Reverse Engineering

Questions tagged [.net]

Ask Question

The .NET framework is a software framework designed mainly for the Microsoft Windows operating system. It includes an implementation of the Base Class Library, Common Language Runtime (commonly referred to as CLI) and Dynamic Language Runtime. It supports many programming languages, including C#, VB.NET, F# and C++.

105 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
4 votes
1 answer
97 views

How to use dnSpyEx or some other .NET debugger to attach to a .NET process started with a process-hollowing technique?

I have a .NET executable that is started using the process-hollowing technique. Here's how it looks from the Detect-It-Easy tool: I can open the image file for that process (from disk) with dnSpyEx, ...
c00000fd
  • 1,437
1 vote
2 answers
124 views

Reversing .net crypter with obfuscated imports

I have started recently with reverse engineering. I came across the linked file. It is a packed/crypted putty.exe. (WARNING: IT MAY BE BACKDOORED!!) How it's working and loading putty.exe with runpe ...
Sauseee
  • 21
1 vote
0 answers
191 views

Dumping .NET Dynamic Methods

I have a .NET exe that creates DynamicMethods whose bodies are built from a byte array and later called. I'm able to access the array, and even to disassemble it "raw" starting from the ...
Net_Newb
  • 11
1 vote
1 answer
465 views

.NET: How to debug or decompile a DanamicMethod with dnSpy?

I have a managed .NET executable that supplies the msil bytecode of a function as raw bytes. It constructs a DynamicMethod object, sets the bytecode with DynamicMethod.DynamicILInfo.SetCode() and ...
bernd feinman
  • 423
1 vote
2 answers
389 views

How to attach and step through a running .NET process?

This is quite easy to do with a low-level debugger, like x64dbg (for instance). Say, if I have a running native process I can attach to it, set a breakpoint, and then step through native code with it. ...
c00000fd
  • 1,437
0 votes
0 answers
42 views

debug native code and net code

I have a .net dll with a lot of calculations and formulas. From this dll, I want to set breakpoints to see the calculated results for a specific field. The main program is written in native code. So, ...
Mrplcmodbus
  • 1
0 votes
0 answers
84 views

How to debug C++ module/function call used in .net application?

I'm currently debugging a .net application by using dnSpy. There is a function where I have call like this <Module>.X.Y.Z.Initialize(ptr, ptr2, flag); The function belongs to a DLL and ...
programmerskitchen
  • 13
0 votes
0 answers
49 views

Retrieve all parameters of specific function: How to automate

I'm trying to reverse engineer.NET binary with dnspy. I have a decryption routine that is used to display useful strings. It takes one integer value as a parameter and uses it in the decryption ...
Raafat
  • 93
1 vote
1 answer
73 views

what is metaData of assemblies and what is used for

hi there I hope you doing well lately, I have searched about ildasm and how to protect my DLLs from reverse engineering, so I found some great open source projects (ConfuseEx..), it works when I tried ...
makri aymen abderraouf
  • 113
2 votes
1 answer
329 views

Patch .net executable via hex editor

What I am trying to do: I have an .exe written in C#. Ilspy shows the code. Inside it has a class DoWork with static field SomeValue: // Program.DoWork public static int SomeValue => 15; In code, ...
Uprooted
  • 141
1 vote
1 answer
425 views

How to step into an invoked method from a DotNet DLL in dnSpy?

I've been analyzing a malware written in C# using dnSpy. It loaded a dotnet assembly DLL from its Resources: I tried stepping into InvokeMember function, but could not go further when hitting this ...
gergeerew
  • 11
1 vote
1 answer
886 views

How to debug a .net DLL?

I'm trying to reverse engineer a .net malicious EXE but it loads a DLL inside its memory. I have tried to debug this DLL using a tool called SharpDllLoader and dnspy but I have 2 issues: First one: (...
ManJaro
  • 55
0 votes
0 answers
736 views

dnSpy - change software value during run

Im working on old software written in C# .NET for increase skills in dnSpy. im new in dnSpy. When I step-in dnSpy, the program get license information from another dll file. and the dll class are only ...
Jason
  • 79
0 votes
1 answer
321 views

dnSpy works really slow. How can I fix it?

I've been doing some stuff with a pre-compiled .NET executable. It is my first time reversing something, so I don't know much. I got a bunch of programs like ILSpy, dnSpy and dotPeek. They all do as ...
ymdred16
  • 1
1 vote
1 answer
104 views

Inserting two digits into binary per Hex - without making EXE corrupt

I dont have much knowledge with assemblers. I beg ur pardon in advance. I need to change an IP address in a win-binary (Net) where the IP its hard-coded. Just changing the IP with an Hex Editor would ...
TefoD
  • 13
0 votes
1 answer
85 views

Modify main function for C++ game file

I am trying to modify the main function for a specific decompiled .exe. More specifically, I want to remove the reference to GUI from that .exe file, so that GUI doesn't get initialised on the startup ...
Irbis77
  • 196
0 votes
0 answers
1k views

How to disassemble an obfuscated .NET DLL?

