2

I have a client application that, once the user is authenticated with my server, sends a byte array which is then loaded using Assembly.Load. I am pretty sure once that happens, even if the loaded bytes are dumped from memory, they cannot be used to re-construct source code. I just wanted to confirm this, or get more information in case I am wrong.

Thanks!

8
  • What if a user reverses your client application and modifies it to save the code you are sending over to disk for inspection? Or captures the data with wireshark or fiddler for inspection? Seems like it would be able to be reversed in that way given some effort. On a side note, I think it is a really bad idea to send executable code over the wire to your client for execution. Seems like bad practice to me. Oct 21 '16 at 18:22
  • I did not think about the modification to save code. I'll have to address that (not sure how yet, maybe just checksum the client application and send it on the server to see if it matches). As for capturing data, it is encrypted and needs to reach the client to be properly decrypted. Also, the client is encrypted with Enigma protector. Oct 21 '16 at 18:36
  • Still with modification to the client (assuming also in C#) would be trivial to accomplish that. Also, Enigma can be unpacked easily as can most .NET protections. This tool has worked for me in unpacking Enigma VM lifeinhex.com/improved-static-enigma-virtual-box-unpacker I would never assume that just because it is packed with a commercial product that it can't be unpacked. Even if no tool like above were available, someone who is willing to put in the work can get it done. Oct 21 '16 at 18:40
  • So am I out of luck? Would checking for modifications of the client work? Now that I think of it, anything I think of can be spoofed if they do indeed modify the client. Hmm. I guess I'm not correctly using code hosting. Oct 21 '16 at 18:48
  • Maybe using a language that takes a lot more work to reverse engineer might be worth using instead of C# if it is that much of a concern for you. Maybe C++ instead? You can do some nice obfuscation on it for free with something like LLVM obfuscator which makes it even more of a pain in to reverse. But again.. given someone with time and determination there is not much you can do. I am no pro on the matter... maybe someone with more experience can chime in. This is why I only commented. Oct 21 '16 at 18:53
8

It is in fact trivial to dump the byte array or the module directly from dnSpy.

To mimic the described scenario I wrote some trivial example code:

using System.IO;
using System.Reflection;

namespace DumpAssembly
{
    class Program
    {
        static void Main(string[] args)
        {
            var rawAssembly = File.ReadAllBytes("Test.dll");
            var assembly = Assembly.Load(rawAssembly);
            foreach(var type in assembly.ExportedTypes)
            {
                if (type.Name == "Test")
                {
                    var method = type.GetMethod("DoCoolStuff");
                    method.Invoke(null, null);
                    break;
                }
            }
        }
    }
}

Drop the generated assembly in dnSpy, start debugging and step a little through the Main method. Soon you will be able to save the newly-loaded module:

Dumping the module

Once the module is saved, opening it in dnSpy will easily give away your intellectual property:

Decompiling the module

Now a partial solution for this is obfuscating your module with something like ConfuserEx (it's open source, commercial products are available). This might slow down your attackers but it would be naive to assume they cannot decompile and understand your code within a reasonable amount of time.

5
  • Yeah, this seems to be what I was looking for. Didn't think it was THIS easy. Oct 21 '16 at 23:32
  • Also, this is a bit out-of-scope if this question. The situation is, I use Enigma protector to pack the client executable that is to be distributed. So maybe there's a way I can verify that the file has not been unpacked/tampered with. I was thinking by sending the MD5 hash of the executed client to the server and making sure it matches. But now I'm wondering if they could just alter the client so that it sends me the correct MD5. Oct 21 '16 at 23:39
  • You can indeed modify the client to send the correct data over the line. You should run under the assumption that your code is being looked at.
    – mrexodia
    Oct 22 '16 at 14:18
  • dnSpy is one of these completely undocumented tools. It is useless for me because after attaching to a process the Assembly Editor shows only the Microsoft assemblies (System.Windows.Forms etc), but not the assemblies of my application.
    – Elmue
    Jul 16 '20 at 1:22
  • Try the Debug -> Modules menu.
    – mrexodia
    Jul 16 '20 at 8:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.