1

When loading a DLL that uses the CLR (.NET runtime) and contains native code, IDA (as of 8.4) will always prefer to load it as "Microsoft.Net assembly" with processor type "Microsoft Visual Studio.Net" (cli).

Now that's not entirely wrong, but for a mixed assembly it's off mark. Aside from manually loading as "Portable executable for AMD64 (PE)" with "MetaPC" as the processor type) what options do I have to have IDA help me make sense of the managed and unmanaged parts of such an assembly?

Many DLLs created with C++/CLI are mixed assemblies.

PS: "assembly" in this question refers to the .NET/CLR concept, not to the assembly language.

1 Answer 1

0

Although that wouldn't necessarily be a perfect solution to your problem, you could dump the native code from the ida database and open it in a separate ida database and loading as "Portable executable for AMD64 (PE)" with "MetaPC" as the processor type as you wanted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.