I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL: Any idea how to unpack it?
c00000fd
  • 1,437
1 vote
0 answers
874 views

C# Console Application can't load file or assembly, but needs a dll which doesn't exists?

I have a strange error. I created for testing purposes a normal Console Application and run my own Tracer which is written with the help of Mono.Cecil on this application. I embedd a Stopwatch at the ...
programming_is_bae
  • 61
0 votes
0 answers
125 views

new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?

just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
ringXzero
  • 1
1 vote
1 answer
139 views

Where are the .NET IL bytes stored in an .NET executable?

When i compile a c# code, it compiles into a .NET executable, that only imports _CorExeMain from mscoree.dll, now my questions are : Is _CorExeMain the interpreter that fetches ILs and executes their ...
Notoriouss
  • 136
0 votes
1 answer
2k views

dnSpy: how to start 32 bit version

I am very unsure if this is the right place to as or if I need to ask this at another forum, but here it goes. I am trying to reverse engineer a .NET program with the use of dnspy. I installed dnspy ...
Mr Krisey
  • 33
-1 votes
1 answer
473 views

What obfuscator is used?

In version 3.7.3.7 I was able to modify some parts of the code using dnSpy. The language is C#. But in the new(next) version, I did not succeed and I guess the code is obfuscated. De4dot did not help. ...
turb1te
  • 11
0 votes
0 answers
70 views

Failed to load .net binary on IDA Pro

I tried to use IDA Pro to load a binary file. IDA detected it as a .NET file: but when I click OK to load the program, the following error occured, and the program can't be loaded: I tried to google ...
hdvd2309
  • 1
2 votes
1 answer
647 views

Disassemble and debug dynamic generated code executed via delegate in c#

I'm trying to reverse engeneer a malware using dnSpy that at some point do this: delegate IntPtr H7IREAEBYY(string path, IntPtr data); byte[] array = new byte[] { 233, 151, ... } IntPtr value ...
n0t0r1us
  • 21
2 votes
1 answer
106 views

Structure of operand bytes in .NET call and data access IL instructions?

I tried googling but couldn't find any good source that explains the structure of memory access instructions like ldstr and call instructions for example based on experience, the last byte of API/...
OneAndOnly
  • 369
5 votes
0 answers
10k views

Deobfuscating Unknown C# obfuscator?

Hello, I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my ...
mo5br
  • 51
1 vote
1 answer
181 views

Determine Control-Flow Of A .NET Assembly?

Using DnSpy is great, but it's very awkward to ascertain the control-flow of an executable. Is anyone able to advise on free-of-charge helpful apps that display a control-flow graph? IDA Home does not ...
Dalski
  • 31
2 votes
0 answers
868 views

How To Deobfuscate ConfuserEx .NET Assembly?

No matter what I try I cannot deobfuscate this crackme https://crackmes.one/crackme/5d6c847433c5d46f00e2c390. I have tried each & every tutorial on youTube of which this one is the best https://...
Dalski
  • 31
1 vote
1 answer
1k views

How to know where a sequences of bytes are used in a .NET application with Dnspy?

There are a sequence of bytes that i need to find out where are used in dnspy i tried going to hex editor and found the bytes, but right clicking and saying go to code or structure or follow reference ...
Mery Ted
  • 222
0 votes
1 answer
87 views

I can't understand this algorithm

I'm trying to solve this challenge but I can't understand the algorithm. it takes the name and generate the serial with this algoritm private int Encrypt(string Input) { int num =...
Raafat
  • 93
1 vote
0 answers
937 views

How can I debug a non-main .NET assembly using dnSpy?

I am performing a security assessment on a .NET application. dnSpy is a great tool to do this. However, I've reached a module which is not in the "main" section of the program... It is loaded by the ...
the_endian
  • 1,738
1 vote
1 answer
794 views

Attach one debugger to a DotNet application, and a second one to a loaded DLL

I'm trying to reverse an application that is using a DLL that i'm interested in. I can properly disassemble the application itself with DnSpy, as it is a .Net application, and I can disassemble the ...
Guillaume
  • 689
2 votes
1 answer
649 views

ildasm on Linux: "original" ildasm.exe same as dotnet-ildasm?

