1

I'm trying to reverse engineer a C# file that requires a password to continue running. When I load it in IDA Pro I get nothing in the functions window and a sp-analysis failed

What I see when loaded

  • for the record I'm new to this so sorry if I'm just stupid – KibbeWater Mar 15 at 17:45
  • You probably want dotPeek or similar for C#, not IDA. It's compiled to an intermediate language, not assembler, and with plenty of metadata included so is much simpler to decompile. – Rup Mar 16 at 0:41
  • when I try in reflector I just get errors about no metadata – KibbeWater Mar 16 at 9:05
  • Why do you think it’s C#? – Igor Skochinsky Mar 16 at 15:04
  • first use De4Dot on the C# file to clean it up, then use .NET Reflector or JustDecompile on it – SSpoke Mar 23 at 3:15
2

If this is C# (or any other .NET file) you need to use a tools such as .NET reflector to "decompile" it into .NET intermediate language.

Anyhow...

The error you are seeing means that at the end of a function the stack pointer (typically the ESP register) does not point to the address expected by the function type, for example: it may have PUSHed something on the stack and did not POP it by the end of the function.

This warning does not stop analysis, but you should be aware of the situation when JMPing between addresses.

Tip:

In general settings you can choose the "show stack pointer" options and see the state of the stack.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.