Extreme .NET Reverse Engineering: Part 5

1. .NET Binary Reverse Engineering: Part 1
2. .NET Reverse Engineering: Part 2
3. .NET Reverse Engineering: Part 3
4. Bug Fixing: .NET Reverse Engineering: Part 4

From the previous articles, we have done lots of IL grammar so far. As I warned you earlier, the motivation for Reverse Engineering could be for either offensive or defensive purposes. It is now time to crack some real things with the association of IL opcode grammar knowledge. Ideally, this article taught us how to reveal sensitive information from the source code in order to bypass security constraints such as user credentials validation, extending the software trial evaluation period, and bypassing serial keys limitations without actually having access to the real source code. We are not going to do binary or byte code patching in the context of reversing the code since we have typically employed tools such as a hex editor, IDA Pro, or ollydb software tools for playing with real bytes. In this article, however, we will be confronted only with IL opcodes instead in order to divert the actual program logic flows as needed to achieve those objectives.

Software is usually developed from a financial point of view in this commercial world. That is, the vendor who developed the software won't allow it to be used for free. Apart from that, they don't expose the source code to the client because the source code is their intellectual property. But they launch a beta version or a flexible to run a version of the software for a special trial period prior to deployment of their product into the market. So, it is necessary to buy the license key of that specific software otherwise that software will stop working after completion of the specific evaluation duration. But some skillful professionals devise a way to use the software without actually purchasing the software license key. They actually diagnose the entire software working life cycle and eventually find some vulnerability in the mechanism. They ultimately exploit such loopholes to bypass the serial key security obstacle. In this context, they can recover the actually serial key, or they can divert the serial key checking program flow or they can inject custom serial keys. Suppose a renowned company developed an application that requires a 7 digit license key (hard-coded 1111111) in order to unlock the software and proceed. Fortunately, some individuals somehow got this software to be executable (maybe the beta version) by any conduit. But they don't have the license key to unlock the software.

After executing this software, it prompts to enter a seven-digit license key. Otherwise, it could not let you proceed in the case of a futile hit and trial as in the following. Okay, don't bother yourself; we can still get through this application without having the real license keys. First things first, decompile the shipped executable file using ILDASM that produces the following IL opcode as in the following:

We can bypass or reveal such security constraints in multiple ways. In the Main() method declaration, if you deem over the following opcode instructions especially IL_0022 that implies that if the proper serial keys are not entered, then jump to the error message instruction. So here is the point, we change this jump code instruction to IL_0025 instead of IL_0033 then the code execution will always jump to the code block we intend it to, no matter what keys values we are entered.

The second trick resides again in the Main() method near to the key verify method. What this code is doing is checking the entered key values to the actual key value. If the values are correct then we can enter otherwise it throws us to the invalid message section using stloc.1. So if we change it to stloc.0 then our execution will always go to the block we intend it to, as in the following:

Now, if you don't possess the right key values then you can still get into the software without having the exact key values as in the following: The final trick is, if you examine the class constructor block, you can easily find the hard-coded key values. Here, in this instruction, we can guess that the key value is 0x10f447 so change it to decimal format and you have the exact key to validate. After finally employing one of these methods, you can bypass the serial key limitation despite not having the key as in the following:

Cracking the password of software or bypassing the login screen is a sophisticated task. Sometimes the password is easily obtained or sometimes it can be very time-consuming. This all depends on how exactly the password mechanism is manipulated in the system. The following Dummy Software requires a user name and password to proceed but we have no idea what the correct user credentials are. So how do we breach this security restriction? By God's grace, we have at least the executable of this software. If we decompile this software executable into its corresponding *.il file and diagnose the corresponding method that is responsible for validating the user credentials then we might be a breach of this security restriction. Here the UserAuth() method IL code is as in the following:

If we rigorously scrutinize that code then we can reach a conclusive result by obtaining some significant information. We can easily determine here that instructions IL_0001 and IL_0007 are storing the actual user name and password information as “ajay” and “1234”.

The second important thing is, we can conclude from these opcodes that IL_000d is responsible for setting a boolean value to true and false. As in the UserAuth() method, if the user enters a correct user name and password then this boolean value is set to true, otherwise, it would be always false. IL_000d: ldc.i4.0. So here is the trick, if we change it to True right here, then it doesn't matter what the user inputs because the boolean value would always be true. IL_000d: ldc.i4.1 In another observation, we can imply some substantial information from the btnLog_Click() method. In fact, this method takes a user name and password from the user and validates them against the predefined parameters.

Now look at these sorts of instructions, these are actually checking the input credentials against the predefined. If the user enters the correct information then okay otherwise it throws the execution to IL_0039 that shows some invalid message or something else.

So, here is a loophole, if we throw the execution to instruction IL0024 rather than IL_0039, then our program always runs perfectly, it doesn't matter what credentials we enter. IL_0022: brtrue.s IL_0024 In other tactics, if we bypass the equal condition, where the credentials are validated then we can breach the software easily. These instructions are responsible for equating the condition as in the following:

So, if we change the IL_001d instruction to ldc.i4.1 then the equal never would be checked and we can breach the login screen easily as in the following:

Sometimes, we do install a beta version of the software just for testing purposes but they expire after completion of their evaluation period and we can no longer use them. As an analogy, the following software calculates some math functions but it is expired now. We can resume our operation after buying the license key. But by applying round-trip Reverse Engineering we can extend its expiry date and make it usable without investing money on the license key. First, decompile its exe file in the IL file and rigorously study it for detecting vulnerability.

After doing some R&D, we found some instructions that show the expiry date as 30/7/2013 of this software as in the following: IL_0001: ldc.i4 0x7dd IL_0006: ldc.i4.7 IL_0007: ldc.i4.s 30 So if we modify the instruction IL_0007 to some other value and recompile it using ILASM then we can still use this software. In another code review, that checks the current date to an expiry date whether or not it is less as in the following.

If we delete some code instruction that shows the expiry date message then we can bypass this restriction as in the following:

Wipeout these aforementioned instructions from the code file, save it and recompile it again and finally run this software. Here the modified code is as in the following:

Finally, this software works fine as in the following:

In this article, we have seen how to obtain sensitive information to crack a user name, password, serials keys and extend a trial duration, or subvert the existing security mechanism without having access to real source code. We have to come to an understanding of how to manipulate IL code with respect to achieving our objective. In the forthcoming article of this series, we will address advanced Reverse Engineering subjects such as byte patching using a hex editor, CFF explorer, and IDA pro.