I'm dealing with an interesting form of obfuscation. A C# program I am reversing has a central API, let's call it "Central API". This Central API has several functions that aren't exactly defined.

For example, all functions in this Central API class go something like this:

    public string SomeFunction(string name)
    {
        IServiceInterface interface = base.\u0001();
        try
        {
            if (interface != null)
            {
                return interface.SomeFunction(name);
            }
        }
        catch (Exception ex)
        {
            ...
        }
        finally
        {
            ServiceInterface.Close(interface);
        }
        return string.Empty;
    }

base.\u0001 does this:

    internal IServiceInterface \u0001()
    {
        IServiceInterface result = null;
        try
        {
            result = this.ChannelFactoryClient.CreateChannel();
        }
        catch (Exception ex)
        {
            ...
        }
        return result;
    }

base.\u0001() returns an object with the type "System.Runtime.Remoting.Proxies.__TransparentProxy" (found while debugging), but when I viewed the value while debugging, there was no member function "SomeFunction" or any other functions. The object includes various information, but nothing that seems to hint to the true location of "SomeFunction".

Does anyone know the next steps I should take to find "SomeFunction"'s true location (maybe what to look for in the object)? For reference, some modules of this project were obfuscated with SmartAssembly, and even after de4dot "successfully" cleaned them, nothing changed.

  • as far as I remember ChannelFactoryClient was used with WCF communication to send/receive requests to i.e. web services. Does this program communicate with an external service? Maybe the code you are looking for is there? Can you share the binary? – Paweł Łukasik Oct 10 at 4:01
  • Hi @PawełŁukasik , upon looking further into the object, I see a uri that accesses a net.pipe//. Could it be that the actual code is running in a different process? Thanks. – Rob Gates Oct 10 at 15:46
  • Yup. Might be the case – Paweł Łukasik Oct 10 at 16:06
  • @PawełŁukasik Hmm, checking out the process in Process Hacker 2 shows no handles to named pipes with the same name (or other file handles too). Any tips on how to track down the second process and find the handler there? – Rob Gates Oct 10 at 16:15
  • it could be in the same process too. As for the tracking down the code - not really sure if there's one way. Just analyzing the binary and slowly building the knowledge about it. – Paweł Łukasik Oct 10 at 16:31

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.