0

For a challenge at OWASP WrongSecrets I have build a self-contained binary to be reverse engineered (see https://github.com/OWASP/wrongsecrets-binaries/actions/runs/8244751569), but, I have not been able to find the secret with Ghidra or Radare2 on MacOS. How can I best find the secret using tools on Linux or MacOS?

Improve this question

1 Answer 1

Reset to default
1

Self-contained executable are usually an executable part and attached inside the executable the DotNet assembly dll files. Decompiling using Ghidra/Radare first will get you into the executable part which is not application-specific, but the DotNet runtime.

Therefore I recommend using a DotNet decompiler like ILSpy. It is capable of loading the assembly DLL files included in the executable and decompile e.g. the Main method of the DotNet application (see assembly dotnetproject).

Unfortunately ILSpy is a Windows program and not available for MacOS. Homebrew has an ilspy cask, but that only installs an old Avalonia, an old and discontinued port of ILSpy. I am not sure if that port is already able to open and decompile the packed DotNet executable.

Improve this answer
1
  • Thank you sir! The lispy cask gave metadata errors when I tried to open the file… is there an alternative possible for Linux/Macos besides running a VM?
    – Jeroen
    Commented Mar 24 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.