杰晶网络

分析一个.NET CM
破解资源 2024/4/27 佚名
3 2

原文链接：https://www.52pojie.cn/thread-1608459-1-1.html
一、准备工作
目标软件是一个加了VMP并开启虚拟化及代码变异，脱壳过程略，直接看脱壳的结果
分析一个.NET CM

11.png


可以看到关键地方全部被虚拟化了，关于虚拟化处理起来我还没有很好的解决方案
二、去除反调试
timer1里有进程检测反调试，每2秒检测是否包含{“dnSpy”，“de4dot”，“64”，“32”，“ExtremeDumper”}字样，将timer1时钟设置为flase即可关闭检测
分析一个.NET CM

22.png


de4dot直接修改会清除vmp区段，这里我直接跳转到16禁止去c32修改的，将0xC98F6这里修改为0就可以啦
分析一个.NET CM

33.png


三、追码
解决反调试后我找了个软件来帮助解决虚拟化代码的问题，下面贴软件生成的log
[Asm] 纯文本查看 复制代码
2022-03-23 13:19:42.639 +08:00 [INF] VmProtectDumperUnsafeInvoke Prefix:2022-03-23 13:19:42.639 +08:00 [WRN] {2022-03-23 13:19:42.640 +08:00 [VRB]         VMP MethodName: System.Void Crackme.Form1::textBox2_TextChanged(System.Object sender, System.EventArgs e) (MDToken 0x100663302)2022-03-23 13:19:42.640 +08:00 [VRB]         MethodName: Replace2022-03-23 13:19:42.640 +08:00 [VRB]         FullDescription: System.String System.String::Replace(System.String oldValue, System.String newValue)2022-03-23 13:19:42.640 +08:00 [VRB]         MethodType: System.Reflection.RuntimeMethodInfo2022-03-23 13:19:42.640 +08:00 [VRB]         Obj: "D93D3311D3NN2C9D213DC21DR1QD9234"2022-03-23 13:19:42.640 +08:00 [VRB]         Parameter (System.String) [0]: ("0")2022-03-23 13:19:42.640 +08:00 [VRB]         Parameter (System.String) [1]: ("D")2022-03-23 13:19:42.641 +08:00 [VRB]         MDToken: 0x60005422022-03-23 13:19:42.641 +08:00 [VRB]         Return Type: System.String2022-03-23 13:19:42.641 +08:00 [INF] VmProtectDumperUnsafeInvoke Result:2022-03-23 13:19:42.641 +08:00 [VRB]         Returns: D93D3311D3NN2C9D213DC21DR1QD92342022-03-23 13:19:42.641 +08:00 [WRN] }2022-03-23 13:19:42.641 +08:00 [INF] VmProtectDumperUnsafeInvoke Prefix:2022-03-23 13:19:42.641 +08:00 [WRN] {2022-03-23 13:19:42.641 +08:00 [VRB]         VMP MethodName: System.Void Crackme.Form1::textBox2_TextChanged(System.Object sender, System.EventArgs e) (MDToken 0x100663302)2022-03-23 13:19:42.641 +08:00 [VRB]         MethodName: Replace2022-03-23 13:19:42.641 +08:00 [VRB]         FullDescription: System.String System.String::Replace(System.String oldValue, System.String newValue)2022-03-23 13:19:42.641 +08:00 [VRB]         MethodType: System.Reflection.RuntimeMethodInfo2022-03-23 13:19:42.641 +08:00 [VRB]         Obj: "D93D3311D3NN2C9D213DC21DR1QD9234"2022-03-23 13:19:42.641 +08:00 [VRB]         Parameter (System.String) [0]: ("8")2022-03-23 13:19:42.641 +08:00 [VRB]         Parameter (System.String) [1]: ("C")2022-03-23 13:19:42.641 +08:00 [VRB]         MDToken: 0x60005422022-03-23 13:19:42.642 +08:00 [VRB]         Return Type: System.String2022-03-23 13:19:42.642 +08:00 [INF] VmProtectDumperUnsafeInvoke Result:2022-03-23 13:19:42.642 +08:00 [VRB]         Returns: D93D3311D3NN2C9D213DC21DR1QD92342022-03-23 13:19:42.642 +08:00 [WRN] }2022-03-23 13:19:42.642 +08:00 [INF] VmProtectDumperUnsafeInvoke Prefix:2022-03-23 13:19:42.642 +08:00 [WRN] {2022-03-23 13:19:42.642 +08:00 [VRB]         VMP MethodName: System.Void Crackme.Form1::textBox2_TextChanged(System.Object sender, System.EventArgs e) (MDToken 0x100663302)2022-03-23 13:19:42.642 +08:00 [VRB]         MethodName: Replace2022-03-23 13:19:42.642 +08:00 [VRB]         FullDescription: System.String System.String::Replace(System.String oldValue, System.String newValue)2022-03-23 13:19:42.643 +08:00 [VRB]         MethodType: System.Reflection.RuntimeMethodInfo2022-03-23 13:19:42.643 +08:00 [VRB]         Obj: "D93D3311D3NN2C9D213DC21DR1QD9234"2022-03-23 13:19:42.643 +08:00 [VRB]         Parameter (System.String) [0]: ("7")2022-03-23 13:19:42.643 +08:00 [VRB]         Parameter (System.String) [1]: ("N")2022-03-23 13:19:42.643 +08:00 [VRB]         MDToken: 0x60005422022-03-23 13:19:42.643 +08:00 [VRB]         Return Type: System.String2022-03-23 13:19:42.643 +08:00 [INF] VmProtectDumperUnsafeInvoke Result:2022-03-23 13:19:42.643 +08:00 [VRB]         Returns: D93D3311D3NN2C9D213DC21DR1QD92342022-03-23 13:19:42.643 +08:00 [WRN] }2022-03-23 13:19:42.643 +08:00 [INF] VmProtectDumperUnsafeInvoke Prefix:2022-03-23 13:19:42.643 +08:00 [WRN] {2022-03-23 13:19:42.643 +08:00 [VRB]         VMP MethodName: System.Void Crackme.Form1::textBox2_TextChanged(System.Object sender, System.EventArgs e) (MDToken 0x100663302)2022-03-23 13:19:42.643 +08:00 [VRB]         MethodName: Replace2022-03-23 13:19:42.643 +08:00 [VRB]         FullDescription: System.String System.String::Replace(System.String oldValue, System.String newValue)2022-03-23 13:19:42.643 +08:00 [VRB]         MethodType: System.Reflection.RuntimeMethodInfo2022-03-23 13:19:42.643 +08:00 [VRB]         Obj: "D93D3311D3NN2C9D213DC21DR1QD9234"2022-03-23 13:19:42.644 +08:00 [VRB]         Parameter (System.String) [0]: ("5")2022-03-23 13:19:42.644 +08:00 [VRB]         Parameter (System.String) [1]: ("Q")2022-03-23 13:19:42.644 +08:00 [VRB]         MDToken: 0x60005422022-03-23 13:19:42.644 +08:00 [VRB]         Return Type: System.String2022-03-23 13:19:42.644 +08:00 [INF] VmProtectDumperUnsafeInvoke Result:2022-03-23 13:19:42.644 +08:00 [VRB]         Returns: D93D3311D3NN2C9D213DC21DR1QD92342022-03-23 13:19:42.644 +08:00 [WRN] }2022-03-23 13:19:42.644 +08:00 [INF] VmProtectDumperUnsafeInvoke Prefix:2022-03-23 13:19:42.644 +08:00 [WRN] {2022-03-23 13:19:42.644 +08:00 [VRB]         VMP MethodName: System.Void Crackme.Form1::textBox2_TextChanged(System.Object sender, System.EventArgs e) (MDToken 0x100663302)2022-03-23 13:19:42.644 +08:00 [VRB]         MethodName: Replace2022-03-23 13:19:42.644 +08:00 [VRB]         FullDescription: System.String System.String::Replace(System.String oldValue, System.String newValue)2022-03-23 13:19:42.644 +08:00 [VRB]         MethodType: System.Reflection.RuntimeMethodInfo2022-03-23 13:19:42.644 +08:00 [VRB]         Obj: "D93D3311D3NN2C9D213DC21DR1QD9234"2022-03-23 13:19:42.644 +08:00 [VRB]         Parameter (System.String) [0]: ("6")2022-03-23 13:19:42.645 +08:00 [VRB]         Parameter (System.String) [1]: ("R")2022-03-23 13:19:42.645 +08:00 [VRB]         MDToken: 0x60005422022-03-23 13:19:42.645 +08:00 [VRB]         Return Type: System.String2022-03-23 13:19:42.645 +08:00 [INF] VmProtectDumperUnsafeInvoke Result:2022-03-23 13:19:42.645 +08:00 [VRB]         