a bunch of emails. Sent off a batch email warning everyone about it. It shocks me these people can fall for this.

How do you remove .net reactor? V4 is a PAIN!

[QUOTE=Dotmister;34997078]Some stuff about reverse engineering network protocols should in the OP. Wireshark - [url]http://www.wireshark.org/[/url] Charles (If it's an HTTP/HTTPS API/whatever) - [url]http://www.charlesproxy.com/[/url][/QUOTE] Use [url]http://www.fiddler2.com/fiddler2/[/url] instead if you're using Windows. It's free, and can do most of the things Charles can do.