Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [.net]

The .NET framework is a software framework designed mainly for the Microsoft Windows operating system. It includes an implementation of the Base Class Library, Common Language Runtime (commonly referred to as CLI) and Dynamic Language Runtime. It supports many programming languages, including C#, VB....

1
vote
0answers
40 views

C# Hidden Method through transparent proxy object?

I'm dealing with an interesting form of obfuscation. A C# program I am reversing has a central API, let's call it "Central API". This Central API has several functions that aren't exactly defined. ...
1
vote
2answers
54 views

.NET assembly IDA PRO, using LDSTR IL op code, how to patch a string?

I'm trying to patch a string. So right now I'm trying to replace instruction LDSTR with LDSTR "mystring"; however, I have been unsuccessful. After assembling the LDSTR op code, I don't quite ...
1
vote
0answers
113 views

Can de4dot deobfuscate Dotfuscator Professional?

I ran de4dot on a Xamarin app obfuscated using Dotfuscator Professional. However, there's still the random switches and strange ints everywhere. Can de4dot decode this? If not, is there another tool ...
0
votes
0answers
17 views

Using yara to obtain information from binary (not matching)

I would like to use yara to extract information from a binary. I went through the doc but did not understand how to always get a certain piece of information. For example: import "dotnet" rule ...
2
votes
1answer
180 views

android unity intercept w/ Frida

I'm trying to extract symbols from an Android Unity game to detect something related to the game which I can intercept and replace variables. The following code will enumerate symbols from libmain.so,...
1
vote
0answers
34 views

Decompiling DotNet2JScript malware?

I've got a .NET malware sample that was transpiled to JScript using DotNet2JScript. The .NET malware assembly was serialized to binary form using BinaryFormatter and then embedded into the JScript ...
5
votes
1answer
359 views

dnSpy - What do these symbols mean?

When decompiling a dll file there are certain lines of code that read like this: return \u0013.\u0002.\u0001(url, info); I have two questions on this: 1) does \u00xx mean that it is obfuscated, if ...
0
votes
0answers
26 views

How to get the count of classes and methods contained in a DLL?

I know the ildasm.exe tool will show me, but in scenarios where i need to a manual check on 2 dll having count of namespaces,classess,methods etc. Please suggest a best approach which can give me ...
1
vote
2answers
453 views

.NET: It's possible to recover original source code from compiled .exe when I have all the .vshost, .pdb and compiled files?

I have the compiled code with all .pdb, vshost and everything that is generated. I am already using DotPeek without too much hassle. Would like to know If I can retrieve the original code with all the ...
0
votes
0answers
157 views

Dotpeek problem decompiling code?

As part of a reverse-engineering challenge on Hackthebox.eu I've tried to decompile a .net executable file. The entire program decompiled successfully but it has two errors. I will post below the ...
4
votes
1answer
118 views

How to tell if a particular .NET assembly was written in C# or F#?

The motivation for this question is that I used JetBrains dotPeek to decompile an .exe written in F#, but the output project directory produced C# code. Why does decompiling an F# assembly produce C# ...
1
vote
0answers
476 views

View static field values in dnSpy

I'm using dnSpy (version: 4.5.3) to debug a .NET binary. I can successfully view the values of Local variables in the Locals window but I cannot view the values of static fields. However, per this ...
2
votes
1answer
129 views

How to find the name of the method in Managed Code using Windbg and SOS?

I've got a crash dump, the application definitely crash in JIT optimized assembler code. I know the start address of the method. How do I find its name using using Windbg and SOS extension? Currently ...
2
votes
0answers
498 views

Unable to unpack heavly obfuscated malware

I'm trying to unpack malware packed with ConfuserEx 1.0.0 and I can't seem to get it to work. Each time I remove the anti-tamper the whole file gets corrupted. I tried all possible tools that I found ...
3
votes
1answer
224 views

How to deobfuscation the public class names .NET

I already try de4dot with all dlls and exe and try remove strong name and don't work. what am I doing wrong?
1
vote
1answer
533 views

Reverse engineering of Managed C++/C# CrackMe

I'm reverse engineering the CrackMe which is written on Managed C++/C#. Arguments are "string" (email in this case) and "serial". Serial is somehow depends on string and I need to understand how. I ...
1
vote
1answer
98 views

