I am performing a security assessment on a .NET application. dnSpy is a great tool to do this. However, I've reached a module which is not in the "main" section of the program... It is loaded by the program (it's a DLL). I need to find out which code calls a class/method from the DLL and one way I thought of doing this is to debug the program. However, I would have to discover manually which functionality I need to perform in the program in order to get it to call this particular class.

Is there a better way to do this? I also tried to search for the text call to the method in the source code but haven't found anything significant. Lastly, in OllyDbg, a user can manually load a DLL using its DLL loader. Is this possible to do in dnSpy or another .NET tool?

  • does this DLL contains managed code too? – Paweł Łukasik Feb 6 '20 at 19:34
  • @PawełŁukasik yes – the_endian Feb 6 '20 at 19:44
  • ok, Analyze is not enough in this case to see where it's being called from? – Paweł Łukasik Feb 6 '20 at 20:03
  • @PawełŁukasik ah that helped - I was not aware of the Analyze command. Took me a bit to find it but I located it in a right-click context menu for the object. There are some values which show nothing under "read by" but I'm skeptical because I'm sure they're used. – the_endian Feb 7 '20 at 6:26
  • it would be easier to help working with real files as now we are a bit speculating why/why not they are there. Can you attach the files and add a comment one of which class you are looking for usages? – Paweł Łukasik Feb 7 '20 at 8:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.