How to debug a .net DLL?

Question

I'm trying to reverse engineer a .net malicious EXE but it loads a DLL inside its memory. I have tried to debug this DLL using a tool called SharpDllLoader and dnspy but I have 2 issues:

First one:

(Cannot create an abstract class.) I searched a little bit and find out that the class inside DLL is static.

Second one:

After modifying the class type, I have another issue (no parameterless constructor defined for this object)

I'm not expert in c# but these issues appears after executing CreateInstance

private static void Main(string[] args)
{
    ParserResult<Options> result = Parser.Default.ParseArguments<Options>(args);
    if (result.Tag != ParserResultType.Parsed)
    {
        Environment.Exit(1);
        return;
    }
    Options options = ((Parsed<Options>)result).Value;
    string filepath = options.Dll;
    string ns = options.Namespace;
    string c = options.Class;
    string i = options.Method;
    string[] arguments = null;
    if (options.Args != null)
    {
        arguments = options.Args.Split(new char[0]);
    }
    Assembly assembly = Assembly.LoadFile(filepath);
    Type type;
    if (ns == null)
    {
        type = assembly.GetType(c);
    }
    else
    {
        type = assembly.GetType(ns + "." + c);
    }
    if (!(type != null))
    {
        Console.WriteLine("Class or namespace not found");
        return;
    }
    object cl = Activator.CreateInstance(type); //Here

Solution

I have tried another way to get an instance of this object without running any constructors by using FormatterServices.GetUninitializedObject(type).

https://stackoverflow.com/questions/2501143/activator-createinstancetype-for-a-type-without-parameterless-constructor

Answer 1

By far the easiest way to work with a .NET DLL is to just add it to a console app in the IDE.

• Create a new console app in Visual Studio / Rider, etc. - make sure it's the right Core / Framework version if possible (you'll find out soon if not)
• Add the DLL as a reference to the project (right-click References, Add Reference, Browse)
• You can then just work with the classes and call your static method directly

  The.Namespace.ClassName.Method();
  

However you're then at the mercy of any static initialisation in that class or any classes referenced by that class, which might be something to worry about if you think this is malicious code. (But in that case you should be reading it not running it I expect.)

To make your existing loader work you can just call the static method on your type directly without making an instance, e.g.

type.GetMethod(i).Invoke(null, null);

(relevant StackOverflow question)