1

I'm trying to reverse engineer a .net malicious EXE but it loads a DLL inside its memory. I have tried to debug this DLL using a tool called SharpDllLoader and dnspy but I have 2 issues:

First one:

(Cannot create an abstract class.) I searched a little bit and find out that the class inside DLL is static.

Second one:

After modifying the class type, I have another issue (no parameterless constructor defined for this object)

I'm not expert in c# but these issues appears after executing CreateInstance

private static void Main(string[] args)
{
    ParserResult<Options> result = Parser.Default.ParseArguments<Options>(args);
    if (result.Tag != ParserResultType.Parsed)
    {
        Environment.Exit(1);
        return;
    }
    Options options = ((Parsed<Options>)result).Value;
    string filepath = options.Dll;
    string ns = options.Namespace;
    string c = options.Class;
    string i = options.Method;
    string[] arguments = null;
    if (options.Args != null)
    {
        arguments = options.Args.Split(new char[0]);
    }
    Assembly assembly = Assembly.LoadFile(filepath);
    Type type;
    if (ns == null)
    {
        type = assembly.GetType(c);
    }
    else
    {
        type = assembly.GetType(ns + "." + c);
    }
    if (!(type != null))
    {
        Console.WriteLine("Class or namespace not found");
        return;
    }
    object cl = Activator.CreateInstance(type); //Here

Solution

I have tried another way to get an instance of this object without running any constructors by using FormatterServices.GetUninitializedObject(type).

https://stackoverflow.com/questions/2501143/activator-createinstancetype-for-a-type-without-parameterless-constructor

2
  • What are you trying to do: just call a static method on a static class? Or something more complicated?
    – Rup
    Sep 28, 2021 at 20:27
  • Have you had a look at Mono.Cecil?
    – 0xC0000022L
    Sep 29, 2021 at 10:01

1 Answer 1

2

By far the easiest way to work with a .NET DLL is to just add it to a console app in the IDE.

  • Create a new console app in Visual Studio / Rider, etc. - make sure it's the right Core / Framework version if possible (you'll find out soon if not)
  • Add the DLL as a reference to the project (right-click References, Add Reference, Browse)
  • You can then just work with the classes and call your static method directly
    The.Namespace.ClassName.Method();
    

However you're then at the mercy of any static initialisation in that class or any classes referenced by that class, which might be something to worry about if you think this is malicious code. (But in that case you should be reading it not running it I expect.)

To make your existing loader work you can just call the static method on your type directly without making an instance, e.g.

type.GetMethod(i).Invoke(null, null);

(relevant StackOverflow question)

1
  • Thanks for replying. I solved the first issue when I re-defined class to non-static. The second issue I used another way to get an instance of object without running any constructor using FormatterServices.GetUninitializedObject(type) and works without any problems. link
    – ManJaro
    Sep 29, 2021 at 17:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.