Modified dll works as original without debugger attached

I'm trying to make some changes to .Net dll (note: dll is mixed mode module) used by an exe, ProtectionID detected nothing, so I happily jumped into dnSpy and made changes. I ran executable with ...
1
vote
0answers
481 views

de4dot and Dotfuscator: IL looks different, not DotPeek decompiled code

From the obfuscated to the deobfuscated assemblies, IL code looks different using ILDASM; however, DotPeek decompiled C# code looks exactly the same for both. Any clue why? The obfuscation software ...
0
votes
0answers
414 views

Trying to dump an assembly .NET

I have an application made in mono. Someone is injecting a dll to make "bad things". I've been able to detect it because it adds an event to AppDomain and with some reflection I detect the assembly. ...
0
votes
2answers
119 views

Do .NET functions have function prologs?

If I'm looking at a binary compiled with VC++ in a hex editor and I want to identify the start of functions - I can look for the hex "55 8B" - which is a common function prolog. Is there something ...
1
vote
0answers
271 views

Is there an existing tool to reverse engineer Xamarin AOTDATA files?

I am currently examining a xamarin application. It has used the "ahead of time compilation" feature, which has left some of the associated .net assemblies (.dlls) as lists of function signatures ...
0
votes
2answers
560 views

Trying to call a function in an unknown DLL

My goal is far from nefarious. After several polite attempts to try and get Lenovo to implement a proper keyboard backlight control, I've had no response. They do have a Windows Store app which adds ...
1
vote
1answer
282 views

Modifying a string in a .net binary

I have a .net exe called foo.exe I open foo in a hex editor (HxD) and search for myString. I do not see it. I open foo.exe in ILSpy and was able to find myString. I do see human readable text in the ...
0
votes
1answer
349 views

Extracting embedded dlls from .NET executable

I have a .NET executable that apparently has some embedded DLLs. It's just one standalone executable. I opened this executable with JetBrains dotPeek and ILSPY, both decomiplier are showing DLL names ...
3
votes
0answers
241 views

Is there a static data flow analysis tool for .net assemblies?

I read here that CAT.NET and FxCop are dead. As far as I understand, the successor Roslyn requires a visual studio project and source code. Is there a tool that reads in a compiled .NET program and ...
0
votes
0answers
75 views

How is .NET related to Windows system calls?

My understanding is that .NET (C#) code compiles to Common Intermediate Language (CIL) code, which then (usually) gets Just-In-Time compiled to native machine code at run-time on the deployment ...
1
vote
1answer
291 views

Encryption (AES-128) in automatic meters reading

I have theoretical questions about encryption when there's a lot of devices involved. Specifically it's about reading meters (water/gas/heat meters). Here's some introduction. I was trying to read a ...
2
votes
1answer
7k views

What to do with ILSpy error “This file does not contain a managed assembly”?

I'm trying to decompile an unknown Win32 executable using ILSpy. However, it only answers by giving me the useless message: This file does not contain a managed assembly. I have also tried to use ...
1
vote
2answers
243 views

How to programatically extract function names, function arguments and strings from a .NET binary?

My goal is to extract function names, the libraries they come from (if the functions were imported), function arguments, and strings from a .NET binary. How can I do this? Is this possible using ...
2
votes
0answers
71 views

Am I seeing this dll's innards correctly? [closed]

The dll in question is custom, from a retail/consumer software package that was first offered for sale in 2006/2007. I am fairly confident that it was compiled with Visual Studio .NET (2003). My ...
1
vote
1answer
695 views

Is it possible ( or how) to dump source code/machine code from memory?

I am actually working for the side of software protection. But in order to properly protect my source code ( be it .Net or C++), I would need to understand what is achievable ( and not achievable) ...
1
vote
1answer
935 views

Are .NET DLLs, even the best obfuscated ones, less secure than C++ DLLs?