I would like to use ildasm on Linux. The original one, that comes with the .NET SDK and can be found on Windows e.g. at c:\Program Files (x86)\Microsoft SDKs\Windows\v8.0A\bin\NETFX 4.0 Tools\. I ...
langlauf.io
  • 1,508
0 votes
0 answers
136 views

Extract .NET code from React Native for Windows

I'm interested in reversing a UWP program made using React Native for Windows. Once such applications are compiled, the logic is contained in one dll. After opening this dll into IDA, it appears ...
Jämes
  • 133
0 votes
0 answers
289 views

reverse engineering obfuscated .net dll

I am decompiling a third party .NET dll which was obfuscated using codeveil my aim is to get full source code, I tried decompiling using dnSpy, JustDecompile & Reflector however it just shows the ...
Nitin Sawant
  • 101
0 votes
0 answers
208 views

Is there a way to see 'imports' in a .NET binary?

Programs such as Detect It Easy or IDA can show functions and libraries (DLLs) imported by a binary in the case of C/C++ binaries. I have a collection of .NET malware that I'm analyzing and would like ...
learnerX
  • 223
5 votes
2 answers
2k views

Trace Method Calls in .NET/C# Binary

I have a heavily obfuscated Windows service binary. Fields, types and methods are renamed. While it is possible to decompile the binary using dnSpy, it is still very cumbersome to identify important/...
DucatiNerd
  • 151
1 vote
2 answers
4k views

How to debug a DLL written in .NET/C#?

I want to reverse engineer an application written in C#. I would like to set a breakpoint at a function and observe the input passed to it during the normal course of the application's functioning.
Japjit Singh N.
  • 11
1 vote
0 answers
41 views

.NET manifest resource format

Currently I'm writing a parser for .NET files and stuck on manifest resources. My main resources: Huge documentation Short summary For resource format I have found this project made in 2005, all ...
ST3
  • 789
1 vote
0 answers
180 views

Parse / statically analyzing .NET binaries using python

Which libraries do you use to parse and statically analyze .NET binaries? Is there a python module, or do I have to use a .NET library such as dnlib? Does it make sense to write a python wrapper for ...
langlauf.io
  • 1,508
3 votes
3 answers
15k views

Unity game: Assembly dll embedded inside the exe

I'm trying to reverse engineer a game made with the Unity engine, and usually all of the games's scripts are in the files \<Game>_Data\Managed\Assembly-CSharp.dll and \<Game>_Data\Managed\...
imad
  • 41
1 vote
1 answer
208 views

Is it possible to detect visual studio version in compiled .net assembly?

I have a .net exe file I want to find out which version of visual studio is used to compile the assembly.. Is there are any solution to find out the IDE version.?
user2920053
  • 11
1 vote
0 answers
54 views

How to choose a .NET software protector which will have a small impact on run-time performance speed? [closed]

I am writing a .NET software which is doing calculations and drawing in real-time i.e when the user is moving the mouse. I want to protect this software from being reverse engineered and restrict its ...
ForeverNoob
  • 111
1 vote
1 answer
982 views

View Array Type in dnSpy

I'm debugging a .NET application and see a declaration of a local array: $ArrayType$$$BY05PAD $ArrayType$$$BY05PAD; I break on an instruction that uses data inside that (char*) array: num9 = <...
Jonas Mechtheim
  • 13
0 votes
1 answer
391 views

Is there a way to see & keep track of registers in dnSpy?

Hello I am trying to see if there is a way to see & keep track of the IP, and other registers as you would in OllyDbg or x64Dbg?
0siris
  • 51
1 vote
1 answer
97 views

Identify ldfld reference in .NET when parsing GetILAsByteArray

I was experimenting with idea of decompiling a PowerShell cmdlet using reflection. While I got some basics seem to work, how do I resolve the value in OperandField, for example ldfld cmd in this ...
chentiangemalc
  • 1,165
1 vote
0 answers
69 views

.NET Method Tracing with Parameters

Is there a tool which can profile the .NET binaries (32-bit and 64-bit) during execution to generate an API trace providing details of the methods called and the parameters passed to each method? ...
Neon Flash
  • 735
1 vote
0 answers
147 views

Re-engineering to create UML Diagrams from .NET binary assembly

What is the base way to generate UML diagrams (both class and sequence) from .NET assembly using OpenSource tools? The 200% Reflective Class Diagram Creation Tool cannot be used due on problems ...
hellboy
  • 111
4 votes
2 answers
6k views

How to disassemble a packed .NET executable?

I'm trying to reverse a Windows executable that shows as having been packed with ENIGMA(5.X): If I later check the class name for one of its UI elements, when the process is unpacked and running, it ...
c00000fd
  • 1,437
1 vote
0 answers
35 views

How to tell when Cor20 starts for DLL's that are supposed to meet ECMA-335?

When I look at a .Net compiled DLL that is supposed to conform to ECMA-335, I see the PE Header well defined up to 0x1EF, but there seems to be block between 0x1F0 and 0x208 which is mainly 00's that ...
Hmm Right
  • 11

1
2 3

Your privacy

By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.