Is reverse engineering managed code from .NET easier or harder? I think it might be Java bytecode that can be easily converted back into source code. Is managed code from .NET similar, and why?
Reverse engineering .net without any anti-reverse engineering protections is trivial.
The reason is that programs like these are compiled down to an intermediate language that we call bytecode which contains high level information (symbol names,data definitions etc) making it possible to recover source code almost similar to the original which simplifies the reverse engineering process.
So is .NET malware usually compiled into native images and obfuscated, or is it usually just obfuscated .NET code?
I doubt malware authors want something like .net converted to native code.
The reason behind someone using .net malware is i guess because it can run on many platforms without caring about processor architecture so in .net malware they definitely want CIL to be there.
Also think about the different languages .net supports.
In general, bytecode is easier to reverse engineer than compiled code. It (usually) contains a lot more metadata and uses an idealized computing model. A good obfuscater can make this much harder, but still not nearly as complex as native code written with reverse engineering in mind. This is because bytecode languages don't allow nearly as many 'tricks' as real-world processors because they are designed to be higher level, safer, and portable.
Note that .NET code can also be compiled into native images as described by MS in the article Compiling MSIL to Native Code. this is usally used for obivous security reasons :
- Code harder to reverse engineer
- No need of the JIT compiler at runtime