Some NET questions

Issues related to VMProtect
Post Reply
AusterX
Posts: 19
Joined: Sun Mar 05, 2023 9:29 am

Some NET questions

Post by AusterX »

Hello,
i've some questions about NET, sorry if i'm not a superskilled coder.
1) i use obfuscation attributes directly in src code, in VMP gui i just load a basic .vmp project file with only global settings in it (in which i see by default a VMComplexity="20")
Is there a way to change the VM complexity directly inside the obfuscation attribute for just that piece of code covered by that attribute?

1b) In VMP gui under options, there are greyed out settings like VM version = default and Instances=default and Complexity=None, but in the .vmp file there is a global VMComplexity="20". These gui settings are actually only for native code and not NET?

2) "renaming" attribute gets effects only if VMP project has "strip debug information" enabled, which is fine for me, even if i loose excemption messages, anyway question is: methods name are really randomized, or an eventual cracker can recover back the original names?
In other words: should i better rename methods like sha256hash(data) to guesswhat(data)? Question came in mind because i saw some serialization library which uses reflection (system.text.jason, messagepack...) cannot work with renamed structs/classes (different name every VMP compile), instead an enum.ToString() reports the correct enum name, even if renaming is enabled.

2b) So... really no way to get back an human readable excemption message?

Thanks for any info
Admin
Site Admin
Posts: 2566
Joined: Mon Aug 21, 2006 8:19 pm
Location: Russia, E-burg
Contact:

Re: Some NET questions

Post by Admin »

1. The Virtual Machine properties don't affect to .NET applications, so they are disabled.
2. New names are really randomized and a cracker is unable to get the original names. About names that used in reflection - VMProtect has heuristic algorithms that help to exclude such names from renaming automatically (without additional obfuscation attributes). Anyway, there is no way to show readable exception message after renaming.
AusterX
Posts: 19
Joined: Sun Mar 05, 2023 9:29 am

Re: Some NET questions

Post by AusterX »

Thanks for reply, i would ask a clarification if you don't mind:
two methods marked with [Obfuscation(Feature = "virtualization", Exclude = false)], in VMP gui i change the complexity of one function from "default" to 60 (which is not greyed out like in global settings), save the .vmp xml file.

Code: Select all

<Procedure MapAddress="Myclass::msg_receive(int32)" Options="0" />
<Procedure MapAddress="Myclass::msg_send(int32)" Options="0" Complexity="60" />
Do you mean that both global and method specific complexity have no effect for NET (no selectable complecity at all in NET)?
Thanks again
Admin
Site Admin
Posts: 2566
Joined: Mon Aug 21, 2006 8:19 pm
Location: Russia, E-burg
Contact:

Re: Some NET questions

Post by Admin »

Do you mean that both global and method specific complexity have no effect for NET (no selectable complecity at all in NET)?
Exactly!
AusterX
Posts: 19
Joined: Sun Mar 05, 2023 9:29 am

Re: Some NET questions

Post by AusterX »

Thank you
AusterX
Posts: 19
Joined: Sun Mar 05, 2023 9:29 am

Re: Some NET questions

Post by AusterX »

Admin wrote: Sun May 21, 2023 10:58 am About names that used in reflection - VMProtect has heuristic algorithms that help to exclude such names from renaming automatically (without additional obfuscation attributes).
It could help, but in my case i'm going to substitute all the enums.tostring with something else to not show anything clear.
For enums, i see a .tostring() triggers that heuristic algo, but looks like it doesn't see the recast?

Code: Select all

VMProtect.SerialState status = VMProtect.SerialState.BadHwid;

// this produces clear enums in compiled file, as expected
Console.WriteLine(status.ToString()); 

// this produces clear enums in compiled file too, even if recasted
Console.WriteLine(((uint)status).ToString("X2")); 

// this produces encrypted enums in compiled file
uint st = (uint)status;
Console.WriteLine(st.ToString("X2")); 
Admin
Site Admin
Posts: 2566
Joined: Mon Aug 21, 2006 8:19 pm
Location: Russia, E-burg
Contact:

Re: Some NET questions

Post by Admin »

For enums, i see a .tostring() triggers that heuristic algo, but looks like it doesn't see the recast?
I don't understand where is a problem.
AusterX
Posts: 19
Joined: Sun Mar 05, 2023 9:29 am

Re: Some NET questions

Post by AusterX »

public enum commands
{
AESCBC_ENC = 1,
AESCBC_DEC = 2,
SHA1 = 8,
SHA256 = 9
}
let's say i don't want people to just hexedit and see this enum ascii, i saw VMProtect encrypts enum names but sometimes not, i wanted to know what exactly triggers VMProtect to skip enum reneaming, to make sure they gets encrypted (.tostring() for sure, i guess also a cast int to enum?!?!).
Anyway, doesn't matter, i saw i can put a [Obfuscation(Feature = "renaming", Exclude = false)] on top of an enum and it gets encrypted (then i cannot use .tostring() of course, but at the end i removed all the enums that needed a .tostring(), substituted with classes or structs and i'm fine.
Thanks anyway
Admin
Site Admin
Posts: 2566
Joined: Mon Aug 21, 2006 8:19 pm
Location: Russia, E-burg
Contact:

Re: Some NET questions

Post by Admin »

This code excludes values of VMProtect.SerialState from renaming:

Code: Select all

VMProtect.SerialState status = VMProtect.SerialState.BadHwid;

// this produces clear enums in compiled file, as expected
Console.WriteLine(status.ToString());
Other cases don't change the renaming behavior.

Anyway, the following code:

Code: Select all

[Obfuscation(Feature = "renaming", Exclude = false)]
enum commands {
...
Will rename values of commands, even when the "enum.ToString" method was found.
weloveayaka
Posts: 51
Joined: Wed Jul 05, 2023 6:21 am

Re: Some NET questions

Post by weloveayaka »

Hello,

Could you please provide more information on the usage of the Obfuscation Attribute?

I have certain requirements for controlling the 'Rename' functionality. I need to specify which elements should be exempt from renaming and which ones should be renamed. If possible, I would like the ability to select the members or methods that need to be renamed within the GUI.
Admin
Site Admin
Posts: 2566
Joined: Mon Aug 21, 2006 8:19 pm
Location: Russia, E-burg
Contact:

Re: Some NET questions

Post by Admin »

The option "Strip debug information" renames classes/methods/properties for .NET applications.

Examples:
1. Excludes all classes from renaming with the following code:

Code: Select all

[assembly: Obfuscation(Feature = "renaming", Exclude = true)]
2. Enables the renaming feature for a class:

Code: Select all

[Obfuscation(Feature = "renaming", Exclude = false)]
class Foo ...
Post Reply