Returns: D93D3311D3NN2C9D213DC21DR1QD92342022-03-23 13:19:42.645 +08:00 [WRN] }2022-03-23 13:19:42.645 +08:00 [INF] VmProtectDumperUnsafeInvoke Prefix:2022-03-23 13:19:42.645 +08:00 [WRN] {2022-03-23 13:19:42.645 +08:00 [VRB]         VMP MethodName: System.Void Crackme.Form1::textBox2_TextChanged(System.Object sender, System.EventArgs e) (MDToken 0x100663302)2022-03-23 13:19:42.645 +08:00 [VRB]         MethodName: Replace2022-03-23 13:19:42.645 +08:00 [VRB]         FullDescription: System.String System.String::Replace(System.String oldValue, System.String newValue)2022-03-23 13:19:42.645 +08:00 [VRB]         MethodType: System.Reflection.RuntimeMethodInfo2022-03-23 13:19:42.645 +08:00 [VRB]         Obj: "D93D3311D3NN2C9D213DC21DR1QD9234"2022-03-23 13:19:42.645 +08:00 [VRB]         Parameter (System.String) [0]: ("L")2022-03-23 13:19:42.645 +08:00 [VRB]         Parameter (System.String) [1]: ("4")2022-03-23 13:19:42.646 +08:00 [VRB]         MDToken: 0x60005422022-03-23 13:19:42.646 +08:00 [VRB]         Return Type: System.String2022-03-23 13:19:42.646 +08:00 [INF] VmProtectDumperUnsafeInvoke Result:2022-03-23 13:19:42.646 +08:00 [VRB]         Returns: D93D3311D3NN2C9D213DC21DR1QD92342022-03-23 13:19:42.646 +08:00 [WRN] }2022-03-23 13:19:42.646 +08:00 [INF] VmProtectDumperUnsafeInvoke Prefix:2022-03-23 13:19:42.646 +08:00 [WRN] {2022-03-23 13:19:42.646 +08:00 [VRB]         VMP MethodName: System.Void Crackme.Form1::textBox2_TextChanged(System.Object sender, System.EventArgs e) (MDToken 0x100663302)2022-03-23 13:19:42.646 +08:00 [VRB]         MethodName: Replace2022-03-23 13:19:42.646 +08:00 [VRB]         FullDescription: System.String System.String::Replace(System.String oldValue, System.String newValue)2022-03-23 13:19:42.646 +08:00 [VRB]         MethodType: System.Reflection.RuntimeMethodInfo2022-03-23 13:19:42.646 +08:00 [VRB]         Obj: "D93D3311D3NN2C9D213DC21DR1QD9234"2022-03-23 13:19:42.646 +08:00 [VRB]         Parameter (System.String) [0]: ("A")2022-03-23 13:19:42.646 +08:00 [VRB]         Parameter (System.String) [1]: ("2")2022-03-23 13:19:42.646 +08:00 [VRB]         MDToken: 0x60005422022-03-23 13:19:42.647 +08:00 [VRB]         Return Type: System.String2022-03-23 13:19:42.647 +08:00 [INF] VmProtectDumperUnsafeInvoke Result:2022-03-23 13:19:42.647 +08:00 [VRB]         Returns: D93D3311D3NN2C9D213DC21DR1QD92342022-03-23 13:19:42.647 +08:00 [WRN] }2022-03-23 13:19:42.647 +08:00 [INF] VmProtectDumperUnsafeInvoke Prefix:2022-03-23 13:19:42.647 +08:00 [WRN] {2022-03-23 13:19:42.647 +08:00 [VRB]         VMP MethodName: System.Void Crackme.Form1::textBox2_TextChanged(System.Object sender, System.EventArgs e) (MDToken 0x100663302)2022-03-23 13:19:42.647 +08:00 [VRB]         MethodName: Replace2022-03-23 13:19:42.647 +08:00 [VRB]         FullDescription: System.String System.String::Replace(System.String oldValue, System.String newValue)2022-03-23 13:19:42.647 +08:00 [VRB]         MethodType: System.Reflection.RuntimeMethodInfo2022-03-23 13:19:42.647 +08:00 [VRB]         Obj: "D93D3311D3NN2C9D213DC21DR1QD9234"2022-03-23 13:19:42.647 +08:00 [VRB]         Parameter (System.String) [0]: ("B")2022-03-23 13:19:42.647 +08:00 [VRB]         Parameter (System.String) [1]: ("3")2022-03-23 13:19:42.647 +08:00 [VRB]         MDToken: 0x60005422022-03-23 13:19:42.647 +08:00 [VRB]         Return Type: System.String2022-03-23 13:19:42.648 +08:00 [INF] VmProtectDumperUnsafeInvoke Result:2022-03-23 13:19:42.648 +08:00 [VRB]         Returns: D93D3311D3NN2C9D213DC21DR1QD92342022-03-23 13:19:42.648 +08:00 [WRN] }2022-03-23 13:19:42.648 +08:00 [INF] VmProtectDumperUnsafeInvoke Prefix:2022-03-23 13:19:42.648 +08:00 [WRN] {2022-03-23 13:19:42.648 +08:00 [VRB]         VMP MethodName: System.Void Crackme.Form1::textBox2_TextChanged(System.Object sender, System.EventArgs e) (MDToken 0x100663302)2022-03-23 13:19:42.648 +08:00 [VRB]         MethodName: Replace2022-03-23 13:19:42.648 +08:00 [VRB]         FullDescription: System.String System.String::Replace(System.String oldValue, System.String newValue)2022-03-23 13:19:42.648 +08:00 [VRB]         MethodType: System.Reflection.RuntimeMethodInfo2022-03-23 13:19:42.648 +08:00 [VRB]         Obj: "D93D3311D3NN2C9D213DC21DR1QD9234"2022-03-23 13:19:42.648 +08:00 [VRB]         Parameter (System.String) [0]: ("E")2022-03-23 13:19:42.648 +08:00 [VRB]         Parameter (System.String) [1]: ("0")2022-03-23 13:19:42.648 +08:00 [VRB]         MDToken: 0x60005422022-03-23 13:19:42.648 +08:00 [VRB]         Return Type: System.String2022-03-23 13:19:42.649 +08:00 [INF] VmProtectDumperUnsafeInvoke Result:2022-03-23 13:19:42.649 +08:00 [VRB]         Returns: D93D3311D3NN2C9D213DC21DR1QD92342022-03-23 13:19:42.649 +08:00 [WRN] }2022-03-23 13:19:42.649 +08:00 [INF] VmProtectDumperUnsafeInvoke Prefix:2022-03-23 13:19:42.649 +08:00 [WRN] {2022-03-23 13:19:42.649 +08:00 [VRB]         VMP MethodName: System.Void Crackme.Form1::textBox2_TextChanged(System.Object sender, System.EventArgs e) (MDToken 0x100663302)2022-03-23 13:19:42.649 +08:00 [VRB]         MethodName: Replace2022-03-23 13:19:42.649 +08:00 [VRB]         FullDescription: System.String System.String::Replace(System.String oldValue, System.String newValue)2022-03-23 13:19:42.649 +08:00 [VRB]         MethodType: System.Reflection.RuntimeMethodInfo2022-03-23 13:19:42.649 +08:00 [VRB]         Obj: "D93D3311D3NN2C9D213DC21DR1QD9234"2022-03-23 13:19:42.649 +08:00 [VRB]         Parameter (System.String) [0]: ("F")2022-03-23 13:19:42.649 +08:00 [VRB]         Parameter (System.String) [1]: ("1")2022-03-23 13:19:42.649 +08:00 [VRB]         MDToken: 0x60005422022-03-23 13:19:42.649 +08:00 [VRB]         Return Type: System.String2022-03-23 13:19:42.649 +08:00 [INF] VmProtectDumperUnsafeInvoke Result:2022-03-23 13:19:42.650 +08:00 [VRB]         Returns: D93D3311D3NN2C9D213DC21DR1QD92342022-03-23 13:19:42.650 +08:00 [WRN] }2022-03-23 13:19:42.650 +08:00 [INF] VmProtectDumperUnsafeInvoke Prefix:2022-03-23 13:19:42.650 +08:00 [WRN] {2022-03-23 13:19:42.650 +08:00 [VRB]         VMP MethodName: System.Void Crackme.Form1::textBox2_TextChanged(System.Object sender, System.EventArgs e) (MDToken 0x100663302)2022-03-23 13:19:42.650 +08:00 [VRB]         MethodName: Replace2022-03-23 13:19:42.650 +08:00 [VRB]         FullDescription: System.String System.String::Replace(System.String oldValue, System.String newValue)2022-03-23 13:19:42.650 +08:00 [VRB]         MethodType: System.Reflection.RuntimeMethodInfo2022-03-23 13:19:42.650 +08:00 [VRB]         Obj: "D93D3311D3NN2C9D213DC21DR1QD9234"2022-03-23 13:19:42.650 +08:00 [VRB]         Parameter (System.String) [0]: ("M")2022-03-23 13:19:42.650 +08:00 [VRB]         Parameter (System.String) [1]: ("9")2022-03-23 13:19:42.651 +08:00 [VRB]         MDToken: 0x60005422022-03-23 13:19:42.651 +08:00 [VRB]         Return Type: System.String2022-03-23 13:19:42.651 +08:00 [INF] VmProtectDumperUnsafeInvoke Result:2022-03-23 13:19:42.651 +08:00 [VRB]         Returns: D93D3311D3NN2C9D213DC21DR1QD92342022-03-23 13:19:42.651 +08:00 [WRN] }2022-03-23 13:19:42.651 +08:00 [INF] VmProtectDumperUnsafeInvoke Prefix:2022-03-23 13:19:42.651 +08:00 [WRN] {2022-03-23 13:19:42.651 +08:00 [VRB]         VMP MethodName: System.Void Crackme.Form1::textBox2_TextChanged(System.Object sender, System.EventArgs e) (MDToken 0x100663302)2022-03-23 13:19:42.651 +08:00 [VRB]         MethodName: ToArray2022-03-23 13:19:42.651 +08:00 [VRB]         FullDescription: static System.Char[] System.Linq.Enumerable::ToArray(System.Collections.Generic.IEnumerable`1<System.Char> source)2022-03-23 13:19:42.651 +08:00 [VRB]         MethodType: System.Reflection.RuntimeMethodInfo2022-03-23 13:19:42.651 +08:00 [VRB]         Parameter (System.String) [0]: ("D93D3311D3NN2C9D213DC21DR1QD9234")2022-03-23 13:19:42.651 +08:00 [VRB]         MDToken: 0x6000B6F2022-03-23 13:19:42.651 +08:00 [VRB]         Return Type: System.Char[]2022-03-23 13:19:42.652 +08:00 [INF] VmProtectDumperUnsafeInvoke Result:2022-03-23 13:19:42.652 +08:00 [VRB]         Returns: ["D","9","3","D","3","3","1","1","D","3","N","N","2","C","9","D","2","1","3","D","C","2","1","D","R","1","Q","D","9","2","3","4"]2022-03-23 13:19:42.652 +08:00 [WRN] }2022-03-23 13:19:42.652 +08:00 [INF] VmProtectDumperUnsafeInvoke Prefix:2022-03-23 13:19:42.652 +08:00 [WRN] {2022-03-23 13:19:42.652 +08:00 [VRB]         VMP MethodName: System.Void Crackme.Form1::textBox2_TextChanged(System.Object sender, System.EventArgs e) (MDToken 0x100663302)2022-03-23 13:19:42.652 +08:00 [VRB]         MethodName: get_Length2022-03-23 13:19:42.652 +08:00 [VRB]         FullDescription: System.Int32 System.String::get_Length()2022-03-23 13:19:42.652 +08:00 [VRB]         MethodType: System.Reflection.RuntimeMethodInfo2022-03-23 13:19:42.652 +08:00 [VRB]         Obj: "D93D3311D3NN2C9D213DC21DR1QD9234"2022-03-23 13:19:42.653 +08:00 [VRB]         MDToken: 0x60004D22022-03-23 13:19:42.653 +08:00 [VRB]         Return Type: System.Int322022-03-23 13:19:42.653 +08:00 [INF] VmProtectDumperUnsafeInvoke Result:2022-03-23 13:19:42.653 +08:00 [VRB]         Returns: 322022-03-23 13:19:42.653 +08:00 [WRN] }2022-03-23 13:19:42.653 +08:00 [INF] VmProtectDumperUnsafeInvoke Prefix:2022-03-23 13:19:42.653 +08:00 [WRN] {2022-03-23 13:19:42.653 +08:00 [VRB]         VMP MethodName: System.Void Crackme.Form1::textBox2_TextChanged(System.Object sender, System.EventArgs e) (MDToken 0x100663302)2022-03-23 13:19:42.653 +08:00 [VRB]         MethodName: smethod_02022-03-23 13:19:42.653 +08:00 [VRB]         FullDescription: static System.Void 7B4E5853::smethod_0(System.Array array_0, System.Int32 int_0, System.Int32 int_1)2022-03-23 13:19:42.653 +08:00 [VRB]         MethodType: System.Reflection.RuntimeMethodInfo2022-03-23 13:19:42.653 +08:00 [VRB]         Parameter (System.Char[]) [0]: (Char[] {D, 9, 3, D, 3, 3, 1, 1, D, 3, N, N, 2, C, 9, D, 2, 1, 3, D, C, 2, 1, D, R, 1, Q, D, 9, 2, 3, 4})2022-03-23 13:19:42.653 +08:00 [VRB]         Parameter (System.Int32) [1]: (0)2022-03-23 13:19:42.653 +08:00 [VRB]         Parameter (System.Int32) [2]: (32)2022-03-23 13:19:42.654 +08:00 [VRB]         MDToken: 0x60000942022-03-23 13:19:42.654 +08:00 [VRB]         Return Type: System.Void2022-03-23 13:19:42.654 +08:00 [INF] VmProtectDumperUnsafeInvoke Result:2022-03-23 13:19:42.654 +08:00 [VRB]         Returns: null2022-03-23 13:19:42.654 +08:00 [WRN] }2022-03-23 13:19:42.654 +08:00 [INF] VmProtectDumperUnsafeInvoke Prefix:2022-03-23 13:19:42.654 +08:00 [WRN] {2022-03-23 13:19:42.654 +08:00 [VRB]         VMP MethodName: System.Void Crackme.Form1::textBox2_TextChanged(System.Object sender, System.EventArgs e) (MDToken 0x100663302)2022-03-23 13:19:42.654 +08:00 [VRB]         MethodName: smethod_02022-03-23 13:19:42.654 +08:00 [VRB]         FullDescription: static System.Object 37891AB0::smethod_0()2022-03-23 13:19:42.654 +08:00 [VRB]         MethodType: System.Reflection.RuntimeMethodInfo2022-03-23 13:19:42.654 +08:00 [VRB]         MDToken: 0x60000492022-03-23 13:19:42.654 +08:00 [VRB]         Return Type: System.Object2022-03-23 13:19:42.654 +08:00 [INF] VmProtectDumperUnsafeInvoke Result:2022-03-23 13:19:42.654 +08:00 [VRB]         Returns: 2022-03-23 13:19:42.655 +08:00 [WRN] }2022-03-23 13:19:42.657 +08:00 [INF] VmProtectDumperUnsafeInvoke Prefix:2022-03-23 13:19:42.657 +08:00 [WRN] {2022-03-23 13:19:42.657 +08:00 [VRB]         VMP MethodName: System.Void Crackme.Form1::textBox2_TextChanged(System.Object sender, System.EventArgs e) (MDToken 0x100663302)2022-03-23 13:19:42.657 +08:00 [VRB]         MethodName: smethod_02022-03-23 13:19:42.657 +08:00 [VRB]         FullDescription: static System.Text.StringBuilder 1C814297::smethod_0(System.Object object_0, System.Char[] char_0)2022-03-23 13:19:42.657 +08:00 [VRB]         MethodType: System.Reflection.RuntimeMethodInfo2022-03-23 13:19:42.658 +08:00 [VRB]         Parameter (System.Text.StringBuilder) [0]: ()2022-03-23 13:19:42.658 +08:00 [VRB]         Parameter (System.Char[]) [1]: (Char[] {4, 3, 2, 9, D, Q, 1, R, D, 1, 2, C, D, 3, 1, 2, D, 9, C, 2, N, N, 3, D, 1, 1, 3, 3, D, 3, 9, D})2022-03-23 13:19:42.658 +08:00 [VRB]         MDToken: 0x60000402022-03-23 13:19:42.658 +08:00 [VRB]         Return Type: System.Text.StringBuilder2022-03-23 13:19:42.658 +08:00 [INF] VmProtectDumperUnsafeInvoke Result:2022-03-23 13:19:42.658 +08:00 [VRB]         Returns: 4329DQ1RD12CD312D9C2NN3D1133D39D2022-03-23 