using System; using System.Collections; using System.Collections.Generic; using System.ComponentModel; using System.Data; using System.Drawing; using System.Text; using System.Windows.Forms; using System.Diagnostics; using System.IO; using Microsoft.Win32; using System.Xml; namespace deprotect { public partial class MainForm : Form { public MainForm() { InitializeComponent(); } private void openAssembly_LinkClicked(object sender, LinkLabelLinkClickedEventArgs e) { openFileDialog.FileName = "*.exe"; openFileDialog.Filter = "Applications | *.exe"; if (openFileDialog.ShowDialog() == DialogResult.OK && openFileDialog.CheckFileExists) { this.exeFile.Text = openFileDialog.FileName; this.launch.Enabled = true; } } private void workdir_LinkClicked(object sender, LinkLabelLinkClickedEventArgs e) { if (folderBrowserDialog.ShowDialog() == DialogResult.OK) { this.workdir.Text = folderBrowserDialog.SelectedPath; } } private void exeFile_TextChanged(object sender, EventArgs e) { this.launch.Enabled = true; } // the result xml file created by the decryption process string resultXMLFile = null; // the directory that files are dumped string dumpDir = null; private void launch_LinkClicked(object sender, LinkLabelLinkClickedEventArgs e) { DllRegister.Register(); ProcessStartInfo processStartInfo = new ProcessStartInfo(exeFile.Text); processStartInfo.EnvironmentVariables["Cor_Enable_Profiling"] = "0x1"; processStartInfo.EnvironmentVariables["COR_PROFILER"] = "{DFFC737C-D0B1-4b86-A6FD-FDD998BEEB03}"; if (args.Text != null && args.Text != "") processStartInfo.Arguments = args.Text; if (workdir.Text != null && workdir.Text != "") processStartInfo.WorkingDirectory = workdir.Text; processStartInfo.UseShellExecute = false; Process process = Process.Start(processStartInfo); process.WaitForExit(); // find the result xml file, dumped\xxx.exe.xml FileInfo fi = new FileInfo(exeFile.Text); string dir; if (workdir.Text != null && workdir.Text != "") dir = workdir.Text; else dir = fi.DirectoryName; dumpDir = dir + "\\dumped"; resultXMLFile = dumpDir + "\\" + fi.Name + ".xml"; this.results.Enabled = true; } private void exitToolStripMenuItem_Click(object sender, EventArgs e) { Application.Exit(); } private void aboutToolStripMenuItem_Click(object sender, EventArgs e) { new AboutBox().ShowDialog(); } private void onlineHelpToolStripMenuItem_Click(object sender, EventArgs e) { System.Diagnostics.Process.Start("http://www.remotesoft.com/deprotector/manual.html"); } private void decyptionArticleToolStripMenuItem_Click(object sender, EventArgs e) { System.Diagnostics.Process.Start("http://www.remotesoft.com/deprotector/index.html"); } // the .NET Explorer cmd we can invole to view all dumped modules static string dotexplorer = null; private void results_LinkClicked(object sender, LinkLabelLinkClickedEventArgs e) { // open the dump directory if (dumpDir != null) Process.Start(dumpDir); // trying to find .NET Explorer if (dotexplorer == null) { RegistryKey lm = Registry.LocalMachine; RegistryKey sc = lm.OpenSubKey("Software\\Remotesoft\\DotExplorer"); if (sc != null) { dotexplorer = (string)sc.GetValue("InstallDir"); dotexplorer += "\\dotexplorer.exe"; sc.Close(); dotexplorerInstallLink.Visible = false; dotexplorerInstallLink.Enabled = false; } else { MessageBox.Show("Remotesoft .NET Explorer is not installed.\nPlease click the link beside View results to download and install it."); dotexplorerInstallLink.Visible = true; dotexplorerInstallLink.Enabled = true; return; } } // find the result xml file ArrayList dumpedFiles = new ArrayList(); ReadResultXML(dumpedFiles); // invoke .NET Explorer to load all dumped files string allfiles = ""; bool first = true; foreach (string fn in dumpedFiles) { if (first) first = false; else allfiles += ";"; allfiles += fn; } // launch .NET Explorer, load all dumped assemblies ProcessStartInfo processStartInfo = new ProcessStartInfo(dotexplorer); processStartInfo.Arguments = allfiles; Process process = Process.Start(processStartInfo); } /// /// Read the result xml file /// /* */ public void ReadResultXML(ArrayList dumpedFiles) { XmlTextReader reader = new XmlTextReader(resultXMLFile); // Create an XmlDocument from the XmlTextReader XmlDocument xmldoc = new XmlDocument(); xmldoc.Load(reader); // Start from the document Element, XmlElement root = xmldoc.DocumentElement; XmlNode module_node = root.FirstChild; while (module_node != null) { XmlNode node = module_node.FirstChild; while (node != null) { if (node.Name.Equals("dump")) { string dumpfile = GetNodeValue(node); dumpedFiles.Add(dumpfile); break; } node = node.NextSibling; } module_node = module_node.NextSibling; } reader.Close(); } private static string GetNodeValue(XmlNode node) { if (node.FirstChild != null) return node.FirstChild.Value; else return ""; } private void dotexplorerInstallLink_LinkClicked(object sender, LinkLabelLinkClickedEventArgs e) { System.Diagnostics.Process.Start("http://remotesoft.com/eval_download/Remotesoft_DOTNET_Explorer_Evaluation.msi"); } } }