Reverse Engineering with Reflector and Reflexil
I've always been a big fan of Reflexil Add-in it's now easy to also modify assemblies yourself.
To demonstrate this, I've created a small CrackMe sample program, which consists out of nothing more then a simple password check. This is how it looks when opened in Reflector, with Reflexil displaying the IL code below it.
Ignoring the fact that the password is out there in the open, let's have a look on how we could easily change the behavior of this assembly.
As you can see on the highlighted line in Reflexil, the instruction will jump to line 11 in case the provided password is false. Let's simply change this to jump when true. Right click the line, select 'Edit...' and change the OpCode to brtrue.s to modify the if statement.
I'm sure this brings back memories for people doing this years ago in assembler, JNE to JE :)
To save this change, navigate to the .exe node in Reflector and select 'Save as ...' in the Reflexil dialog.
If you open the new executable in Reflector and have a look at the password check, you'll notice the operator has changed, making all passwords valid except the correct one.
I've attached the good tools are.
This post is the first in a series on protecting intellectual property.