6

I would like to reverse-engineer the software that came with my Chinese-made laser engraver. Unfortunately the hardware does not play at all with other software out there... The original software is horribly buggy, is loaded with malware (specifically the Strictor Trojan), and the vendor is refusing to give support for the program. I would like to get the original code of this program so that I may remove the Trojan, debug the software, and just make the damn thing work. I paid over $400 for the thing and frankly I am quite pissed off at the fact that the software is complete SHIT. (pretty sure it hasn't been updated since win2k...) It acts as if it were written by some highschool kid as a senior project or something... severely limited and severely bugged.

So looking at the error files this program keeps pumping out, i WAS 100% sure that the main program was made in .net (not sure if VB, VC, VC++, etc). it's stating errors with "windows.form.button...", ontop of that, they required .net framework to be installed in order to use it. Which made me think possibly VB? However after trying VBDecompilerLite, it stated that the program was compiled using an unknown compiler... so i'm at a loss here.

I have tried to extract the code from the exe using DeDe, ResourceHacker, Universal Extractor, 7Zip extraction, etc - all of which produce a 0b file "[0~]" which is unreadable, or an error saying could not extract files.

If anyone has a clue of what I could try next, please let me know. I cannot upload the file for people to test because - as I stated above - it contains malware. I am decompiling the program on a PC that is off the usual network, so no internet / network access there.

Virus Scan Results:

Scanner         |   Malware Variant             |   AV updated
---------------------------------------------------------------
ALYac               Gen:Variant.Strictor.99340      20160115
Ad-Aware            Gen:Variant.Strictor.99340      20160115
Arcabit             Trojan.Strictor.D1840C          20160115
Avast               Win32:Malware-gen               20160115
BitDefender         Gen:Variant.Strictor.99340      20160115
Emsisoft            Gen:Variant.Strictor.99340 (B)  20160115
F-Secure            Gen:Variant.Strictor.99340      20160115
GData               Gen:Variant.Strictor.99340      20160115
MicroWorld-eScan    Gen:Variant.Strictor.99340      20160115
Qihoo-360           QVM19.1.Malware.Gen             20160115
Rising              PE:Malware.RDM.18!5.18 [F]      20160114 

Please help me!

Here is the original error that the program gave me (if it helps):

> See the end of this message for details on invoking  just-in-time
> (JIT) debugging instead of this dialog box.
> 
> ************** Exception Text ************** System.ArgumentException: Parameter is not valid.    at System.Drawing.Bitmap.LockBits(Rectangle
> rect, ImageLockMode flags, PixelFormat format, BitmapData bitmapData) 
> at System.Drawing.Bitmap.LockBits(Rectangle rect, ImageLockMode flags,
> PixelFormat format)    at xj2.Form1.Gray2(Bitmap srcBitmap, Boolean
> reverse)    at xj2.Form1.button3_Click(Object sender, EventArgs e)   
> at System.Windows.Forms.Control.OnClick(EventArgs e)    at
> System.Windows.Forms.Button.OnClick(EventArgs e)    at
> System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)    at
> System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons
> button, Int32 clicks)    at
> System.Windows.Forms.Control.WndProc(Message& m)    at
> System.Windows.Forms.ButtonBase.WndProc(Message& m)    at
> System.Windows.Forms.Button.WndProc(Message& m)    at
> System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)
> at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message&
> m)    at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32
> msg, IntPtr wparam, IntPtr lparam)
> 
> 
> ************** Loaded Assemblies ************** mscorlib
>     Assembly Version: 2.0.0.0
>     Win32 Version: 2.0.50727.3643 (GDR.050727-3600)
>     CodeBase: file:///C:/windows/Microsoft.NET/Framework/v2.0.50727/mscorlib.dll
> ---------------------------------------- BoxedAppSDK_AppDomainManager
>     Assembly Version: 1.0.0.0
>     Win32 Version: 1.0.0.0
>     CodeBase: file:///C:/windows/assembly/GAC/BoxedAppSDK_AppDomainManager/1.0.0.0__ef07ce3257ee81c1/BoxedAppSDK_AppDomainManager.dll
> ---------------------------------------- xj2
>     Assembly Version: 1.0.0.0
>     Win32 Version: 1.0.0.0
>     CodeBase: file:///C:/Documents%20and%20Settings/Owner/デスクトップ/1.exe
> ---------------------------------------- System.Windows.Forms
>     Assembly Version: 2.0.0.0
>     Win32 Version: 2.0.50727.3645 (GDR.050727-3600)
>     CodeBase: file:///C:/windows/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/System.Windows.Forms.dll
> ---------------------------------------- System
>     Assembly Version: 2.0.0.0
>     Win32 Version: 2.0.50727.3644 (GDR.050727-3600)
>     CodeBase: file:///C:/windows/assembly/GAC_MSIL/System/2.0.0.0__b77a5c561934e089/System.dll
> ---------------------------------------- System.Drawing
>     Assembly Version: 2.0.0.0
>     Win32 Version: 2.0.50727.3644 (GDR.050727-3600)
>     CodeBase: file:///C:/windows/assembly/GAC_MSIL/System.Drawing/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll
> ---------------------------------------- Accessibility
>     Assembly Version: 2.0.0.0
>     Win32 Version: 2.0.50727.3053 (netfxsp.050727-3000)
>     CodeBase: file:///C:/windows/assembly/GAC_MSIL/Accessibility/2.0.0.0__b03f5f7f11d50a3a/Accessibility.dll
> ---------------------------------------- xj2.resources
>     Assembly Version: 1.0.0.0
>     Win32 Version: 1.0.0.0
>     CodeBase: file:///C:/Documents%20and%20Settings/Owner/デスクトップ/en/xj2.resources.DLL
> ---------------------------------------- System.Configuration
>     Assembly Version: 2.0.0.0
>     Win32 Version: 2.0.50727.3053 (netfxsp.050727-3000)
>     CodeBase: file:///C:/windows/assembly/GAC_MSIL/System.Configuration/2.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll
> ---------------------------------------- System.Xml
>     Assembly Version: 2.0.0.0
>     Win32 Version: 2.0.50727.3082 (QFE.050727-3000)
>     CodeBase: file:///C:/windows/assembly/GAC_MSIL/System.Xml/2.0.0.0__b77a5c561934e089/System.Xml.dll
> ----------------------------------------
> 
> ************** JIT Debugging ************** To enable just-in-time (JIT) debugging, the .config file for this application or computer
> (machine.config) must have the jitDebugging value set in the
> system.windows.forms section. The application must also be compiled
> with debugging enabled.
> 
> For example:
> 
> <configuration>
>     <system.windows.forms jitDebugging="true" /> </configuration>
> 
> When JIT debugging is enabled, any unhandled exception will be sent to
> the JIT debugger registered on the computer rather than be handled by
> this dialog box.
  • It seems to use .NET (CodeBase: file:///C:/windows/Microsoft.NET/Framework/), so try to use .NET Reflector to decompile the code. – ebux Jan 18 '16 at 8:34
  • @ebux Thanks for the advice, i'll try it. edit: I tried .NET Reflector, however it came back as not being a .NET module... – Jason Jan 19 '16 at 0:33
3

