2

I'm trying to reverse engineer a C# file that requires a password to continue running. When I load it in IDA Pro I get nothing in the functions window and a sp-analysis failed

What I see when loaded

Improve this question
5
  • for the record I'm new to this so sorry if I'm just stupid
    – KibbeWater
    Commented Mar 15, 2020 at 17:45
  • You probably want dotPeek or similar for C#, not IDA. It's compiled to an intermediate language, not assembler, and with plenty of metadata included so is much simpler to decompile.
    – Rup
    Commented Mar 16, 2020 at 0:41
  • when I try in reflector I just get errors about no metadata
    – KibbeWater
    Commented Mar 16, 2020 at 9:05
  • Why do you think it’s C#?
    – Igor Skochinsky ♦
    Commented Mar 16, 2020 at 15:04
  • first use De4Dot on the C# file to clean it up, then use .NET Reflector or JustDecompile on it
    – SSpoke
    Commented Mar 23, 2020 at 3:15

2 Answers 2

Reset to default
3

If this is C# (or any other .NET file) you need to use a tools such as .NET reflector to "decompile" it into .NET intermediate language.

Anyhow...

The error you are seeing means that at the end of a function the stack pointer (typically the ESP register) does not point to the address expected by the function type, for example: it may have PUSHed something on the stack and did not POP it by the end of the function.

This warning does not stop analysis, but you should be aware of the situation when JMPing between addresses.

Tip:

In general settings you can choose the "show stack pointer" options and see the state of the stack.

Improve this answer
0

about analysis failed, you can refer official doc:

analysis failed

maybe can find the solution to fix it.

my case is Decompilation failure: xxx call analysis failed, and refer it to find out solution.

For more detail pls refer another post's answer

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.