Le blog de Sébastien LEBRETON

• Be.HexEditor - MIT


• De4dot - GPL


• ICSharpCode.NRefactory - MIT


• ICSharpCode.SharpDevelop.Dom - LGPL


• ICSharpCode.TextEditor - LGPL


• Mono.Cecil - MIT

• Reflexil core code - MIT/LGPL/GPL


• Reflexil core and Be.HexEditor - MIT/LGPL/GPL


• Reflexil core and ICSharpCode.TextEditor - LGPL


• Reflexil core and De4dot - GPL


• Reflexil all inclusive - GPL

Reflexil 1.5 will be able to deobfuscate assemblies, thanks to de4dot by 0xd4d.

Babel NET, CliSecure, CodeVeil, CryptoObfuscator, DeepSea, Dotfuscator, dotNET Reactor, Eazfuscator NET, Goliath NET, Skater NET, SmartAssembly, Spices Net and Xenocode are supported !

Custom attributes are now supported in Reflexil 1.4. Let's use the following sample code:

Here is the execution result:

 Open Reflector & Reflexil then go to the "stub" method, we can see attributes in the "Custom attributes" tab:

Edit the attribute, we can see constructor arguments used :

Then update the first one, an array with enumeration values :

Then a simple string:

Then a simple bool:

Then a type reference:

Ok let's update the attribute:

Save & test....  works !

Note: a search area is now available in the type tree for easier use : 

 You can download the latest version here: http://reflexil.net

Reflector 7 has changed its assembly version (previously 5.0.0.0, now 7.0.0.0), so that lots of plugins fail to load, but without any plugin API changes.
Here is a simple tool to patch all references to Reflector assembly with custom version, so you don't need to get the plugin source code and recompile.

Tested with Reflexil 1.1, BamlViewer, Graph, CppCli.

Hope it can be useful.

I do not encourage the use of Dexer for any form of application piracy or copyright infringement. You HAVE TO customize the Google’s Android License Verification Library if you want to protect your software against piracy.
This post was written to make you aware of this. Please support android developers, and pay for your apps.

I've made a simple application, using Android Licensing Service, based on the sample provided with the SDK.
Then i've made a simple C# application, using Dexer, to show how it's easy to circumvent the licensing protection. Something similar was first done by Justin Case using Smali/Baksmali.

All the magic is in a switch block, which tells the licensing library what to do next, depending on the results of the verification query. Here is how to patch this switch, without knowing the class name, method name and method prototype (so it should work with simple obfuscated applications).

apktool d -f -s DexerLVL.unpatched.apk DexerLVL.unpatched.apk-extract
I: Copying raw classes.dex file...
I: Loading resource table...
I: Decoding resources...
I: Copying assets and libs...
copy /Y DexerLVL.unpatched.apk-extract\classes.dex classes.dex > nul

DexerPOC
Dexer Licensing POC - Scanning instructions...
SparseSwitch found! - com.android.vending.licensing.LicenseValidator
::verify(java.security.PublicKey, Int, java.lang.String, java.lang.String) : Void
Done!

copy /Y output.dex DexerLVL.unpatched.apk-extract\classes.dex > nul
apktool b DexerLVL.unpatched.apk-extract DexerLVL.patched.apk
I: Copying classes.dex file...
I: Checking whether resources has changed...
I: Building resources...
I: Building apk file...

jarsigner -keystore debug.keystore -storepass android -keypass android DexerLVL.patched.apk androiddebugkey

Again, i've made this on my own application for research purposes only. It is illegal to defeat protections on copyrighted works. You should read all protection techniques here.

Original application: DexerLVL.unpatched.apk

Patched application: DexerLVL.patched.apk

I decided to write this post in English because I’ve received lots of emails regarding Dexer.

Dexer is an open source framework, written in C#. With Dexer, you can load, update then write back “.DEX” files used by Android (inside “.APK” packages).

Dexer is different than other tools like the famous Smali/Baksmali because all is done directly inside its object model. Dexer was inspired by Mono.Cecil that I’m very familiar with (Cecil targets .NET assemblies).

Dexer is a framework, not an application. Perhaps I will make an advanced GUI like Reflexil, but not yet, I spent too many nights on this one:).

Let’s see how it works with a simple Android application (Java):

Here is the result:

And here is the code of the main method inside the Dexer object model:

Now let’s go back to C# to play a little with this application by changing a string constant and an opcode (adding instead of multiplying):

Here is the result:

Now let’s call a method to change the title color:

Here is the result:

As you can see, altering DEX files is quite easy with Dexer. In order to rebuild APK packages, I’ve used ApkTool and JarSigner (with the default debug key generated by the Android SDK).

apktool d -s -f DexerPOC.apk output

I: Copying raw classes.dex file...

I: Loading resource table...

I: Decoding resources...

I: Copying assets and libs...



apktool b output DexerPOC.new.apk

I: Copying classes.dex file...

I: Checking whether resources has changed...

I: Building resources...

I: Building apk file...



jarsigner -keystore .\.android\debug.keystore -storepass android -keypass android DexerPOC.new.apk androiddebugkey



adb install DexerPOC.new.apk

586 KB/s (12609 bytes in 0.021s)

        pkg: /data/local/tmp/DexerPOC.new.apk

Success.

You can get up-to-date Dexer sourcecode here.