sipoc.netlify.app

Babel Obfuscator 6 Cracker Barrel

1. Babel Obfuscator is a powerful tool that helps you protect.NET assemblies against having their code stolen or reverse engineered. It does that using the typical protection method of obfuscating the code and making it unreadable to people.
2. Difficulty: 1Language:.NETPlatform: WindowsOS Version: Windows 7Packer / Protector: Babel Obfuscator 8.3 Description: UnPackMe and crackme very easy.

Savoritz 6 Cracker

Introduction

Managed code, unlike native code, has been known to be easily decompiled to its source code, easing its reverse engineering, thus giving the need to what we call obfuscation. We change the managed code after compiling it in a way that makes decompilers obsolete and makes decompiling it useless, as the decompilation will generate garbage code that can’t be understood or compiled again after modifying it. Obfuscation is mostly done with renaming the names of classes, methods, and variables into random names, rendering it unreadable when it’s decompiled, and in the case of some obfuscators, the output obfuscated application, when decompiled, generates a code that gives build errors when being compiled again. But although obfuscation sometimes proves to be efficient, it has major weaknesses and limitations that makes relying on it is not a good decision.

For the sake of demonstration, in this article, I’m going to use C# as my managed code language, and the preemptive Dotfuscator that comes as a community edition with Microsoft Visual Studio will be my obfuscation tool.

The example

Say, we have this application that checks if the user is authenticated or not before doing an action:

When we obfuscate this code and try to decompile it, we get (I use Lutz reflector to do the decompile):

As it’s obvious, most of the code has been renamed, but the message strings are untouched. Also, the .NET framework has used classes and methods like the MessageBox class and the Show() method which are still not renamed, which is a big problem. Compiling the resulting code from decompiling the obfuscated code might result in build time errors because the obfuscated code might have the same names for the methods and classes, but this isn’t the same for IL (Intermediate Language). So, if we simply used ildasm to disassemble the EXE for this application, we will get this:

As we can see, again, our message strings are written in plain text. So are the used .NET framework namespaces. And here comes our message box again: System.Windows.Forms.MessageBox::Show(string). Dress up halloween games for girls.

So, what is the problem in this? The problem is that the old cracking techniques that were used with Win32 applications can still be applied to .NET assemblies very easily. So, if I’m an experienced cracker, I would disassemble this application into IL and search for the “invalid credentials” string that shows in my face every time I write in an invalid password, and look up a few lines till I find the branching statement at line IL_0006, and very easily, I could brfalse to brtrue and build the application using ILAsm.

So next time I run the newly built application, I supply an invalid user name and password, and I will get the welcome message saying “access granted” instead of being kicked out. And as it’s very obvious, the same can be applied for cracking license keys and similar stuff.

But that was because my current obfuscation tool didn’t obfuscate the messages strings, right? What if we obfuscate every available string in my application? I will be doing this using the evaluation version of Dotfuscator which has a feature called “string encryption”, which I personally don’t consider encryption, rather encoding or obfuscation, because you can’t encrypt things and supply the encryption algorithm and key with it. So, here is the disassembled code after the string obfuscation:

Note: the “eval” prefix is because I’m using an evaluation version of the Dotfuscator.

As we can see, all of the strings have been obfuscated, but still all the .NET framework used class and method names are still in plain text and readable to anyone, and that is because you can obfuscate anything but the .NET framework namespaces, classes, and methods. This is because if you obfuscated their names, how are you going to call them on your user machine?

Again, if I’m an experienced cracker and I know what I’m looking for, I will be looking for the most rare .NET framework methods and classes that have been called within this application. For example, the MessageBox is a very good example. Also, the Form::Close() is another good option. I would search for them in the new IL, and again look up for a few lines searching for the branching statement till I find it at line IL_000f, and again, I will change it from brfalse to brtrue and build my application again using ILAsm. When I run it, I will get another access granted message, and as you can see, it took me only 5 minutes.

But, that is because the application flow is so clear and it wasn’t obfuscated, right? What if we obfuscate the application flow too using the “Control Flow Obfuscation” feature in Dotfuscator? The output IL is going to look like this:

There are lots of branches, but with a bare eye inspection, all of them are pointing to other branches that again are pointing to others till they reach a real branch. Also, with a bare eye inspection, none of them have a condition - they just branch. So it would be very easy to spot the real branch that we are seeking at line IL_000f, and do the same again by changing the condition from false to true, and build the application, and again we will get the previous result.

But that is because the code isn’t complex enough. What if we make the code a little bit more complex and use the previous way to obfuscate it?

A code that looks like this:

would look like this after disassembling:

This time, it’s harder to crack, but with a bare eye inspection, we can see there are only two conditional branches at lines IL_000f and IL_0017, before where I found the Form::Close() method. I can try my luck with them, or I would just change the first one before where I found the Form::Close() method and the MessageBox::Show(string) method, and build the application again and again until I get another access granted message.

Babel Obfuscator 6 Crackers

So, what is the conclusion?

Conclusion

Babel Obfuscator 6 Crackers

Well, obfuscation is a good way to protect our intellectual properties and it’s better than just leaving our confidential information in plain text. But, as I’ve just demonstrated through this article, we can’t rely on obfuscation to protect our applications as it’s easy to crack any application that is relying only on obfuscation for protection. And I did that without any special tools, and in only a few minutes.

Thanks for reading, and I’m waiting for your comments and feedback.

Savoritz 6 Cracker Assortment