1

I'm trying to reverse engeneer a malware using dnSpy that at some point do this:

delegate IntPtr H7IREAEBYY(string path, IntPtr data);
byte[] array = new byte[]
        { 233, 151, ... }

IntPtr value = IntPtr.Zero;
IntPtr intPtr = W47PO0IHP8.VirtualAlloc(IntPtr.Zero, (uint)array.Length, 12288U, 64U);
Marshal.Copy(array, 0, intPtr, array.Length);
        W47PO0IHP8.H7IREAEBYY h7IREAEBYY = (W47PO0IHP8.H7IREAEBYY)Marshal.GetDelegateForFunctionPointer(intPtr, typeof(W47PO0IHP8.H7IREAEBYY));
h7IREAEBYY(path, intPtr2);  

When the delegate is executed the debugger step over the delegate and i can't analyze such code, how can i analyze or disassemble the code in the array that is executed through a delegate?

0

You cannot do that with dnSpy, as the code that is stored in array is not managed code but native. So you have to extract that bytes, saved them in a file and analyze spearately with a native disassembler like r2, Ghidra, IDA etc.

As for stepping into, it's the same. You have to use a native debugger and not the one from dnSpy.

Since this is a mixed binary it might be tricky to setup the system in such a way that you could step from one part of the code debugged in dnSpy and to the other that is native.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.