8

This is seriously one question I couldn't find the answer to anywhere on Google.com

When I mean mixed mode I mean .NET application which has unmanaged and managed code together.

I used tools .NET Reflector 6 that crashes on native methods or shows only signature to them. Also used dnEditor v0.76 beta which doesn't ever crash but also doesn't show any native x86 assembly for the areas it couldn't decompile.

I get code like this

[SuppressUnmanagedCodeSecurity]
[MethodImpl(MethodImplOptions.Unmanaged | MethodImplOptions.PreserveSig)]
public unsafe static extern byte WritePointer(uint uint_1, void* pVoid_1, int int_4, int int_5, __arglist);

Yet no way to see the x86 assembly for this method.

I thought about injecting this dll file to a application then attaching ollydbg to it so I could dump the dll file and check it out in IDA PRO but this also doesn't work.

IDA PRO 6.8 by default doesn't even load mixed .NET programs as both .NET IL Code and decompilable native asm..

I ran out of options here, I'll try getting a real dll file and nopping it out somewhere in the middle and pasting the binary there maybe this way IDA PRO would detect it as a unmanaged dll file.

But ya I ask you any tools to achieve this?

Improve this question

2 Answers 2

Reset to default
4

The Linked Dll's native method is here you can load the dll directly in ollydbg too to find a resolved disassembly of the native method

E:\1dll>ls -l 1.dll

-rwxr-xr-x    1 Admin    Administ   268288 Dec 24 15:27 1.dll

E:\1dll>rahash2 -a md5 1.dll

1.dll: 0x00000000-0x000417ff md5: 82eab591d8bc6d293a2a07f10a5f6a46

E:\1dll>"c:\Program Files\Microsoft SDKs\Windows\v7.0A\bin\ildasm.exe" /text 1.dll | grep -i global.*writepointer -B 3

  // Embedded native code
  // Disassembly of native methods is not supported.
  //  Managed TargetRVA = 0x00005B20
} // end of global method WritePointer

E:\1dll>radare2 -qc "s 0x5b20-0x1000+0x400;af;pdf;" 1.dll

/ (fcn) fcn.00004f20 135
|          0x00004f20    51             push ecx
|          0x00004f21    53             push ebx
|          0x00004f22    55             push ebp
|          0x00004f23    56             push esi
|          0x00004f24    8b742414       mov esi, dword [esp + 0x14]     ; [0x14:4]=0
|          0x00004f28    57             push edi
|          0x00004f29    8d442424       lea eax, [esp + 0x24]           ; 0x24  ; '$'
|          0x00004f2d    6a04           push 4
|          0x00004f2f    83c004         add eax, 4
|          0x00004f32    56             push esi
|          0x00004f33    33db           xor ebx, ebx
|          0x00004f35    89442418       mov dword [esp + 0x18], eax     ; [0x18:4]=64
|          0x00004f39    e83c5a0000     call 0xa97a ;0x0000a97a(unk, unk, unk, unk, unk, unk, unk) ; fcn.0000550c+21614

radare2 doesn't seem to load the dll properly as an image but seems to load it as a raw file (as in hexeditor view) ollydbg will load the dll and will disassemble properly radare2 disassembly above and ollydbg disassembly below for the embedded native method WritePointer 

CPU Disasm
Address   Hex dump         Command                                  Comments
10005B20  /.  51           PUSH    ECX
10005B21  |.  53           PUSH    EBX                              ; Jump to mscoree._CorDllMain
10005B22  |.  55           PUSH    EBP
10005B23  |.  56           PUSH    ESI
10005B24  |.  8B7424 14    MOV     ESI, DWORD PTR SS:[ESP+14]
10005B28  |.  57           PUSH    EDI
10005B29  |.  8D4424 24    LEA     EAX, [ESP+24]
10005B2D  |.  6A 04        PUSH    4                                ; /Size = 4
10005B2F  |.  83C0 04      ADD     EAX, 4                           ; |
10005B32  |.  56           PUSH    ESI                              ; |Addr = 13F8B8
10005B33  |.  33DB         XOR     EBX, EBX                         ; |
10005B35  |.  894424 18    MOV     DWORD PTR SS:[ESP+18], EAX       ; |
10005B39  |.  E8 3C5A0000  CALL    <JMP.&KERNEL32.IsBadReadPtr>     ; \KERNEL32.IsBadReadPtr

regarding your pastebin

here is the pseudo code for the function without inside loop

radare2 -c "s 0x5cb0-0x1000+0x400;af;pdc;" 1.dll

function fcn.000050b0 () {
    loc_0x50b0:    
    push ecx
    push ebx
    push ebp
    push esi
    esi = dword [esp + 0x14]
    push edi
    eax = [esp + 0x1c]
    push 4
    eax += 4
    push esi
    ebx = 0
    dword [esp + 0x18] = eax
    0xa97a ()
    if (eax == eax
    notZero 0x5106) {
        loc_0x5106:    
        eax = dword [ebx]
        pop edi
        pop esi
        pop ebp
        dword [esp + 4] = 0
        pop ebx
        pop ecx

        loc_0x50d2:    
        ebp = dword [esp + 0x1c]
        esi = dword [esi]
        edi = 0
        if (ebp == ebp
        isLessOrEqual 0x5106)
      }
      return;
}
Improve this answer
3
  • Wow thanks so much mate, very useful knowledge!, not going to ask how you get 0x1000+0x400 can't wait until these tools updated to show raw asm code if it cant be decompiled. Thanks again
    – SSpoke
    Dec 24, 2015 at 19:11
  • 2
    that is basic pe reversing 101 it is (rva - virtual address of the rvas section + pointer to raw address ) = physical file offset btw pebrowse pro can disassemble the methods simply by double clicking on the .net metainfo tab
    – blabb
    Dec 24, 2015 at 19:25
  • thanks again I completely miss-looked Igor's solution lol I usually just click Ok without checking those options that's by far the easiest way to do it.
    – SSpoke
    Dec 24, 2015 at 19:48
3

You need to select Portable executable for 80386 (PE) from the list of loaders in IDA instead of confirming the default (Microsoft.NET assembly). IDA loader screen

Improve this answer
1
  • Oh dang haha slow moment should read more, thanks a bunch too, this is much easier to me and did the trick.
    – SSpoke
    Dec 24, 2015 at 19:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.