Exetools - SMD For Agile

Page 1 of 3

Show 40 post(s) from this thread on one page

Exetools (https://forum.exetools.com/index.php)

- Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)

- - SMD For Agile (https://forum.exetools.com/showthread.php?t=19219)

CodeCracker

05-20-2019 01:23

SMD For Agile

1 Attachment(s)

SimpleMSILDecryptorForAgile:
this tool decrypts methods of last version of Agile;
inspirited by duyan13 https://board.b-at-s.info/index.php?showtopic=9313

Two Frameworks are supported: Framework 2.0 and Framework 4.0;
Framework 4+ (latter Frameworks like 4.6.1 etc.) should be supported
by Framework 4.0:
Place Simple_MSIL_Decryptor.exe.config, SJITHook.dll and Simple_MSIL_Decryptor.exe
in the target program directory; start Simple_MSIL_Decryptor.exe
from NetBox 4.0 and try to decrypt target assembly;
if reports missing assemblies you should place them in the target
directory for being able to decrypt MSIL of those methods;
in the end undecrypted count should be 0.

Next step: unvirtualize Agile with de4dot:
This may not work for some targets!
After we decrypt MSIL we deobfuscate methods with de4dot v3.1.41592,
we just set decrypts methods to false so de4dot won't decrypt methods
by adding to de4dot.exe the parameter:
--an-methods false

in command line do:
de4dot.exe filename.exe --an-methods false

sendersu

05-20-2019 02:02

Thanks for interesting tool

why it says on startup this?

---------------------------
Warning
---------------------------
GAC installation failed!

---------------------------
OK
---------------------------

CodeCracker

05-20-2019 02:23

It will try to install the assembly on GAC (Global Assembly Cache):
https://en.wikipedia.org/wiki/Global_Assembly_Cache

On Windows 7 or latter system will fail!

So what you should do?
You should Simple_MSIL_Decryptor.exe.config, SJITHook.dll and Simple_MSIL_Decryptor.exe to the target program directory;
and ignore that warning!

During Appdomain creating the program (Simple_MSIL_Decryptor.exe) try to loads itself;
which fails it won't find proper file (Simple_MSIL_Decryptor.exe) in GAC or in current directory!

http://www.adamtuliper.com/2009/12/adding-permissions-to-add-items-to-gac.html

congviet

05-22-2019 22:59

1 Attachment(s)

I can't derypte this dll file. Please try it.

CodeCracker

05-23-2019 15:32

Missing dlls:
AgileDotNetRT64.dll
RevitAPI, Version=17.0.0.0, Culture=neutral, PublicKeyToken=null
RevitAPIUI, Version=17.0.0.0, Culture=neutral, PublicKeyToken=null
0 undecrypted methods!
File saved!

So RevitAPI and RevitAPIUI must be placed in the program directory else some methods like: public Result Execute(ExternalCommandData commandData, ref string message, ElementSet elements);
Declaring Type: ohM=.oRM=
Assembly: DecryptMe, Version=1.0.0.0

If you have RevitAPI and RevitAPIUI please share them!

congviet

05-23-2019 17:37

Quote:

Originally Posted by CodeCracker (Post 117096)

RevitAPI.dll:

Quote:

hxxps://mega.nz/#!y0dhHS4Y!-yNA32WsiqP133q8T3YVsOGezEjFMpe4yA5AxK9hSew

RevitAPIUI.dll:

Quote:

hxxps://mega.nz/#!utMh2IxL!7L5CnlWLMTEYONXyPhuzc-VxmGKll_suNi6NOtXnazo

CodeCracker

05-24-2019 03:31

Sorry but still can't do it: they are lots of missing referenced assemblies!
Those are part of Revit API 2017 x64 right?
Is there any Revit API 2017 x32?

congviet

05-24-2019 09:03

Autodesk has only x64 version.
You can try the setup:

Quote:

hxxps://drive.google.com/file/d/1j3TDjleNHQ8cMUKaEK0eRuxcpAv782r2/view

Quote:

Part 1: hxxp://trial2.autodesk.com/NET17SWDLD/2017/RVT/DLM/Autodesk_Revit_2017_English_Win_64bit_dlm_001_002.sfx.exe
Part 2: hxxp://trial2.autodesk.com/NET17SWDLD/2017/RVT/DLM/Autodesk_Revit_2017_English_Win_64bit_dlm_002_002.sfx.exe

CodeCracker

05-27-2019 17:03

The unpacked file (msil decryted)

The unpacked file (msil decryted):
https://www80.zippyshare.com/v/Zp0cgvVz/file.html
As for what I did: I created my own dlls RevitAPI.exe and RevitAPIUI.exe
with only their constructions (classes/methods) for being able to unpack MSIL;
let me know if the unpacked exe is ok; you got to also nop Agile constructors!

CodeCracker

05-27-2019 20:34

To decrypt strings runs the fallowing command:
de4dot filename --an-methods false --strtyp delegate --strtok 06000006

06000006 is the method which decrypt strings in this case.

@congviet: Let me know if there is any undecrypted method or other problem!

congviet

05-28-2019 10:56

Quote:

Originally Posted by CodeCracker (Post 117148)

1.Can you share two dlls with only classes & methods?
2. This source code:

Code:

using System;



using System.Collections.Generic;



using System.Linq;



using System.Text;



using System.Threading.Tasks;



using Autodesk.Revit.ApplicationServices;



using Autodesk.Revit.Attributes;



using Autodesk.Revit.DB;



using Autodesk.Revit.UI;



using Autodesk.Revit.UI.Selection;



namespace DecryptMe

{

    [Transaction(TransactionMode.Manual)]



    [Regeneration(RegenerationOption.Manual)]



    public class Class1 : IExternalCommand



    {



        public Result Execute(ExternalCommandData commandData, ref string message, ElementSet elements)



        {



            //Get application and documnet objects



            UIApplication uiapp = commandData.Application;



            Document doc = uiapp.ActiveUIDocument.Document;



            //Define a reference Object to accept the pick result



            Reference pickedref = null;



            //Pick a group



            Selection sel = uiapp.ActiveUIDocument.Selection;



            pickedref = sel.PickObject(ObjectType.Element, "Please select a group");



            Element elem = doc.GetElement(pickedref);



            Group group = elem as Group;



            //Pick point



            XYZ point = sel.PickPoint("Please pick a point to place group");



            //Place the group



            Transaction trans = new Transaction(doc);



            trans.Start("Lab");



            doc.Create.PlaceGroup(point, group.GroupType);



            trans.Commit();



            return Result.Succeeded;



        }



    }

}

This Decrypted code:

Code:

using System;

using Autodesk.Revit.Attributes;

using Autodesk.Revit.DB;

using Autodesk.Revit.UI;

using Autodesk.Revit.UI.Selection;



namespace ns0

{

        [Regeneration(0)]

        [Transaction(1)]

        public class GClass0 : IExternalCommand

        {

                public Result Execute(ExternalCommandData commandData, ref string message, ElementSet elements)

                {

                        Transaction transaction;

                        for (;;)

                        {

                                int num = 睷.睷_0(-3);

                                for (;;)

                                {

                                        switch (num)

                                        {

                                        case 0:

                                        {

                                                UIApplication uiapplication;

                                                Selection selection = uiapplication.ActiveUIDocument.Selection;

                                                Reference reference_ = 睸.睸_0(selection, 1, "Please select a group");

                                                Document document;

                                                Element element = 睹.睹_0(document, reference_);

                                                Group object_ = element as Group;

                                                num = 睷.睷_0(-2);

                                                continue;

                                        }

                                        case 1:

                                                goto IL_10D;

                                        case 2:

                                        {

                                                Selection selection;

                                                XYZ xyz_ = selection.PickPoint("Please pick a point to place group");

                                                Document document;

                                                transaction = new Transaction(document);

                                                睺.睺_0(transaction, "Lab");

                                                Group object_;

                                                睽.睽_0(睻.睻_0(document), xyz_, 睼.睼_0(object_));

                                                num = 睷.睷_0(-1);

                                                continue;

