0

I have a .NET executable that apparently has some embedded DLLs. It's just one standalone executable. I opened this executable with JetBrains dotPeek and ILSPY, both decomiplier are showing DLL names under "Reference" but can't locate where those dlls are. ILSpy example:

ilspy example

As you can see, I can't expand those DLLs to see what inside. I suspect that ILmerge similar utility is used to combine dlls inside a standalone exe. I wonder if it's possible to extract those dlls.

Improve this question

1 Answer 1

Reset to default
2

They are not inside the application, there should be somewhere on your machine and will be loaded at runtime. You can use Process Monitor to check from where they are loaded.

ILSpy should be able to go into those DLLs so if it can't it might be an indication that it can't find them.

Improve this answer
8
  • thanks for reply. Yea, ILSpy can't find those dlls, neither dotPeek does. I used Process Monitor and launched the application, when searching through Process Monitor logs for dll name, it shows few hits of "PATH NOT FOUND" and "Name NOT FOUND", that's all. It seems like it's trying to locate this dll in same working directory and it can't find it. The application is self contained and it works fine, everything inside one exe and you can run on fresh machine with just .NET framework and it works fine too.
    – Anthony J.
    Jun 19, 2017 at 16:13
  • 2
    if that's the case then the dlls might be somewhere else. Check Resources - maybe there's something there. .NET gives you the ability to see the whole source code so the code for extracting those should also be there
    – Paweł Łukasik
    Jun 19, 2017 at 17:02
  • I checked resources and I couldn't find it. is possible that it's extracting those dlls to memory and loading those dlls from there? if you are interested you can find the one legit utility that is using this technique here: we.tl/BsR70rNuvb
    – Anthony J.
    Jun 20, 2017 at 8:04
  • 1
    might be possible - but it's sounds a lot of trouble to do so. Anyway - the code is there. Why not opening it in dnSpy, debug and see what's going on?
    – Paweł Łukasik
    Jun 20, 2017 at 8:11
  • 1
    yep you already mentioned resources but at that time I couldn't open extracted resources so I though they are not there. Anyway, I did what libZ developer said here: github.com/MiloszKrajewski/LibZ/issues/17. it looks like extracted file are compressed or encrypted, I'm just trying to figure this out now. thanks.
    – Anthony J.
    Jun 20, 2017 at 11:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.