View Single Post
  #12  
Old 03-10-2005, 06:11
Newbie_Cracker's Avatar
Newbie_Cracker Newbie_Cracker is offline
VIP
 
Join Date: Jan 2005
Posts: 227
Rept. Given: 72
Rept. Rcvd 26 Times in 12 Posts
Thanks Given: 50
Thanks Rcvd at 25 Times in 18 Posts
Newbie_Cracker Reputation: 26
Quote:
Originally Posted by zacdac
For a winforms assembly the patching of the size of the strong name field in the COR header will do the trick, but for an asp.net assembly you will need to also patch the strong named attribute which is stored as meta data before the RAS key.
I didn't understand completely.
Here is the public key of the above mentioned DLL which IDA shows :

Code:
.assembly RadTreeView
{
  .hash algorithm 0x00008004
  .ver 4:0:0:0
  .originator = (
   00 24 00 00 04 80 00 00 94 00 00 00 06 02 00 00
   00 24 00 00 52 53 41 31 00 04 00 00 01 00 01 00
   CD 62 12 05 0E 7C CD 6F 51 AF 2C 41 FD CC 65 44
   AC E3 CF 79 6A 19 49 C5 80 C3 FF 52 7C AC 91 1D
   9B E0 5F AD 28 47 CE F4 E7 E5 EC 87 9F C9 4B E4
   9E 31 C7 97 C2 B8 39 25 C4 ED F6 AA 83 FA 78 A3
   5A 47 C0 F4 7B 44 A8 F9 3F D1 44 A9 B7 96 BF 74
   9E 8D FC B3 99 82 11 52 A9 5C 7A 37 EB A3 82 B6
   9D A5 8B 7A 1C 87 DA 5C ED 0B 7A 72 BA B1 3F 12
   52 C6 2F 50 DD 35 44 06 E6 F3 B0 4B AF F4 19 BD)
}
The bold numbers mean : RSA1

You mean I must patch 80 at 0x102c to 00 and bytes before RSA1? bytes before RSA1 or complete section of public key?
And patch to what? to 00s?

Regards.

Last edited by Newbie_Cracker; 03-10-2005 at 06:15.
Reply With Quote