                                        }

                                        case 3:

                                        {

                                                UIApplication uiapplication = 睾.睾_0(commandData);

                                                Document document = 瞀.瞀_0(睿.睿_0(uiapplication));

                                                num = 睷.睷_0(0);

                                                continue;

                                        }

                                        }

                                        break;

                                }

                        }

                        IL_10D:

                        transaction.Commit();

                        return 0;

                }



                // Note: this type is marked as 'beforefieldinit'.

                static GClass0()

                {

                        <AgileDotNetRT>.Initialize();

                        <AgileDotNetRT>.PostInitialize();

                }

        }

}

How can i restore above the delegate methods to original methods? (chinese string)
Thank you very much.

CodeCracker

05-28-2019 16:05

Here are the two dlls

Here are the two dlls:
https://www67.zippyshare.com/v/3MW9QG87/file.html

As for the Chinese characters those are some fields - delegates type!
I rather not rename at all: the dll may not work after renaming!

congviet

05-30-2019 16:00

I tried the file at

Quote:

https://forum.exetools.com/showthread.php?t=19019

but there are still many methods that cannot be decrypted.

Quote:

Exceptions while decrypting these methods:
06000008: Index was outside the bounds of the array.
06000009: Index was outside the bounds of the array.
0600001C: Index was outside the bounds of the array.
0600001F: Index was outside the bounds of the array.
06000022: Index was outside the bounds of the array.
06000026: Index was outside the bounds of the array.
06000029: Index was outside the bounds of the array.
0600002C: Index was outside the bounds of the array.
0600002F: Index was outside the bounds of the array.
06000032: Index was outside the bounds of the array.
....
060005B6: Could not execute the method because either the method itself or the containing type is not fully instantiated.
060005B7: Could not execute the method because either the method itself or the containing type is not fully instantiated.
060005B8: Could not execute the method because either the method itself or the containing type is not fully instantiated.
....
0600186C: Index was outside the bounds of the array.
06001871: Index was outside the bounds of the array.
06001883: Index was outside the bounds of the array.
1863 undecrypted methods!
File saved!

this is my dll files with class/methods

Quote:

hxxps://mega.nz/#F!mhszCSqQ!HchMlmuJ2xfrvbDVs8HSvA

How can i fix above errors? Thanks

CodeCracker

06-14-2019 01:43

SMD for Agile with any CPU

@congviet:
Sorry for late reply. Compiled SMD for Agile with any CPU.
Should load referenced (x64) assemblies just fine, of course they should be present in the target's program directory.

congviet

06-14-2019 16:28

1 Attachment(s)

Quote:

Originally Posted by CodeCracker (Post 117258)

@congviet:
Sorry for late reply. Compiled SMD for Agile with any CPU.
Should load referenced (x64) assemblies just fine, of course they should be present in the target's program directory.

Thank you for reply.
I get an error when click the decrypt button.
My OS is Win10Pro x64.

sajan_saragam

02-28-2020 19:59

Hey @CodeCracker, @congviet. Can you upload
"SMD_ForAgile_AnyCPU" on any file hosting site? Please..

CodeCracker

03-02-2020 17:34

Quote:

Originally Posted by sajan_saragam (Post 119428)

Hey @CodeCracker, @congviet. Can you upload
"SMD_ForAgile_AnyCPU" on any file hosting site? Please..

https://forum.exetools.com/showpost.php?p=117258&postcount=14

https://www76.zippyshare.com/v/3HxU5ELW/file.html

CodeCracker

05-02-2020 14:48

More note on how you deal with Agile:

https://lifeinhex.com/string-decryption-with-de4dot/

For decrypting strings:
de4dot hello-3.exe --strtyp delegate --strtok 0x060004EC

0x060004EC is the string decryption method - you will have to find manually browsing in Reflector/dnspy.

Force to packer unknown on first deobfuscation:
-p un

I don't know why you have to clean that many times until it got it right (1+2):
.... _msil-cleaned-cleaned-cleaned.exe

SimpleMSILDecryptorForAgile will only decryt methods and is not an unvirtualizer.

