Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 07-08-2019, 19:59
ian ian is offline
Friend
 
Join Date: Jul 2019
Posts: 18
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 16
Thanks Rcvd at 37 Times in 15 Posts
ian Reputation: 1
Post Decompile Xsql Server Comparison

Hello mate,
I started to crack the SQL Server Comparison Bundle v9 program (.net).
I decompile xSQL.Licensing.v4.dll file by using justDecompile tools, then extract the code and open with Visual Studio .
Final rebuild the dll and extract new dll.
After run the program there is an error in eventViewer:

Quote:
Application: xSQL.DataCompare.SqlServer.UI.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.MissingMethodException
at k0.c()
Quote:
Faulting application name: xSQL.DataCompare.SqlServer.UI.exe, version: 9.5.2.0, time stamp: 0x5c143804
Faulting module name: KERNELBASE.dll, version: 10.0.17763.475, time stamp: 0x69a188f0
Exception code: 0xe0434352
Fault offset: 0x0000000000039129
Faulting process id: 0x2560
Faulting application start time: 0x01d535822d244178
Faulting application path: C:\Program Files (x86)\xSQL Software\Test\xSQL.DataCompare.SqlServer.UI.exe
Faulting module path: C:\Windows\System32\KERNELBASE.dll
Report Id: 322ccb70-d387-4ba9-8dc8-d92061f5ed1b
Faulting package full name:
Faulting package-relative application ID:
Does the error result due to unsigned dll or what?
Can help me to solve this error.
Thanks in advance
ian

Last edited by ian; 07-08-2019 at 20:06.
Reply With Quote
The Following User Says Thank You to ian For This Useful Post:
Indigo (07-19-2019)
  #2  
Old 07-09-2019, 09:26
goku goku is offline
 
Join Date: Feb 2009
Posts: 123
Rept. Given: 30
Rept. Rcvd 34 Times in 15 Posts
Thanks Given: 19
Thanks Rcvd at 3 Times in 2 Posts
goku Reputation: 34
try decompile xSQL.Licensing.v4.dll DNS SPY
__________________
hi
Reply With Quote
The Following User Says Thank You to goku For This Useful Post:
Indigo (07-19-2019)
  #3  
Old 07-09-2019, 12:06
computerline computerline is offline
Friend
 
Join Date: Jun 2014
Posts: 71
Rept. Given: 40
Rept. Rcvd 27 Times in 11 Posts
Thanks Given: 101
Thanks Rcvd at 106 Times in 44 Posts
computerline Reputation: 27
I don't think decompile and rebuild the obfuscate .net dll is a good idea why don't direct modify it in dnspy
Reply With Quote
The Following User Says Thank You to computerline For This Useful Post:
Indigo (07-19-2019)
  #4  
Old 07-09-2019, 18:05
NoneForce NoneForce is offline
Lo*eXeTools*rd
 
Join Date: Mar 2002
Posts: 441
Rept. Given: 229
Rept. Rcvd 138 Times in 77 Posts
Thanks Given: 119
Thanks Rcvd at 45 Times in 24 Posts
NoneForce Reputation: 100-199 NoneForce Reputation: 100-199
Hi,

Just de4dot the xSQL.Licensing.v4.dll and patch InTrial (16 2A) and IsProductLicensed(Boolean) (17 2A) functions.

don't get messy with decompile/compile process.
Reply With Quote
The Following User Says Thank You to NoneForce For This Useful Post:
Indigo (07-19-2019)
  #5  
Old 07-09-2019, 20:30
ian ian is offline
Friend
 
Join Date: Jul 2019
Posts: 18
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 16
Thanks Rcvd at 37 Times in 15 Posts
ian Reputation: 1
Hello mates,
I've worked on de4dot and then make decompile/compile process.
I have the same error.
Thanks in advance.
ian
Reply With Quote
The Following User Says Thank You to ian For This Useful Post:
Indigo (07-19-2019)
  #6  
Old 07-09-2019, 21:05
NoneForce NoneForce is offline
Lo*eXeTools*rd
 
Join Date: Mar 2002
Posts: 441
Rept. Given: 229
Rept. Rcvd 138 Times in 77 Posts
Thanks Given: 119
Thanks Rcvd at 45 Times in 24 Posts
NoneForce Reputation: 100-199 NoneForce Reputation: 100-199
Quote:
Originally Posted by ian View Post
Hello mates,
I've worked on de4dot and then make decompile/compile process.
I have the same error.
Thanks in advance.
ian
As mentioned above decompile/recompile is not a proper way for obfuscated targets.
Just deobfuscate and patch a few bytes.

Code:
https://mega.nz/#!uktDCKaa!wX6yGTWx-DzMZste9XE0uykgkebjdUQeclmbgk4ufKU
Reply With Quote
The Following 2 Users Say Thank You to NoneForce For This Useful Post:
ian (07-10-2019), Indigo (07-19-2019)
  #7  
Old 07-09-2019, 22:42
yoza's Avatar
yoza yoza is offline
Moderator
 
Join Date: Aug 2015
Location: Himalaya
Posts: 162
Rept. Given: 31
Rept. Rcvd 159 Times in 55 Posts
Thanks Given: 146
Thanks Rcvd at 826 Times in 135 Posts
yoza Reputation: 100-199 yoza Reputation: 100-199
Quote:
Originally Posted by NoneForce View Post
Hi,

Just de4dot the xSQL.Licensing.v4.dll and patch InTrial (16 2A) and IsProductLicensed(Boolean) (17 2A) functions.

don't get messy with decompile/compile process.
Yes you right, just patch the two above function...
xSQL Sotft use this functions (on xSQL.Licensing.v4.dll) for all products.
It's protected with Dotfuscator, but its very clear, not obfuscated. So no need de4dot to decompile/deobfuscation.
I as far as I remember for some years ago... Simple, JUST PATCH on an editor, reflexil or something like that... there you go.
Reply With Quote
The Following 3 Users Say Thank You to yoza For This Useful Post:
ian (07-10-2019), Indigo (07-19-2019), niculaita (07-10-2019)
  #8  
Old 07-10-2019, 14:06
ian ian is offline
Friend
 
Join Date: Jul 2019
Posts: 18
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 16
Thanks Rcvd at 37 Times in 15 Posts
ian Reputation: 1
Quote:
Originally Posted by NoneForce View Post
As mentioned above decompile/recompile is not a proper way for obfuscated targets.
Just deobfuscate and patch a few bytes.

Code:
https://mega.nz/#!uktDCKaa!wX6yGTWx-DzMZste9XE0uykgkebjdUQeclmbgk4ufKU
The patch file works fine.
I regenerate the patched file using dnspy, it works fine.
Thanks all
ian
Reply With Quote
The Following 2 Users Say Thank You to ian For This Useful Post:
Indigo (07-19-2019), niculaita (07-10-2019)
Reply

Tags
csharp, dotnet

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
VM Comparison mm10121991 General Discussion 3 11-27-2017 16:45


All times are GMT +8. The time now is 15:44.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX