I am actually working for the side of software protection. But in order to properly protect my source code ( be it .Net or C++), I would need to understand what is achievable ( and not achievable) from hacker's point of view .

I can protect/obfuscate/encrypt/virtualize my code all the way I want, but when the source code is loaded into the memory, it will have to be unprotected in order to run. So at this point of time, can hacker dump the source code out from the memory, and thus recover my source code in full, unadulterated fashion?

If yes, how this can be done? Using what tools?

Edit: from my finding, it seems that this is doable, and there are protection tools that can prevent this, such as Agile.Net:

Method Level Code Encryption - Encrypts all the MSIL code and keeps it in a secure storage. When the assembly is loaded Agile.NET binds to the .NET runtime engine and manages decrypting the MSIL on a per method basis. Agile.NET creates a runtime environment that executes the original MSIL code by decrypting one method at a time, this important virtue minimizes the exposure of MSIL code in memory thus prevents dumping the code from physical memory.

But I have no idea how, can anyone shed some lights on this?

  • Review your knowledge of the compilation process. Unless you are actively compiling your source code, it will never reside in memory. – Jongware Sep 7 '16 at 8:33
  • Why am I downvoted? – Graviton Sep 7 '16 at 8:34
  • @RadLexus, would you like to expand your comment into a proper answer? – Graviton Sep 7 '16 at 8:34
  • @RadLexus, I'm not too sure about the validity of your claim; see the updated question – Graviton Sep 7 '16 at 9:45
  • For .NET you can use any of ILSpy, Reflector or DotPeek to retrieve C# code from a .DLL or .EXE (as long as it is 100% managed code). – Fernando Gonzalez Sanchez Sep 7 '16 at 17:34

Just to be clear: You can not reconstruct source code from .net or c++ binaries. You can try to recover it using heuristics, embedded symbols and knowledge about the assembler, but you already lost the necessary information in translation.

You should differentiate between packing and obfuscation.

Packing means you encrypt (and / or compress) parts of your compiled code and have a decryption / unpacking stub at the beginning, fetching the encrypted blocks and unpacking them. This can be often observed in the case of malicious software. In this case, you can dump the memory right after the decryption process and it will be unencrypted.

There are more sophisticated means of packing like VM-packing, which increase the challenge of dumping the data noticeably, but there has been a lot of research in this area. That being said, something like a general unpacker does not exist.

Obfuscation on the other hand alters the code directly in a fashion which makes it still able to be executed. For example, a common technique is obfuscating the control flow though the use of spaghetti code, e.g. inserting unnecessary branches and jumps. These operations can principally not be undone and increase the challenge of reversing significantly.

-> You can not hide the logic you want to execute from the machine you want it to run on. You can only make it harder for humans to figure out what your code does.

  • "you can dump the memory right after the decryption process and it will be unencrypted"-- so this means that the packed source code can be unpacked, by dumping it out from the memory using appropriate decompilers? – Graviton Sep 7 '16 at 9:48
  • If yes, how? any tools/resources to recommend? – Graviton Sep 7 '16 at 9:51
  • You can dump the machine code at any time utilizing an debugger. Other common tools are the Process Explorer or dumping the whole memory using a virtual machine. – Nordwald Sep 7 '16 at 10:28
  • Norward, how do you view the claim that MSIL code in memory can be exposed ( see my updated question), is it possible, and if yes, how it can be done? – Graviton Sep 7 '16 at 11:20
  • All memory can be dumped. The advantage of function-level-encryption is that you decrypt each function just before it is executed. To be able to dump the whole code, you would need to dump the memory at each function call or decrypt the code yourself (reverse the encryption). Code which shall be executed has to reside in memory. – Nordwald Sep 7 '16 at 11:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.