Reverse Engineering Chinese laser engraver

Question

I would like to reverse-engineer the software that came with my Chinese-made laser engraver. Unfortunately the hardware does not play at all with other software out there... The original software is horribly buggy, is loaded with malware (specifically the Strictor Trojan), and the vendor is refusing to give support for the program. I would like to get the original code of this program so that I may remove the Trojan, debug the software, and just make the damn thing work. I paid over $400 for the thing and frankly I am quite pissed off at the fact that the software is complete SHIT. (pretty sure it hasn't been updated since win2k...) It acts as if it were written by some highschool kid as a senior project or something... severely limited and severely bugged.

So looking at the error files this program keeps pumping out, i WAS 100% sure that the main program was made in .net (not sure if VB, VC, VC++, etc). it's stating errors with "windows.form.button...", ontop of that, they required .net framework to be installed in order to use it. Which made me think possibly VB? However after trying VBDecompilerLite, it stated that the program was compiled using an unknown compiler... so i'm at a loss here.

I have tried to extract the code from the exe using DeDe, ResourceHacker, Universal Extractor, 7Zip extraction, etc - all of which produce a 0b file "[0~]" which is unreadable, or an error saying could not extract files.

If anyone has a clue of what I could try next, please let me know. I cannot upload the file for people to test because - as I stated above - it contains malware. I am decompiling the program on a PC that is off the usual network, so no internet / network access there.

Virus Scan Results:

Scanner         |   Malware Variant             |   AV updated
---------------------------------------------------------------
ALYac               Gen:Variant.Strictor.99340      20160115
Ad-Aware            Gen:Variant.Strictor.99340      20160115
Arcabit             Trojan.Strictor.D1840C          20160115
Avast               Win32:Malware-gen               20160115
BitDefender         Gen:Variant.Strictor.99340      20160115
Emsisoft            Gen:Variant.Strictor.99340 (B)  20160115
F-Secure            Gen:Variant.Strictor.99340      20160115
GData               Gen:Variant.Strictor.99340      20160115
MicroWorld-eScan    Gen:Variant.Strictor.99340      20160115
Qihoo-360           QVM19.1.Malware.Gen             20160115
Rising              PE:Malware.RDM.18!5.18 [F]      20160114 

Please help me!

Here is the original error that the program gave me (if it helps):