Still don't understand why SMD For Agile isn't working for some user not even with NetBox 4. For me all worked fine even on different machines.

sendersu

05-02-2020 22:41

Quote:

Originally Posted by CodeCracker (Post 120020)

More note on how you deal with Agile:

Still don't understand why SMD For Agile isn't working for some user not even with NetBox 4. For me all worked fine even on different machines.

maybe save video how you use it

halplis

01-10-2022 08:29

The dll

Hello folks. where I can get SJITHook.dll?

For some reason I cannot download files from the forum so I only could download from one of the external links.

congviet

01-10-2022 22:46

1 Attachment(s)

Quote:

Originally Posted by halplis (Post 124459)

Hello folks. where I can get SJITHook.dll?

For some reason I cannot download files from the forum so I only could download from one of the external links.

Check attach file

Bidasci

10-17-2022 05:18

Thank you for this. This will be very useful.

EDIT: I am getting the error Arithmetic operation resulted in an overflow when trying to deobfuscate a DLL.

The full log is here:

Code:

************** Exception Text **************

System.OverflowException: Arithmetic operation resulted in an overflow.

   at System.IntPtr.op_Explicit(IntPtr value)

   at Simple_MSIL_Decryptor.MainForm.SendToJit()

   at System.AppDomain.DoCallBack(CrossAppDomainDelegate callBackDelegate)

   at Simple_MSIL_Decryptor.MainForm.Button2Click(Object sender, EventArgs e)

   at System.Windows.Forms.Control.OnClick(EventArgs e)

   at System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)

   at System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)

   at System.Windows.Forms.Control.WndProc(Message& m)

   at System.Windows.Forms.ButtonBase.WndProc(Message& m)

   at System.Windows.Forms.Button.WndProc(Message& m)

   at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)





************** Loaded Assemblies **************

mscorlib

    Assembly Version: 4.0.0.0

    Win32 Version: 4.8.9075.0 built by: NET481REL1LAST_C

    CodeBase: file:///C:/Windows/Microsoft.NET/Framework64/v4.0.30319/mscorlib.dll

----------------------------------------

Simple_MSIL_Decryptor

    Assembly Version: 1.0.0.0

    Win32 Version: 1.0.0.0

    CodeBase: file:///C:/Users/Bidasci/LaunchBox/Core/Simple_MSIL_Decryptor.exe

----------------------------------------

System.Windows.Forms

    Assembly Version: 4.0.0.0

    Win32 Version: 4.8.9075.0 built by: NET481REL1LAST_C

    CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll

----------------------------------------

System

    Assembly Version: 4.0.0.0

    Win32 Version: 4.8.9065.0 built by: NET481REL1LAST_C

    CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll

----------------------------------------

System.Drawing

    Assembly Version: 4.0.0.0

    Win32 Version: 4.8.9032.0 built by: NET481REL1

    CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll

----------------------------------------

System.Configuration

    Assembly Version: 4.0.0.0

    Win32 Version: 4.8.9032.0 built by: NET481REL1

    CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Configuration/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll

----------------------------------------

System.Xml

    Assembly Version: 4.0.0.0

    Win32 Version: 4.8.9032.0 built by: NET481REL1

    CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Xml/v4.0_4.0.0.0__b77a5c561934e089/System.Xml.dll

----------------------------------------

Accessibility

    Assembly Version: 4.0.0.0

    Win32 Version: 4.8.9032.0 built by: NET481REL1

    CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/Accessibility/v4.0_4.0.0.0__b03f5f7f11d50a3a/Accessibility.dll

----------------------------------------

sendersu

10-18-2022 01:50

any chance to support .net higher then 4.0? (eg 5.0,, 6.0?)

CodeCracker

11-05-2023 00:35

An updated version

An updated version attached, fixed some generic type instantiation.

amatory

11-05-2023 02:27

Not trying to steal the thread. If this is not allowed, please quote and I will remove this thread.

