Quote:
Originally Posted by taos
Hi, I have an obfuscated .net app. This app use WMI (Select * From Win32_processor) to get motherboard serial numer and CPUID. I don't want to patch directly EXE (it has several checks to avoid this) so I got 2 vectors of attack:
a) Patch WMI to return always the same values in different hardware
Anyone has info about this?
b) Patch in memory using a loader for .net
Anyone has info too?
(I have seen how to hook functions but it always make changes at EXE so is not valid for me)
Thanks
|
Sounds interesting
Please share the target with me (PM is fine if its a private one).
You can join the
SLACK channel while you are at it (invite attached there), as this could be done much faster by CHAT than by sending out a PM, waiting for a day and then replying etc.
Anyways, just share the target first
Cheers