Programs such as Detect It Easy or IDA can show functions and libraries (DLLs) imported by a binary in the case of C/C++ binaries. I have a collection of .NET malware that I'm analyzing and would like to see the imported functions and DLLs for these binaries. I've noticed that _CorExeMain is the only thing that I can see in the imports section with tools such as IDA for such binaries. I'm aware that I can decompile the .NET binary in a tool like dnSpy and manually read the function calls but I would like an automated and fast of doing this such as the imports section in IDA.

Is there a way to see functions imported from dynamic libraries for .NET binaries?

  • use proper tools - dnSpy or other decompiler that's targeting .NET programs. Nov 15 '19 at 6:34
  • I already mentioned dnSpy in my question. I still have to manually find the library calls by reading the code. Is there a section in dnSpy that I'm missing where all the function calls are shown in one place?
    – learnerX
    Nov 15 '19 at 6:38
  • @learnerX so do I understand correctly that you want the list of all methods that a specific .NET program uses based on its references? Nov 15 '19 at 6:44
  • @PawełŁukasik yes, I would like to see the list of all library function calls like in the imports view in IDA
    – learnerX
    Nov 15 '19 at 7:02
  • to get native function calls might be tricky if impossible (maybe some magic done after methods are JITed) - to get the list of managed function calls might be possible to get. Nov 15 '19 at 7:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.