6

I am a beginner, I want to decode 1 lvl in crackmes, I downloaded a GHIDRA as my main tool. I've got a simple keygen app.

Here it is: https://crackmes.one/crackme/5ab77f6433c5d40ad448cb2d. The solution is simple

  • use Reflector and
  • go KeyMe->KeyMe.exe->KeyMe->Form1
  • now Go to the CloseApp() method.

The source appears to be like this :

  private void CloseApp()
  {
      string str = "papanyquiL";
      for (int i = 0; i < this.textBox1.Text.Length; i++)
      { etc..

I won't ask how to get this function if the name would be different. But there are other problems - All my functions aren't visible in the decompiler, only enter function is available. I can't find an Assembler code and code in the solution.

Is GHIDRA ever available to decompile this type of file? It says that it is .NET CLR Managed Code, and that's all I've found.

Image

Rohit Gupta
  • 257
  • 2
  • 3
  • 12
OREN YT
  • 61
  • 3
  • 1
    .NET compiles to IL bytecode that requires a runtime to be executed. To my best knowledge Ghidra doesn't support this architecture, you should use a .NET decompiler like the popular ILSpy or Reflector as you mentioned – mimak Apr 25 '23 at 16:50

1 Answers1

2

You mentioned that you are a beginner so I'll give you a more generic answer with a concrete recommendation in the end.

Compared to other industries, like software development, or generally white-collar type jobs, reverse engineering (RE) is a bit of a niche-industry. So while you might be used to using "one tool for everything" in other place, I don't believe that this will be the case in RE any time soon. So imho you should be getting used to having a larger tool "box" of software that is more specialized for particular tasks.

In your situation, for example, you want to analyze a .NET-based sample. And while Ghidra is, in principal, able to analyze .NET-based samples, it is not the most powerful tool. Think of it like this: you can use a screwdriver to hammer in a nail — and one sometimes does that, if there is no hammer around for example — but if you are being serious about nails, you should get a proper hammer. And your hammer in this case is dnSpy.

Alternatives "hammers" have also been mentioned in the comment section: ILSpy and Reflector.

born
  • 240
  • 1
  • 6