13:19:42.658 +08:00 [WRN] }2022-03-23 13:19:42.658 +08:00 [INF] VmProtectDumperUnsafeInvoke Prefix:2022-03-23 13:19:42.658 +08:00 [WRN] {2022-03-23 13:19:42.659 +08:00 [VRB]         VMP MethodName: System.Void Crackme.Form1::textBox2_TextChanged(System.Object sender, System.EventArgs e) (MDToken 0x100663302)2022-03-23 13:19:42.659 +08:00 [VRB]         MethodName: ToString2022-03-23 13:19:42.659 +08:00 [VRB]         FullDescription: virtual System.String System.Object::ToString()2022-03-23 13:19:42.659 +08:00 [VRB]         MethodType: System.Reflection.RuntimeMethodInfo2022-03-23 13:19:42.659 +08:00 [VRB]         Obj: 4329DQ1RD12CD312D9C2NN3D1133D39D2022-03-23 13:19:42.659 +08:00 [VRB]         MDToken: 0x600022A2022-03-23 13:19:42.659 +08:00 [VRB]         Return Type: System.String2022-03-23 13:19:42.659 +08:00 [INF] VmProtectDumperUnsafeInvoke Result:2022-03-23 13:19:42.659 +08:00 [VRB]         Returns: 4329DQ1RD12CD312D9C2NN3D1133D39D2022-03-23 13:19:42.659 +08:00 [WRN] }2022-03-23 13:19:42.659 +08:00 [INF] VmProtectDumperUnsafeInvoke Prefix:2022-03-23 13:19:42.659 +08:00 [WRN] {2022-03-23 13:19:42.659 +08:00 [VRB]         VMP MethodName: System.Void Crackme.Form1::textBox2_TextChanged(System.Object sender, System.EventArgs e) (MDToken 0x100663302)2022-03-23 13:19:42.660 +08:00 [VRB]         MethodName: smethod_02022-03-23 13:19:42.660 +08:00 [VRB]         FullDescription: static System.String 680A5711::smethod_0(System.Object object_0)2022-03-23 13:19:42.660 +08:00 [VRB]         MethodType: System.Reflection.RuntimeMethodInfo2022-03-23 13:19:42.660 +08:00 [VRB]         Parameter (System.Windows.Forms.TextBox) [0]: (System.Windows.Forms.TextBox, Text: 1245)2022-03-23 13:19:42.660 +08:00 [VRB]         MDToken: 0x60000222022-03-23 13:19:42.660 +08:00 [VRB]         Return Type: System.String2022-03-23 13:19:42.660 +08:00 [INF] VmProtectDumperUnsafeInvoke Result:2022-03-23 13:19:42.660 +08:00 [VRB]         Returns: 12452022-03-23 13:19:42.660 +08:00 [WRN] }2022-03-23 13:19:42.660 +08:00 [INF] VmProtectDumperUnsafeInvoke Prefix:2022-03-23 13:19:42.660 +08:00 [WRN] {2022-03-23 13:19:42.660 +08:00 [VRB]         VMP MethodName: System.Void Crackme.Form1::textBox2_TextChanged(System.Object sender, System.EventArgs e) (MDToken 0x100663302)2022-03-23 13:19:42.660 +08:00 [VRB]         MethodName: smethod_02022-03-23 13:19:42.660 +08:00 [VRB]         FullDescription: static System.Boolean 094923F6::smethod_0(System.String string_0, System.String string_1)2022-03-23 13:19:42.661 +08:00 [VRB]         MethodType: System.Reflection.RuntimeMethodInfo2022-03-23 13:19:42.661 +08:00 [VRB]         Parameter (System.String) [0]: ("1245")2022-03-23 13:19:42.661 +08:00 [VRB]         Parameter (System.String) [1]: ("4329DQ1RD12CD312D9C2NN3D1133D39D")2022-03-23 13:19:42.661 +08:00 [VRB]         MDToken: 0x600003A2022-03-23 13:19:42.661 +08:00 [VRB]         Return Type: System.Boolean2022-03-23 13:19:42.661 +08:00 [INF] VmProtectDumperUnsafeInvoke Result:2022-03-23 13:19:42.661 +08:00 [VRB]         Returns: false2022-03-23 13:19:42.661 +08:00 [WRN] }

