2

When i compile a c# code, it compiles into a .NET executable, that only imports _CorExeMain from mscoree.dll, now my questions are :

  1. Is _CorExeMain the interpreter that fetches ILs and executes their corresponding x86 code just like VMprotect, etc?

  2. Where are the IL bytes actually stored? they seem to be stored in the .text section, but i couldn't find any tool that can find the location that they are stored. where are they stored?

Improve this question
3
  • Press Ctrl+F in any hexeditor and search for these bytes
    – morsisko
    Commented Feb 14, 2021 at 12:44
  • @morsisko bruh.. I'm asking how can i find them so i can write a tool that finds them automatically.. not searching for bytes..
    – Notoriouss
    Commented Feb 15, 2021 at 5:55
  • Sorry, my crystal ball didn't work this time. I think my answer still answers the question "how can I find them", as there are multiple programs that can display the IL bytes so you can search the desired position in executable...
    – morsisko
    Commented Feb 15, 2021 at 17:12

1 Answer 1

Reset to default
2

For .NET assemblies there's a .NET MetaData Directory that can be found in the Data Directories. From that you can get access to MetaData Header and MetaData Streams that holds all the info for you to extract and located the code.

A good start (or maybe even a complete guide) into this topic would be the "Anatomy of a .NET Assembly" by Simon Cooper.

For the first question - yes, the _CorExeMain is the entry point that does all the tricks to make your assembly to execute. For the explanations of all the things that happen during that call check The 68 things the CLR does before executing a single line of your code

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.