Reverse engineering an obfuscated .Net application

Huge thanks Curtis Mechling http://twitter.com/#!/curtismechling

Outline

This talk is for all audiences, no experience and seasoned .Net

Steps to reverse .Net app

Run the application to understand functionality
Decompile the

Topic not new

Many others before me have discussed the insecurities of

Reversing and obfuscation

What exactly is reversing and obfuscation?
Reversing example
You’re given an

.Net basics

.Net, it’s a framework, nuff said
Blanket term for microsoft family

.Net basics

A stand alone executable built for .Net will run inside

Executables

There are two main kinds of EXE’s
Compiled and interpreted
Compiled applications usually

Executables

Compiled executables are often built with a higher programming language, such

Executables

Interpreted executables, such as java and .Net, are much easier to

Obfuscation

Because it’s trivial to get source code from a .Net application

Determine type executable

There are a number of ways to determine the

Firefox with CFF explorer

Firefox with CFF explorer

GuessPassword.exe in CFF explorer

GuessPassword.exe is a simple .Net application I wrote

Next step > decompile

Now you’ve identified the executable was built using

ILSpy

Reflector

Decompilation tips

Only analyze your exe tree and ignore dependencies that get

Decompilation tips

Only focus on the “real” code
Real code located in pink

SafeAsHouses.exe

Let’s take a look at a real life example
SafeAsHouses.exe can be

SafeAsHouses in ILSpy

SafeAsHouses in ILSpy

So soon as we open SafeAsHouses.exe in ILSpy we

GuessPassword vs SafeAsHouses

Next let’s compare GuessPassword and SafeAsHouses in ILSpy
First GuessPassword

GuessPassword vs SafeAsHouses

SafeAsHouses

More obfuscation

Here we see more signs of obfuscation
In GuessPassword we see

Understanding the app

Typically you would run the application first to get

Understanding the app

If we authenticate with the correct password we are

Items of interest

The application asks for input
Incorrect password presents a pop

Items of interest

The main idea is to take certain areas of

Searching for items of interest

Now that we’ve done some recon and

Decompile code into text file

Decompile code into text file

Next choose File > Save Code

Decompile code into text file

Then save the file as a “C#

Decompile code into text file

At this point you can use your

Reflector code search plugin

Reflector’s code search plugin is very convenient in

Items of interest

The application asks for input
Incorrect password presents a pop

Application asks for input

A popular way of taking form input in

Application asks for input
Searching for this.*.Text revealed numerous hits, probably best

Pop up message

A pop up box is typically done with the

Pop up message
So quite a few hits on MessageBox.Show, let’s continue

Pop up message

The pop up message states “Password incorrect”
We should search

Application closes

If you enter an incorrect password you’ll get a pop

Application closes
Less results which means which means less manual reviewing of

Successful authentication opens another window

Probably the most popular way to show

Successful authentication opens another window
Only three hits, we’re money

Code search plugin

Using this plugin we were able to narrow down

First hit, found the functionality

Same code in ILSpy

Explanation of code

Line 6: developer is assigning variable “a” to whatever

Subverting authentication

Now that we’ve found the code that performs the authentication

Reflexil

Reflexil

The bottom half of the previous screen shot shows the reflexil

CIL

Lower level language used by the .Net application virtual machine
So your

CIL

Not that important to understand all the technical details behind CIL
On

Modifying CIL

Looking through the code and CIL we see an interesting

Modifying CIL

You’ll also notice the operand for the opcode on line

Modifying CIL

Right click on opcode and choose edit

Modifying CIL

Next change to brtrue then click update

Modifying CIL

Next right click on root tree and save

Patched executable

Now you’ve successfully patched a .Net executable
If we run this

Deleting code blocks

Delete code blocks

Delete lines 1-28
Save the patched application
Run it again and

Missing code block

Great success

We’ve successfully modified the application to subvert authentication
If we had

Easier reversing via deobfuscation

There is a slightly easier way to go

Reflexil deobfuscation

Right click > Reflexil > Obfuscator search

Reflexil deobfuscation

Next reflexil will try to determine the type of obfuscation

Reflexil deobfuscation

Next you save the executable, you can stick with the

Deobfuscated code

Deobfuscated code

So reflexil actually does a nice job on getting us

Steps to reverse .Net app

Run the application to understand functionality
Decompile the

Wrapping up

A standalone .Net executable will more than likely be very