Programs such as Detect It Easy or IDA can show functions and libraries (DLLs) imported by a binary in the case of C/C++ binaries. I have a collection of .NET malware that I'm analyzing and would like to see the imported functions and DLLs for these binaries. I've noticed that _CorExeMain is the only thing that I can see in the imports section with tools such as IDA for such binaries. I'm aware that I can decompile the .NET binary in a tool like dnSpy and manually read the function calls but I would like an automated and fast of doing this such as the imports section in IDA.

Is there a way to see functions imported from dynamic libraries for .NET binaries?

  • use proper tools - dnSpy or other decompiler that's targeting .NET programs. Nov 15, 2019 at 6:34
  • I already mentioned dnSpy in my question. I still have to manually find the library calls by reading the code. Is there a section in dnSpy that I'm missing where all the function calls are shown in one place?
    – learnerX
    Nov 15, 2019 at 6:38
  • @learnerX so do I understand correctly that you want the list of all methods that a specific .NET program uses based on its references? Nov 15, 2019 at 6:44
  • @PawełŁukasik yes, I would like to see the list of all library function calls like in the imports view in IDA
    – learnerX
    Nov 15, 2019 at 7:02
  • to get native function calls might be tricky if impossible (maybe some magic done after methods are JITed) - to get the list of managed function calls might be possible to get. Nov 15, 2019 at 7:30


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.