[analysis tool] ILDasm

[S3NSA]

http://msdn2.microsoft.com/en-us/library/Aa309387(VS.71).aspx

Great tutorial on ILDasm.exe.

Appalsap sent me this tool from the .net framework yesterday that proved to be quite useful.


Here is the example of what it did;

We all know perm revert, the program made my Neon to try and revert back to Rev896. However all it seemed to do was "failed to revert".

So using this tool we managed to disassemble it into a readable graphic form to see what the program was really doing.

Disassembly;
.method private hidebysig static void Main(string[] args) cil managed
{
.entrypoint
// Code size 104 (0x68)
.maxstack 1
IL_0000: ldc.i4.2
IL_0001: call bool PFitzsimons.ConsoleColour.ConsoleColour::SetForeGr oundColour(valuetype PFitzsimons.ConsoleColour.ConsoleColour/ForeGroundColour)
IL_0006: pop
IL_0007: ldstr "PermRevert Coded By NeonPhilite"
IL_000c: call void [mscorlib]System.Console::WriteLine(string)
IL_0011: ldstr "Reverts from rev 1086 to rev 896"
IL_0016: call void [mscorlib]System.Console::WriteLine(string)
IL_001b: call bool PFitzsimons.ConsoleColour.ConsoleColour::SetForeGr oundColour()
IL_0020: pop
IL_0021: ldc.i4.4
IL_0022: call bool PFitzsimons.ConsoleColour.ConsoleColour::SetForeGr oundColour(valuetype PFitzsimons.ConsoleColour.ConsoleColour/ForeGroundColour)
IL_0027: pop
IL_0028: ldstr "PermRevert 1.0.1 \n"
IL_002d: call void [mscorlib]System.Console::WriteLine(string)
IL_0032: ldc.i4.3
IL_0033: call bool PFitzsimons.ConsoleColour.ConsoleColour::SetForeGr oundColour(valuetype PFitzsimons.ConsoleColour.ConsoleColour/ForeGroundColour)
IL_0038: pop
IL_0039: ldc.i4 0x708
IL_003e: call void [mscorlib]System.Threading.Thread::Sleep(int32)
IL_0043: ldstr "Reverting from 1086 to 896..."
IL_0048: call void [mscorlib]System.Console::WriteLine(string)
IL_004d: ldc.i4 0xbb8
IL_0052: call void [mscorlib]System.Threading.Thread::Sleep(int32)
IL_0057: ldstr "Failed to revert."
IL_005c: call void [mscorlib]System.Console::WriteLine(string)
IL_0061: call string [mscorlib]System.Console::ReadLine()
IL_0066: pop
IL_0067: ret
} // end of method Program::Main

This showed us that the program did nothing more than display the text up until "reverting from 1086 to 896" then paused to make it seem as if it was working and finally after the pause displayed "Failed to revert".

Ironically the program did work as that was all it was supposed to do.

So here is a thought, if a simple program gets released and pretends to be amazing but it never works, use this little tool to find out if it is actually what it says it is.

p.s. Ive attached the original PermRevert so you can check it yourself =]

[S3NSA]

wiped the source as well, up to you if you wanna release it publicly :)

[NeonPhilite]

And there is a line of code to prevent disassembling so beware.

[S3NSA]

+added neons found tutorial

[thaicoures3]

And there is a line of code to prevent disassembling so beware.

In GG or in your program o.O?

[NeonPhilite]

No, there is a line of code that can prevent Disassembly.

[CioNide]

I like this program, thank you S3NSA and applesap(whatever it is...) thanks.

And as you can see you can't open up just any program, has to have a CLR Header, say you made it in Microsoft Visual Studio C++ 2005, that would compile/build the .exe with a CLR Header.

[S3NSA]

why thanks to the old crackpot [scruie] ?

[cwisfa]

Don't worry Sensa, I think he means you ;)

[CioNide]

Sorry S3NSA accidentally put scruie.