1

I have an .net assembly application written on c#

Its target framework version is 4.5.2

Trying to decompile with ILSpy, mostly all files looks like this:

    using MyApp.Controller;
    using MyApp.Controller.SendQuest;
    using PureMVC.Interfaces;
    
    public class AutoSendQuestCommand : BaseQuestCommand
    {
        private delegate void a(AutoSendQuestCommand P_0, INotification notification);
    
        private delegate void b(AutoSendQuestCommand P_0);
    
        private static bool Processing;
    
        protected override void InternalExecute(INotification notification)
        {
            try
            {
                ((a)global::<Module>.Invoke(334))(this, notification);
            }
            catch
            {
                throw;
            }
        }
    
        private void AutoSendQuestIntenal()
        {
            try
            {
                ((b)global::<Module>.Invoke(335))(this);
            }
            catch
            {
                throw;
            }
        }
    }

Also, there are class Module :

    using System;
    using System.IO;
    using System.Security.AccessControl;
    using System.Security.Principal;
    using System.Runtime.InteropServices;
    using System.Threading;
    
    internal class <Module>
    {
        internal static i Invoke;
    
        static <Module>()
        {
            IntPtr iUnknownForObject = Marshal.GetIUnknownForObject(typeof(global::<Module>));
            try
            {
                if (IntPtr.Size == 4)
                {
                    g(Environment.Version.Major, iUnknownForObject);
                }
                else if (IntPtr.Size == 8)
                {
                    h(Environment.Version.Major, iUnknownForObject);
                }
            }
            finally
            {
                Marshal.Release(iUnknownForObject);
            }
        }
    
        [DllImport("kernel32.dll", CharSet = CharSet.Auto, EntryPoint = "GetModuleHandle")]
        private static extern IntPtr a(string P_0);
    
        [DllImport("kernel32.dll", CharSet = CharSet.Auto, EntryPoint = "LoadLibrary")]
        private static extern IntPtr b(string P_0);    
        
        private static IntPtr d()
        {
            string text = ((IntPtr.Size == 4) ? "Protect544cd51a.dll" : "Protect2a3d628b.dll");
            IntPtr intPtr = a(text);            
            return intPtr;
        }
    
        [DllImport("kernel32.dll", CharSet = CharSet.Ansi, EntryPoint = "GetProcAddress", ExactSpelling = true)]
        private static extern IntPtr e(IntPtr P_0, string P_1);
    
        private static Delegate f(string P_0, Type P_1)
        {
            return Marshal.GetDelegateForFunctionPointer(e(d(), P_0), P_1);
        }
    
        private static bool g(int P_0, IntPtr P_1)
        {
            return ((a)f("P0", typeof(a)))(P_0, P_1);
        }
    
        private static bool h(int P_0, IntPtr P_1)
        {
            return ((a)f("P0", typeof(a)))(P_0, P_1);
        }
    }

And, finally in resources there are those dll files Protect544cd51a.dll and Protect2a3d628b.dll (their content not readable)

I understand that each delegate calls some function like this

    ((a)global::<Module>.Invoke(334))(this, notification);

and then class Module check if system is 32bit or 64bit

and then loads code from Protect544cd51a.dll (32bit) or from Protect2a3d628b.dll (64bit) by the number parameter (334 or 335)

But how can I see the native code, what obfuscator is this? where to dig ?

1 Answer 1

0

You could try dnSpyEx (dnSpyEx) which is a bit more useful for .net binaries than ILSpy.

The dlls mentioned are most likely stored in the resources and you can dump/save them and then analyze the native code with a disassembler such as IDA Pro if the binaries are native or in case the dlls are .net binaries feed them back to dnSpyEx to see what they are doing in the rest of the execution process.

4
  • btw this seems to be Lumma Stealer. Commented May 5 at 11:07
  • Its not stealer, its game bot for multiaccounting. dnSpyEx show the same result as ILSpy
    – Alex
    Commented May 12 at 12:04
  • i downloaded those dlls from resources. They are totally not readable. They contain all code i need, for sure. Is there another ways to explore?
    – Alex
    Commented May 12 at 12:12
  • @Alex the resources (at least the ones I am looking at) looks to be encrypted, you have to look in the code (or debug) in order to see how they are being decrypted/decoded in order to get a valid file to work with that actually contains code. be careful because I see this as being malware in several platforms. I would use a vm. Commented May 12 at 13:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.