> See the end of this message for details on invoking  just-in-time
> (JIT) debugging instead of this dialog box.
> 
> ************** Exception Text ************** System.ArgumentException: Parameter is not valid.    at System.Drawing.Bitmap.LockBits(Rectangle
> rect, ImageLockMode flags, PixelFormat format, BitmapData bitmapData) 
> at System.Drawing.Bitmap.LockBits(Rectangle rect, ImageLockMode flags,
> PixelFormat format)    at xj2.Form1.Gray2(Bitmap srcBitmap, Boolean
> reverse)    at xj2.Form1.button3_Click(Object sender, EventArgs e)   
> at System.Windows.Forms.Control.OnClick(EventArgs e)    at
> System.Windows.Forms.Button.OnClick(EventArgs e)    at
> System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)    at
> System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons
> button, Int32 clicks)    at
> System.Windows.Forms.Control.WndProc(Message& m)    at
> System.Windows.Forms.ButtonBase.WndProc(Message& m)    at
> System.Windows.Forms.Button.WndProc(Message& m)    at
> System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)
> at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message&
> m)    at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32
> msg, IntPtr wparam, IntPtr lparam)
> 
> 
> ************** Loaded Assemblies ************** mscorlib
>     Assembly Version: 2.0.0.0
>     Win32 Version: 2.0.50727.3643 (GDR.050727-3600)
>     CodeBase: file:///C:/windows/Microsoft.NET/Framework/v2.0.50727/mscorlib.dll
> ---------------------------------------- BoxedAppSDK_AppDomainManager
>     Assembly Version: 1.0.0.0
>     Win32 Version: 1.0.0.0
>     CodeBase: file:///C:/windows/assembly/GAC/BoxedAppSDK_AppDomainManager/1.0.0.0__ef07ce3257ee81c1/BoxedAppSDK_AppDomainManager.dll
> ---------------------------------------- xj2
>     Assembly Version: 1.0.0.0
>     Win32 Version: 1.0.0.0
>     CodeBase: file:///C:/Documents%20and%20Settings/Owner/デスクトップ/1.exe
> ---------------------------------------- System.Windows.Forms
>     Assembly Version: 2.0.0.0
>     Win32 Version: 2.0.50727.3645 (GDR.050727-3600)
>     CodeBase: file:///C:/windows/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/System.Windows.Forms.dll
> ---------------------------------------- System
>     Assembly Version: 2.0.0.0
>     Win32 Version: 2.0.50727.3644 (GDR.050727-3600)
>     CodeBase: file:///C:/windows/assembly/GAC_MSIL/System/2.0.0.0__b77a5c561934e089/System.dll
> ---------------------------------------- System.Drawing
>     Assembly Version: 2.0.0.0
>     Win32 Version: 2.0.50727.3644 (GDR.050727-3600)
>     CodeBase: file:///C:/windows/assembly/GAC_MSIL/System.Drawing/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll
> ---------------------------------------- Accessibility
>     Assembly Version: 2.0.0.0
>     Win32 Version: 2.0.50727.3053 (netfxsp.050727-3000)
>     CodeBase: file:///C:/windows/assembly/GAC_MSIL/Accessibility/2.0.0.0__b03f5f7f11d50a3a/Accessibility.dll
> ---------------------------------------- xj2.resources
>     Assembly Version: 1.0.0.0
>     Win32 Version: 1.0.0.0
>     CodeBase: file:///C:/Documents%20and%20Settings/Owner/デスクトップ/en/xj2.resources.DLL
> ---------------------------------------- System.Configuration
>     Assembly Version: 2.0.0.0
>     Win32 Version: 2.0.50727.3053 (netfxsp.050727-3000)
>     CodeBase: file:///C:/windows/assembly/GAC_MSIL/System.Configuration/2.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll
> ---------------------------------------- System.Xml
>     Assembly Version: 2.0.0.0
>     Win32 Version: 2.0.50727.3082 (QFE.050727-3000)
>     CodeBase: file:///C:/windows/assembly/GAC_MSIL/System.Xml/2.0.0.0__b77a5c561934e089/System.Xml.dll
> ----------------------------------------
> 
> ************** JIT Debugging ************** To enable just-in-time (JIT) debugging, the .config file for this application or computer
> (machine.config) must have the jitDebugging value set in the
> system.windows.forms section. The application must also be compiled
> with debugging enabled.
> 
> For example:
> 
> <configuration>
>     <system.windows.forms jitDebugging="true" /> </configuration>
> 
> When JIT debugging is enabled, any unhandled exception will be sent to
> the JIT debugger registered on the computer rather than be handled by
> this dialog box.

Answer 1

VB Decompiler is for decompiling native programs and P-code programs.

But as @ebux said, your target appears to be written in .NET, so you'd need to use something like ILSpy or .NET Reflector.

However, given that your target is packed with BoxedApp, you'll first need to unpack it. A quick Google search shows that it's rather easy to unpack the packed files -- all you need is a hex editor.

Once you've extracted the files from the BoxedApp EXEs, you can then decompile them with ILSpy or .NET Reflector:

Answer 2

RedGate's NET Reflector can disassemble a whole DLL assembly and generate the .cs files & even .vcxproj files.

With the VSPro version, you can disassemble & debug code on the fly.

So, I suggest getting a trial of it.

However, if the code is ofuscated (or is part native / part managed, ie with C++ CLI) it will not disassemble completely. However, from your stack trace, looks like it is not ofuscated.

Additionally some ofuscators create a thread that checks in an infinite loop if System.Diagnostics.Debugger.IsAttached property is true and if so kills the whole process, so some extra effort may be required :)