From e3fd44134ba6fd8bddb15355d57c0f7138218d24 Mon Sep 17 00:00:00 2001 From: TheRogueArchivist <24215969+TheRogueArchivist@users.noreply.github.com> Date: Fri, 4 Oct 2024 21:56:52 -0600 Subject: [PATCH] Add initial .NET Reactor support (#325) * Add initial .NET Reactor support It's minimal, but is much better than nothing. A few notes on how it can be realistically improved have been added as well. * Fix missing using * 7-zip SFX is extractable now --- BinaryObjectScanner/Packer/dotNetReactor.cs | 106 ++++++++++++++++++++ README.md | 3 +- 2 files changed, 108 insertions(+), 1 deletion(-) create mode 100644 BinaryObjectScanner/Packer/dotNetReactor.cs diff --git a/BinaryObjectScanner/Packer/dotNetReactor.cs b/BinaryObjectScanner/Packer/dotNetReactor.cs new file mode 100644 index 00000000..36101b1e --- /dev/null +++ b/BinaryObjectScanner/Packer/dotNetReactor.cs @@ -0,0 +1,106 @@ +using BinaryObjectScanner.Interfaces; +using SabreTools.Serialization.Wrappers; +using System.Collections.Generic; +using SabreTools.Matching; +using SabreTools.Matching.Content; + +namespace BinaryObjectScanner.Packer +{ + /// + /// .NET Reactor is a .NET obfuscator that was original released in 2004. https://web.archive.org/web/20040828162124/http://eziriz.com:80/ + /// It is currently still being updated and supported. https://www.eziriz.com/dotnet_reactor.htm + /// While ProtectionID does detect .NET Reactor, it's currently unknown exactly how. + /// It seems to simply check for the string "" in specific, and currently unknown, conditions but appears to be prone to false positives. + /// A "Demo/Nag Screen" version is available for free, and may be able to be used to make samples to improve detections. https://www.eziriz.com/reactor_download.htm + /// + /// Resource that could be useful for extraction: https://github.com/SychicBoy/NETReactorSlayer + /// + public class dotNetReactor : IExtractablePortableExecutable, IPortableExecutableCheck + { + /// + public string? CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) + { + // TODO: Detect version + // TODO: Further refine checks using https://github.com/horsicq/Detect-It-Easy/blob/075a70b1484d1d84d1dc37c86aac16188d5a84e7/db/PE/NetReactor.2.sg and https://github.com/cod3nym/detection-rules/blob/main/yara/dotnet/obf_net_reactor.yar + // Get the sections from the executable, if possible + var sections = pex.Model.SectionTable; + if (sections == null) + return null; + + // Get the .text section, if it exists + if (pex.ContainsSection(".text")) + { + var textData = pex.GetFirstSectionData(".text"); + if (textData != null) + { + var matchers = new List + { + // Adapted from https://github.com/cod3nym/detection-rules/blob/main/yara/dotnet/obf_net_reactor.yar and confirmed to work with "KalypsoLauncher.dll" from Redump entry 95617. + // {[8]-[4]-[4]-[4]-[12]} + new(new byte?[] + { + 0x3C, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, + 0x49, 0x6D, 0x70, 0x6C, 0x65, 0x6D, 0x65, 0x6E, + 0x74, 0x61, 0x74, 0x69, 0x6F, 0x6E, 0x44, 0x65, + 0x74, 0x61, 0x69, 0x6C, 0x73, 0x3E, 0x7B, null, + null, null, null, null, null, null, null, 0x2D, + null, null, null, null, 0x2D, null, null, null, + null, 0x2D, null, null, null, null, 0x2D, null, + null, null, null, null, null, null, null, null, + null, null, null, 0x7D + }, ".NET Reactor"), + + // Modified from the previous detection to detect a presumably newer version of .NET Reactor found in "KalypsoLauncher.dll" version 2.0.4.2. + // TODO: Check if this can/should be made more specific. + // .RSA + new(new byte?[] + { + 0x3C, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, + 0x49, 0x6D, 0x70, 0x6C, 0x65, 0x6D, 0x65, 0x6E, + 0x74, 0x61, 0x74, 0x69, 0x6F, 0x6E, 0x44, 0x65, + 0x74, 0x61, 0x69, 0x6C, 0x73, 0x3E, 0x00, 0x52, + 0x53, 0x41 + }, ".NET Reactor"), + + // Adapted from https://github.com/cod3nym/detection-rules/blob/main/yara/dotnet/obf_net_reactor.yar and confirmed to work with "KalypsoLauncher.dll" from Redump entry 95617. + // 3{.[9].-.[9].-.[9].} + new(new byte?[] + { + 0x33, 0x7B, 0x00, null, null, null, null, null, + null, null, null, null, 0x00, 0x2D, 0x00, null, + null, null, null, null, null, null, null, null, + 0x00, 0x2D, 0x00, null, null, null, null, null, + null, null, null, null, 0x00, 0x2D, 0x00, null, + null, null, null, null, null, null, null, null, + 0x00, 0x7D, 0x00 + }, ".NET Reactor (Unconfirmed - Please report to us on GitHub)"), + + // Adapted from https://github.com/cod3nym/detection-rules/blob/main/yara/dotnet/obf_net_reactor.yar and confirmed to work with "KalypsoLauncher.dll" from Redump entry 95617. + // {[8]-[4]-[4]-[4]-[12]} + new(new byte?[] + { + 0x3C, 0x4D, 0x6F, 0x64, 0x75, 0x6C, 0x65, 0x3E, + 0x7B, null, null, null, null, null, null, null, + null, 0x2D, null, null, null, null, 0x2D, null, + null, null, null, 0x2D, null, null, null, null, + 0x2D, null, null, null, null, null, null, null, + null, null, null, null, null, 0x7D + }, ".NET Reactor (Unconfirmed - Please report to us on GitHub)") + }; + + return MatchUtil.GetFirstMatch(file, textData, matchers, includeDebug); + } + } + + + return null; + } + + /// + public string? Extract(string file, PortableExecutable pex, bool includeDebug) + { + // TODO: Add extraction + return null; + } + } +} diff --git a/README.md b/README.md index ea63c5b2..0a5a0688 100644 --- a/README.md +++ b/README.md @@ -153,7 +153,8 @@ Below is a list of executable packers detected by BinaryObjectScanner. The three | Protection Name | Content Check | Path Check | Extractable | Notes | | --------------- | ------------- | ---------- | ----------- | ----- | -| 7-zip SFX | Yes | No | No | | +| .NET Reactor | Yes | No | No | | +| 7-zip SFX | Yes | No | Yes | | | Advanced Installer / Caphyon Advanced Installer | Yes | No | No | | | Armadillo | Yes | No | No | | | ASPack | Yes | No | No | |