For some reason, SMD becomes unresponsive for me. For anyone having issues with SMD, you can also use the following process:

1. Run ManagetJITerFR4 in Netbox 4
2. Then run SAE in-built deobfuscator module with Strings Only mode
3. Then de4dot Reactor v4.9

CodeCracker

11-07-2023 19:47

At the moment only x86 (32 bits) assemblies are supported.
What's new:
- get ride of SJITHook.dll
- added support for more Frameworks: only tested with Framework 4.5 and 4.8 at this moment;
I wanna ask you to test SMD_FOR_AGILE in various Frameworks and report back if it is working or not.
Download link:
https://workupload.com/file/wyfrJKjCRcx

CodeCracker

11-09-2023 22:18

What's new:
- Finally added support for x64 assemblies, now is released as any cpu;
Only tested with Framework 4.0, 4.5 and 4.8 at this moment.
Will be great if someone will test it with more Frameworks.
Download link:
https://workupload.com/file/rGGMtpWJ2Y7
a simple x64 unpackme:
https://workupload.com/file/YBNad7ua6Hc

CodeCracker

11-29-2023 23:49

An updated version:
https://workupload.com/file/zVujwwPX7u5
What's new: - Added "WPF Application fix" to make System.Windows.Application.Current different from null
- Added "No new Appdomain" - when selected no new AppDomain is created, default unchecked
- Added "Patch GetExecutinAsm" - Assembly.GetExecutingAssembly / Assembly.GetCallingAssembly will be patched only when this checkbox is selected, default unchecked

hp3	01-07-2024 22:03

hi
CodeCracker :

this last version can use for x86 file too ?

CodeCracker

01-08-2024 01:17

Quote:

Originally Posted by hp3 (Post 129851)

this last version can use for x86 file too ?

Yes. Released as x86 with AnyCpu marked.
The last version has "32bits required" unmarked in .NET Directory -> Flag
so it in x86 system will runs as 32 bits;
in 64 bits OS will run as x64.

hp3	01-08-2024 15:51

@CodeCracker :

crash in unpacking exe and dll
test in win 7 - 32bit 64bit and win10 64bit and Net box
this maybe for files have virtualization ?

CodeCracker

01-08-2024 20:10

Quote:

crash in unpacking exe and dll

Please mark "No new Appdomain" option;
Error should be shown now. Let me know.

hp3	01-08-2024 20:49

exe and dll files unpack

3 Attachment(s)

this is error when try unpack exe and dll

CodeCracker

01-08-2024 22:30

Please send me a PM with all targets so I could check them.

hp3	01-08-2024 22:49

i think PM is close in forum

[email protected]
if u can send a mail and i will contact u on mail

CodeCracker

01-09-2024 00:52

share all targets here

Quote:

Originally Posted by hp3 (Post 129877)

i think PM is close in forum

Than please share all targets here.

embassy

02-29-2024 09:12

Hello! The provided executable gives the error message "Could not load file or assembly 'System.Net.Http ...' "
Below is the full callstack. To reproduce, you can use the decryptor on itself or other code, in a virtual machine (but I have the same result on my main machine) This is with the latest version.

Code:

************** Exception Text **************

System.IO.FileNotFoundException: Could not load file or assembly 'System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a' or one of its dependencies. The system cannot find the file specified.

File name: 'System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'

   at Simple_MSIL_Decryptor.MainForm.SendToJit()

   at System.AppDomain.DoCallBack(CrossAppDomainDelegate callBackDelegate)

   at System.AppDomain.DoCallBack(CrossAppDomainDelegate callBackDelegate)

   at Simple_MSIL_Decryptor.MainForm.Button2Click(Object sender, EventArgs e)

   at System.Windows.Forms.Control.OnClick(EventArgs e)

chants

02-29-2024 17:49

Looks like you don't have a version of the .NET framework installed that it's specifically referencing.

congviet

02-29-2024 22:25

Missing reference files or the target is using a newer version of the .net framework

CodeCracker

06-10-2024 19:16

bug fixed version

SMD for AGILE bug fixed version: now should work.
https://workupload.com/file/6vbvr38yVZG

All times are GMT +8. The time now is 04:29.

Page 1 of 3

Show 40 post(s) from this thread on one page