在之前介绍Jit层脱壳原理时曾提到两个难点，
1。方法体的局部变量签名。
2。方法体的SEH 异常处理表。

本文主要就第一个问题进行简单探讨，随带也涉及到一些第二个问题。


阅读全文……

Net 内核级的加密保护工具。
采用的是纯虚拟机处理层的内核。

兼容目前所有的32位 .Net 框架版本，Net 1.1, 2.0, 3.0, 3.5 以及其所有子版本（如beta x，CTP，RC，sp x等）。



阅读全文……

应使用者的要求，增加了反制静态编译工具查看程序集完整结构的功能。
当然首当其冲的就是Reflector了。
个人认为，加密最主要的就是加密方法代码，结构啥的并不是重点，
如果是做中间件、类库啥的，结构还非得给用户看不可。



阅读全文……

运行库兼容性更新：

调整了运行库，修正了一处判断DynamicMethod错误的bug。

下载地址：


阅读全文……

一款 .Net 内核级的加密保护工具。

采用的是纯虚拟机处理层的内核。

兼容目前所有的32位 .Net 框架版本，Net 1.1, 2.0, 3.0, 3.5 以及其所有子版本（如beta x，CTP，RC，sp x等）。


阅读全文……

本文将在 .Net 反射脱壳机核心源代码 的基础上介绍，如何实现 Jit层脱壳 机。

首先我们选择使用 C++/CLI 来完成这个工作。反射部分需要用到 。Net的相关类库，jit 层 hook 需要使用native c++ 方面的功能。
本文假设您已经完成了 hook jit的工作，并截获到了相关结构体。



阅读全文……

本文主要介绍一些dotNet加密保护工具的原理以及就其脱壳进行简单探讨。remotesoft protector、maxtocode、.Net Reactor、Cliprotector

、themida .Net、xenocode native compiler、DNGuard。




阅读全文……

In my previous entry on IL modification we looked at the details for inserting a method call with a known (hardcoded) method token. We also used metadata to list the available methods, as a way to avoid this hardcoding.
When listing the methods on a given class, the method signatures were available, but we didn't use them. In this short entry, we'll extend our metadata inspection a little bit by using an existing method's signature to search for another method with a matching signature.
Update: I posted the zipped project.

Using a known signature to find a method


阅读全文……

A couple of days back, we tweaked the running IL a little bit. Today, let's modify it some more!
We'll insert a method call at the beginning of the body of the Main method. The method we'll call is as easy as can be: it is part of the of the same class, is static and has a void() signature.
The IL used during the modification is still hardcoded. But we'll try to start moving away from that by exploring the metadata, to try and find the method token at runtime. The first step of this is to list all the methods on the current class and print out their names, which we'll see how to do.
You'll need a running copy of the DNProfiler tool to try the code provided and I recommend that you read my previous blog on the subject if you haven't used the Profiler APIs before.



阅读全文……

原文出处：http://blog.monstuff.com/

If you remember the Omniscient Debugger, it was a Java debugger that instrumented the bytecode at runtime to trace calls and monitor variables. It did so by using a custom ClassLoader.
Unfortunately the .NET classes that seemed somewhat equivalent to the Java ClassLoader are sealed, so they can't be extended. So, for a while I thought runtime instrumentation of the code wasn't possible in .NET...
A couple weeks later, I stumbled onto the NProf (open-source .NET profiler) project and wondered how they did their magic. It turns out they use the CLR Profiling APIs which are COM based and allow you to hook up into various events and get information on the runtime. It is while digging some more into these that I first found a mention of the intriguing ICorProfilerInfo::SetILFunctionBody method.


阅读全文……