Yesterday, I visited forum of RETEAM and found a thread asking which obfuscator is applied on the target. So curious, I downloaded the target and try to identify with my tool .Net Id and he could not identify which packer was used. The packer used for the target is .Net Reactor. My tool does not work because of my programming fault. I fixed it and it works again. I already added a new signature for PE Compact. During analyzing the assembly, I found that it is not difficult to write a tool to deobfuscate the target. Therefore I started to write DeReactor to deobfuscate .Net Reactor.
As you know, the obfuscator obfuscate all of functions, variable’s name, encrypt string and flow control. DeReactor will help you to achieve an assembly with easy-to-read source code.
Flow control
.Net Reactor uses a simple tip to anti-decompile with .Net Reflector. He just added 3 instructions before each method so that Reflector confuses. They are ‘branch’, ‘pop’ and ‘load int 0’ instructions as you can see in the figure below:
This trick is also used in many other obfuscators. They just add some useless instructions in the header of each method and then put jump command to entry point at the top. With this way, they did not destroy or obfuscate any flow control but this trick can prevent Reflector from decompiling. This trick is pretty weak against an expert reverser but it is a good candidate to fight against script kiddie. It is also pretty simple to implement.
Encrypt string
The second feature of .Net Reactor is that it will encrypt all of string into a unreadable form so that the reverser has no clue to find which he really wants. The way.Net Reactor works to decrypt the string during executing is pretty simple. He just encrypt the clear text and replace the clear text with encrypted one. Then inserted the decrypt function below this ‘ldstr’ instruction and this function will decrypt the string to original form and gives it back to the program as the figure below.
There are still a lot of things to do with this tool. But I hope in this beta version it will help you a little so that you can analyze your assembly easier.