Reverse Engineering with Reflector and Reflexil

I’ve always been a big fan of Reflector, allowing me to have a look in assemblies to learn new things, debug in case of problems and provide useful information when creating bug reports. Combined with the Reflexil Add-in it’s now easy to also modify assemblies yourself.

To demonstrate this, I’ve created a small CrackMe sample program, which consists of nothing more than a simple password check. This is how it looks when opened in Reflector, with Reflexil displaying the IL code below it.

Ignoring the fact that the password is out there in the open, let’s have a look at how we could easily change the behavior of this assembly.

As you can see on the highlighted line in Reflexil, the instruction will jump to line 11 in case the provided password is wrong. Let’s simply change this to jump when true. Right click the line, select Edit... and change the OpCode to brtrue.s to modify the if statement.

I’m sure this brings back memories for people doing this years ago in assembler, JNE to JE :)

To save this change, navigate to the .exe node in Reflector and select Save as... in the Reflexil dialog.

If you open the new executable in Reflector and have a look at the password check, you’ll notice the operator has changed, making all passwords valid except the correct one.

I’ve attached the .zip of this project and the modified file as a small example to demonstrate how powerful good tools are.

This post is the first in a series on protecting intellectual property:

• Reverse Engineering with Reflector and Reflexil (this post)
• Code Signing as Reverse Engineering Protection
• Obfuscation - Making Reverse Engineering Harder