From what I understand about .NET code, it is first compiled to Microsoft Common Intermediate Language (MSIL) before being translated to machine code at runtime. Whereas C++ code is compiled directly ...
3
votes
3answers
7k views

Edit codes in .Net Reflector with Reflexil (Compile Window)

I'm Using .Net Reflector with Reflexil to edit or view .net Assembly codes. I see this picture in reflexil.net: reflexil.net http://sebastien.lebreton.free.fr/reflexil/img/screenshot1.png It Shows ...
1
vote
1answer
756 views

Cannot detect obfuscator of the obfuscated DLL

I want to do a reverse-engineering of an obfuscated Unity DLL assembly, but de4dot doesn't work. It says "Unknown Obfuscator". Also tried iMPROVE and it says that there is a 97% chance that it is a ...
1
vote
1answer
2k views

Is it possible to debug a .Net executable with IDA?

When I load a .Net executable into IDA then there is no Debug menu as when I load a normal binary. Is there any way to enable the debug functionality for .Net as well? I'd like to step into some ...
1
vote
1answer
56 views

Compressed stream unopenable with external tools

I'm trying to reverse-engineer the file format of a game's save files. The game is written in Unity, thus .NET, so it was possible to view an approximated code with RedGate Reflector. Right now I ...
7
votes
2answers
598 views

Reverse Engineering Chinese laser engraver

I would like to reverse-engineer the software that came with my Chinese-made laser engraver. Unfortunately the hardware does not play at all with other software out there... The original software is ...
8
votes
2answers
2k views

How to retrieve native asm code from .NET mixed mode dll file?

This is seriously one question I couldn't find the answer to anywhere on Google.com When I mean mixed mode I mean .NET application which has unmanaged and managed code together. I used tools .NET ...
2
votes
1answer
6k views

How to disassemble .NET after using Confuser

I want to test malware that wrote in .NET 4.5 and obfuscated by Confuser 1.9. I have tried to open it with .NET Reflector, ILSpy and dotpeek, but all of them can't open it. How can I debug (and ...
2
votes
1answer
1k views

In-memory patching of .net code

Are there techniques for patching .net executables in memory? Let's say we've have a .net dll/exe, we identified what method we want to patch and what IL to replace the existing code with. Executing ...
1
vote
1answer
2k views

Opening mono droid .so files in .NET decompiler

What is the format for .so native android files developed in Xamarin Mono droid? From this SO post it appears they are actually .NET IL binaries (not native machine code). However, this other SO post ...
2
votes
2answers
1k views

Techniques for reverse engineering an unknown or protected file format

I'm working on converting a game originally developed to run on Windows for the web. I have a bunch of artwork for the game received from the artist in .tga image files which open fine in Photoshop. ...
1
vote
1answer
101 views

How can I find the implementation/source code of an interface in .NET?

So I'm disassembling the Winnov.Amalga.Core.Session.Common.dll, and trying to figure out how the WriteScriptCommand works. I'm absolutely new to .NET, so go easy on me, please. You can find the dll ...
0
votes
0answers
522 views

How to change the DLL name in the already compiled application?

I am trying to change the name of the DLL file I had specified for my application before compiling it. When I change the DLL file name I get the error message like: System.IO.FileNotFoundException: ...
-1
votes
2answers
1k views

How can I use an x64 debugger to reroute a .NET application's logic?

I'd like to improve my reverse engineering skills, so I made this WPF application (targeting x64, of course): MainWindow.xaml: <Window x:Class="ApplicationTest.MainWindow" xmlns="http://...
4
votes
3answers
24k views

Modify code with ILSpy

I want to modify an exe a little bit. With ILSpy I see all the code that I need but I don't know how to modify the code. I tried "save code" on ILSpy that exports a .cs file, but when I open the .cs ...
2
votes
1answer
2k views

Methods of discovering the location of nag/pop-up screens besides string search?

I would like to remove a nag screen from a popular program. To do this I need to make sure the screen never gets called. So, the first task is to find the actual location of the nag (where it is ...
0
votes
1answer
52 views

Is the security of this .net application flawed? [closed]

Ok, I know that every obfuscated .Net application can be reverse engineered. And I know that it is better if I go the open source way if possible. But unfortunately I cannot because there is no ...
8
votes
4answers
8k views

Recovering .NET sources into full blown project

I wonder if total decompilation of arbitrary non packed project .NET is possible? If no, what is the conditions that should be met to make it possible? If yes, is there tools that can automate this? I'...
6
votes
2answers
610 views

Decompiling .NET marshaled code

There's a .NET malware sample I'm trying to analyze, which goes more or less like this: internal static class Class1 { public static byte[] Code = new byte[] { 9, 249, ...