我的机器码为4B29D5F6EFA8EB1AE98277BE1FB30B90，此时正确的key为D93D3311D3NN2C9D213DC21DR1QD9234
分析一个.NET CM

44.png


四、分析算法
借助于软件的log分析起来应该不难，直接贴注册机成品算法了
首先是机器码的算法
[C#] 纯文本查看 复制代码
                public string doIt()                {                                                string text = null;                        foreach (ManagementBaseObject managementBaseObject in new ManagementClass("Win32_NetworkAdapterConfiguration").GetInstances())                        {                                ManagementObject managementObject = (ManagementObject)managementBaseObject;                                if (Convert.ToBoolean(managementObject["IPEnabled"]))                                {                                        text = managementObject["MacAddress"].ToString();                                        text = text.Replace(':', '-');                                }                                managementObject.Dispose();                        }                        return text;                }                public string run(string str)                {                        return BitConverter.ToString(new MD5CryptoServiceProvider().ComputeHash(Encoding.UTF8.GetBytes(str))).Replace("-", "");                }                                private void Form1_Load(object sender, EventArgs e)        {                        textBox1.Text = run(doIt().Replace("-", ""));                }

下面是注册机的算法
[C#] 纯文本查看 复制代码
   private void button1_Click(object sender, EventArgs e)        {                        string text;                        text = textBox1.Text.Replace("0","D");                        text = text.Replace("8", "C");                        text = text.Replace("7", "N");                        text = text.Replace("5", "Q");                        text = text.Replace("6", "R");                        text = text.Replace("L", "4");                        text = text.Replace("A", "2");                        text = text.Replace("B", "3");                        text = text.Replace("E", "0");                        text = text.Replace("F", "1");                        text = text.Replace("M", "9");                        textBox2.Text = ReverseA(text);        }                public string ReverseA(string text)                {                        char[] cArray = text.ToCharArray();                        string reverse = String.Empty;                        for (int i = cArray.Length - 1; i > -1; i--)                        {                                reverse += cArray[i];                        }                        return reverse;                }

完活@Domado

标签：
分析一个.NET CM
免责声明：本站文章均来自网站采集或用户投稿，网站不提供任何软件下载或自行开发的软件！ 如有用户或公司发现本站内容信息存在侵权行为，请邮件告知！ 858582#qq.com
评论“分析一个.NET CM”
暂无“分析一个.NET CM”评论...
www.imxmx.com 杰晶网络
8,675无损音乐
1,324高清电影
213破解软件
120,141站长资源
一句话新闻
苹果官宣WWDC 2024！预计会有大批AI功能 - 2024/4/27

3月27日消息，苹果宣布2024年全球开发者大会（WWDC）将于6月10日至6月14日举行，巧合的是，这次大会与端午假期重合。

苹果官方表示：

在线参加 Apple 每年规模最大的开发者盛会。亲眼见证 Apple 最新平台、技术和工具的发布。了解如何创建和改进你的 App 和游戏。与 Apple 设计师和工程师互动交流，与全球开发者社区建立联系。以上活动均免费在线举行。

探索各种新的工具、框架和功能，助力你打造出理想的 App 和游戏。通过视频讲座学习新技能，与 Apple 专家进行一对一会面，以推进你的项目，完善你的构思。

Swift Student Challenge 旨在支持和鼓舞下一代开发者、创作者和企业家。太平洋时间 3 月 28 日，我们将公布今年的获奖者名单。获奖者将有资格参加在 Apple Park 举办的特别活动。我们还会选出 50 名杰出获胜者，他们将受邀前往库比提诺，获得为期三天的非凡体验，包括参加 Apple Park 的特别活动。

RTX 5090要首发 性能要翻倍！三星展示GDDR7显存

三星在GTC上展示了专为下一代游戏GPU设计的GDDR7内存。

首次推出的GDDR7内存模块密度为16GB，每个模块容量为2GB。其速度预设为32 Gbps（PAM3），但也可以降至28 Gbps，以提高产量和初始阶段的整体性能和成本效益。

据三星表示，GDDR7内存的能效将提高20%，同时工作电压仅为1.1V，低于标准的1.2V。通过采用更新的封装材料和优化的电路设计，使得在高速运行时的发热量降低，GDDR7的热阻比GDDR6降低了70%。

更新动态

友情链接

杰晶网络 DDR爱好者之家 南强小屋 黑松山资源网 白云城资源网 更多链接