1

I've been analyzing a malware written in C# using dnSpy. It loaded a dotnet assembly DLL from its Resources: the malware calling a method from loaded DLL

I tried stepping into InvokeMember function, but could not go further when hitting this call: enter image description here

I've dumped the DLL to file to analyze it statically, but the code is protected by SmartAssembly, so I cannot fully understand its behavior.

My question is: how can I step into the code of the method called by "InvokeMethod"? If I cannot do it directly, is there any workaround?

0

I've figured out the solution. It's simple. We only need to set a breakpoint inside the DLL.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.