If I'm looking at a binary compiled with VC++ in a hex editor and I want to identify the start of functions - I can look for the hex "55 8B" - which is a common function prolog.
Is there something equivalent with .net CIL? I.e. is there a hex pattern I can look for to identify the start of functions raw?
The application here is to look for shared code between malware samples.
There is no real prolog in IL code because it does not need to manage the stack, save clobbered registers, or do any other standard bookkeeping necessary in the native code.
However, the bytecode itself is preceded by the method header, and those have a limited number of possibilities. From the book .NET IL Assembler:
Method Header Attributes
The RVA value (if it is nonzero) of a Method record points to the method body. Two types of method headers—fat and tiny—are defined in CorHdr.h. The first two bits of the header indicate its type: bit 10 stands for the tiny format, and bit 11 stands for the fat format.
[...]
A tiny method header is only 1 byte in size, with the first two (least significant) bits holding the type—10—and the six remaining bits holding the method IL code size in bytes. A method is given a tiny header if it has neither local variables nor managed exception handling, if it works fine with the default evaluation stack depth of 8 slots, and if its code size is less than 64 bytes. A fat header is 12 bytes in size and has the structure described in Table 10-1. The fat headers must begin at 4-byte boundaries. Figure 10-4 shows the structures of both tiny and fat method headers.
So if you take some .NET binaries, look up method RVAs in the metadata and go to that RVA in the binary, you can collect some patterns of headers and use them to find bytecode in the binary. (although I would suggest just using metadata in the first place - it lists locations of all legitimate methods in the binary).
I dont think .NET is as simple.. you can clearly see it in IDA Pro - there at least a few different one byte function prologues.
Why not use a decompiler library for dnSpy/de4dot - dnlib to decompile and then use code clone detection, for example Simian or implement some fuzzy matching (hashing?) algorithm.
.NET generally decompiles nicely when its not packed or obfuscated. If it is however obfuscated or packed you will not have a great deal of success in matching the functions.
