{"id":2085,"date":"2024-03-12T21:35:32","date_gmt":"2024-03-12T12:35:32","guid":{"rendered":"https:\/\/h4ck.kr\/?p=2085"},"modified":"2024-05-20T13:23:48","modified_gmt":"2024-05-20T04:23:48","slug":"csharp","status":"publish","type":"post","link":"https:\/\/h4ck.kr\/?p=2085","title":{"rendered":"CSHARP"},"content":{"rendered":"\n

Exeinfo PE<\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n

C# \/ .NET \uc5b8\uc5b4\ub85c \ud504\ub85c\uadf8\ub7a8\uc774 \uac1c\ubc1c\ub418\uc5c8\ub2e4.<\/p>\n\n\n\n

dnSpy \ud234\ub85c \ud55c\ubc88 \ubd84\uc11d\ud574\ubcf4\uc790.<\/p>\n\n\n\n

Analysis<\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n

\uc774\ub807\uac8c \uc785\ub825\ud558\ub294 \ucc3d\uc774 \ub728\uace0
Check \ubc84\ud2bc\uc744 \ub20c\ub800\uc744\ub54c \uc720\ud6a8\ud558\uc9c0 \uc54a\ub294 \uac12\uc73c\ub85c \ud310\ub2e8\ub418\uba74, Wrong \uba54\uc2dc\uc9c0\uac00 \ub72c\ub2e4.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

private static void MetMetMet(string sss)<\/code> \ud568\uc218\uc5d0\uc11c \uc720\ud6a8\ud55c \uac12\uc778\uc9c0 \ud310\ub2e8\ud558\ub294 \ucf54\ub4dc\uac00 \uc788\ub2e4.<\/p>\n\n\n\n

\uac12\uc744 “ABCDEFGH”\ub85c \ub123\uace0
method.Invoke<\/code>\uc5d0 \ube0c\ub808\uc774\ud06c\ud3ec\uc778\ud2b8\ub97c \uac78\uc5b4 Check \ubc84\ud2bc\uc744 \ub20c\ub7ec\ubcf4\uba74,<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

bytes\uc5d0 ABCDEFGH\ub97c base64\ub85c \uc778\ucf54\ub529\ub41c QUJDREVGR0g \uac12\uc774 \ub4e4\uc5b4\uac04\ub2e4.<\/p>\n\n\n\n

\uc774\uc81c \uc2a4\ud15d\uc744 \ud558\ub098\uc529 \ubc1f\uc544\uc11c \ud655\uc778\ud574\ubcf4\uba74,<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

MetM \ud568\uc218\ub97c \ud1b5\ud574 \uac12\uc744 \ud655\uc778\ud558\uace0 \uc788\uc5c8\ub2e4.<\/p>\n\n\n\n

MetM<\/strong><\/h3>\n\n\n\n
\n
\n
using System;\n\n\/\/ Token: 0x02000002 RID: 2\npublic class RevKrT2\n{\n\t\/\/ Token: 0x06000001 RID: 1\n\tprivate static void MetM(byte[] A_0, byte[] A_1)\n\t{\n\t\tif (A_1.Length == 12)\n\t\t{\n\t\t\tA_0[0] = 2;\n\t\t\tif ((A_1[0] ^ 16) != 74)\n\t\t\t{\n\t\t\t\tA_0[0] = 1;\n\t\t\t}\n\t\t\tif ((A_1[3] ^ 51) != 70)\n\t\t\t{\n\t\t\t\tA_0[0] = 1;\n\t\t\t}\n\t\t\tif ((A_1[1] ^ 17) != 87)\n\t\t\t{\n\t\t\t\tA_0[0] = 1;\n\t\t\t}\n\t\t\tif ((A_1[2] ^ 33) != 77)\n\t\t\t{\n\t\t\t\tA_0[0] = 1;\n\t\t\t}\n\t\t\tif ((A_1[11] ^ 17) != 44)\n\t\t\t{\n\t\t\t\tA_0[0] = 1;\n\t\t\t}\n\t\t\tif ((A_1[8] ^ 144) != 241)\n\t\t\t{\n\t\t\t\tA_0[0] = 1;\n\t\t\t}\n\t\t\tif ((A_1[4] ^ 68) != 29)\n\t\t\t{\n\t\t\t\tA_0[0] = 1;\n\t\t\t}\n\t\t\tif ((A_1[5] ^ 102) != 49)\n\t\t\t{\n\t\t\t\tA_0[0] = 1;\n\t\t\t}\n\t\t\tif ((A_1[9] ^ 181) != 226)\n\t\t\t{\n\t\t\t\tA_0[0] = 1;\n\t\t\t}\n\t\t\tif ((A_1[7] ^ 160) != 238)\n\t\t\t{\n\t\t\t\tA_0[0] = 1;\n\t\t\t}\n\t\t\tif ((A_1[10] ^ 238) != 163)\n\t\t\t{\n\t\t\t\tA_0[0] = 1;\n\t\t\t}\n\t\t\tif ((A_1[6] ^ 51) != 117)\n\t\t\t{\n\t\t\t\tA_0[0] = 1;\n\t\t\t}\n\t\t}\n\t}\n}<\/pre>\n<\/div>\n<\/div>\n\n\n\n
MetM \ud568\uc218 \ucf54\ub4dc\ub294 \uc704\uc640 \uac19\uc774 XOR \uc5f0\uc0b0\uc744 \ud558\uba74\uc11c \uac12\uc744 \ud655\uc778\ud558\uace0 \uc788\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
XOR \uc5f0\uc0b0\uc744 \ud558\uace0 ZFluYWFNaWM\ub97c base64 \ub514\ucf54\ub529\ud558\uba74,
dYnaaMic<\/strong><\/p>\n\n\n\n
Result<\/h2>\n\n\n\n
\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"
Exeinfo PE C# \/ .NET \uc5b8\uc5b4\ub85c \ud504\ub85c\uadf8\ub7a8\uc774 \uac1c\ubc1c\ub418\uc5c8\ub2e4. dnSpy \ud234\ub85c \ud55c\ubc88 \ubd84\uc11d\ud574\ubcf4\uc790. Analysis \uc774\ub807\uac8c \uc785\ub825\ud558\ub294 \ucc3d\uc774 \ub728\uace0 Check \ubc84\ud2bc\uc744 \ub20c\ub800\uc744\ub54c \uc720\ud6a8\ud558\uc9c0 \uc54a\ub294 \uac12\uc73c\ub85c \ud310\ub2e8\ub418\uba74, Wrong \uba54\uc2dc\uc9c0\uac00 \ub72c\ub2e4. private static void MetMetMet(string sss) \ud568\uc218\uc5d0\uc11c \uc720\ud6a8\ud55c \uac12\uc778\uc9c0 \ud310\ub2e8\ud558\ub294 \ucf54\ub4dc\uac00 \uc788\ub2e4. \uac12\uc744 “ABCDEFGH”\ub85c \ub123\uace0method.Invoke\uc5d0 \ube0c\ub808\uc774\ud06c\ud3ec\uc778\ud2b8\ub97c \uac78\uc5b4 Check \ubc84\ud2bc\uc744 \ub20c\ub7ec\ubcf4\uba74, bytes\uc5d0 ABCDEFGH\ub97c base64\ub85c \uc778\ucf54\ub529\ub41c QUJDREVGR0g \uac12\uc774 \ub4e4\uc5b4\uac04\ub2e4. \uc774\uc81c \uc2a4\ud15d\uc744… \ub354 \ubcf4\uae30 »CSHARP<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","footnotes":""},"categories":[16],"tags":[24],"class_list":["post-2085","post","type-post","status-publish","format-standard","hentry","category-reversing-kr","tag-reversing"],"_links":{"self":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/2085","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2085"}],"version-history":[{"count":1,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/2085\/revisions"}],"predecessor-version":[{"id":2098,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/2085\/revisions\/2098"}],"wp:attachment":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2085"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2085"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2085"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}