VB Decompiler is for decompiling native programs and P-code programs.

But as @ebux said, your target appears to be written in .NET, so you'd need to use something like ILSpy or .NET Reflector.

However, given that your target is packed with BoxedApp, you'll first need to unpack it. A quick Google search shows that it's rather easy to unpack the packed files -- all you need is a hex editor.

Once you've extracted the files from the BoxedApp EXEs, you can then decompile them with ILSpy or .NET Reflector:

ILSpy

  • "I cannot upload the file for people to test because - as I stated above - it contains malware." - Can you save the file in a password-protected ZIP and upload the ZIP somewhere? – Jason Geffner Jan 19 '16 at 14:01
  • Yeah, I know the feeling. I can do a password protected zip/rar file in that case, can you suggest a platform to upload to without having to register? password will be "reverseengineering.stackexchange.com" – Jason Jan 20 '16 at 1:25
  • 1
    For safety, I deleted my previous comment / link (just in case). I have uploaded the file to a site i found. I had some issues with editing the current zip file to password protect it, so I had to double-archive it (work-around due to the virus scanner constantly deleting the extracted files.... argh!) http://www.filedropper.com/acan-a4 it's a 7zip & RAR archive. PW: reverseengineering.stackexchange.com – Jason Jan 20 '16 at 1:59
  • Thank you very much sir, you have saved me and my company quite the headache! We will, of course, use the source code in an ethical way (just fixing the issues & using, no selling). I wish i could add more points for your answer, however i'm limited to just one... – Jason Jan 20 '16 at 23:19
  • I was interested in a laser engraver coded in .NET heh, For the future i'll mirror the link as well mediafire.com/download/kkjpauk5wiejumx/acan-a4.rar PW: reverseengineering.stackexchange.com – SSpoke Jan 21 '16 at 8:00
1

RedGate's NET Reflector can disassemble a whole DLL assembly and generate the .cs files & even .vcxproj files.

With the VSPro version, you can disassemble & debug code on the fly.

So, I suggest getting a trial of it.

However, if the code is ofuscated (or is part native / part managed, ie with C++ CLI) it will not disassemble completely. However, from your stack trace, looks like it is not ofuscated.

Additionally some ofuscators create a thread that checks in an infinite loop if System.Diagnostics.Debugger.IsAttached property is true and if so kills the whole process, so some extra effort may be required :)

  • Thank you for your suggestion. I will look into those programs for future reference! – Jason Jan 21 '16 at 3:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.