![]() |
{SmartAssembly 4} Refrences Dynamic Proxy Setting patch?
Anyone have any information on how to patch a {SmartAssembly 4} protected target with this setting enabled? Here is what the setting says in {SM4}:
"{smartassembly} can create a proxy for calls to external members. This high protection feature will hide most of the calls to external methods, properties or fields in your code by replacing them with calls to the proxy. This proxy is created dynamically at run-time, which increases the protection of your code. Additionally, the proxy is built in a way that prevents the assembly from being modified. This means that if a hacker tries to modify your assembly, even slightly, then the proxy will no longer work and the application will not be able to start. Because this feature has a built-in protection against assembly modification, you won't be able to post-process the built assembly with any tool." Based on my research, I am almost positive that this is the method: cctor: Code:
Shared Sub New()Code:
Public Shared Sub (ByVal num1 As Integer)Thanks. |
Hi,
do you have a real target for this? |
Quote:
|
@NoneForce: Yes, I do, and I suppose many people who use the new SmartAssembly will use this setting if they don't already. If you'd like to see it I could shoot you a PM.
@virus: Thanks for the info, but how would I find the dynamically generated code? I've enabled only this setting in a test app, so it would be easier to find there, but in a "real" target control flow obfuscation, strings encoding, and obfuscation will also be applied. That makes things quite challenging for one app. Also @virus: While browsing with CFF explorer in the tables section I noticed that the {Smartass 4'd} exe had 914 methods, while my original exe only had 470. I also noticed that the extra methods are the one in my original post, and many ctor/cctor/Invoke methods which are generated at runtime. If I can't see these extra methods in a decompiler like reflector (since they're generated at runtime), how can I "find" this generated code, and what would I replace it with? Thanks for your info so far. Edit: I see that ildasm knows that these methods are there, but reflector doesn't. But although ildasm sees the method names, the methods are blank because they're generated at runtime, as I said before. It isn't as simple as deleting these methods, is it? |
| All times are GMT +8. The time now is 10:41. |
Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX