Not breaking after deobfuscation

Help
EBOO ASD
2013-02-02
2013-03-24
  • EBOO ASD
    EBOO ASD
    2013-02-02

    Hi,

    I am facing a strange new problem. I am looking at a .net assembly which is protected with smartassembly to avoid disassembling. The original file is working in DILE and dile is breaking at my desired locations. However, a "cleaned" binary does not break any longer in DILE. SmartAssembly has been stripped off using de4dot and the cleaned assembly is also executing. It's just not breaking in DILE except for exceptions which are still getting caught. Any ideas on that?

     
  • Petrény Zsolt
    Petrény Zsolt
    2013-02-04

    Hi,

    First of all, I made DILE for developers as I'm also a developer and not for cracking applications. So I consider your situation "unsupported". :)

    But anyway, this is what I know about breakpoints. Breakpoints cannot be set at any point. Debuggers can tell the API where they would like to set breakpoints but ultimately the API decides whether it is possible to do so. A breakpoint can be rejected for many reasons. One of these is that IL code doesn't always map directly to native code. Mike Stall had a nice article about this on his blog years ago . Compilers also often emit extra "nop" instructions (mostly in debug builds) to allow setting breakpoints at certain places. I don't know how the deobfuscator works which you used but I can imagine that it left very few spots where breakpoints can be placed. Perhaps try to set a breakpoint on several lines and hopefully the API will be able to handle one of them. I also noticed that usually setting a breakpoint on the very first instructions of methods works. Another thing that can help is starting the target application from DILE. Debuggers can tell the runtime to avoid optimizing assemblies when they are loaded which usually leaves more spots for breakpoints. If you attach to a running application then the assembly might have already been loaded and compiled by the runtime and thus it might be too late for the debugger to disable optimizations.

    So, try to start the debuggee in DILE and put breakpoints in several places and/or at the beginning of methods. Unfortunately, that's all I can suggest, I'm afraid.

    http://blogs.msdn.com/b/jmstall/archive/2004/10/03/237137.aspx