Skip to main content

Questions tagged [.net]

The .NET framework is a software framework designed mainly for the Microsoft Windows operating system. It includes an implementation of the Base Class Library, Common Language Runtime (commonly referred to as CLI) and Dynamic Language Runtime. It supports many programming languages, including C#, VB.NET, F# and C++.

Filter by
Sorted by
Tagged with
1 vote
1 answer
123 views

How to detect obfuscator and where to dig?

I have an .net assembly application written on c# Its target framework version is 4.5.2 Trying to decompile with ILSpy, mostly all files looks like this: using MyApp.Controller; using MyApp....
1 vote
1 answer
82 views

What is the specification for a dotnet resource, header and data?

What is the header and data structure of a .NET resource? I would like to find an equivalent type of documentation to the following, but for .NET resources: https://learn.microsoft.com/en-us/windows/...
0 votes
0 answers
26 views

Modifying a Bundled .NET 7 Application

I am attempting to reverse a .NET 7 program and patch it, but it is a bundled file. When importing the EXE into dnSpy I get the headings of a PE file (.text, etc.) and nothing else. However, if I ...
0 votes
1 answer
57 views

How can I reverse engineer a self-contained dotnet executable on MacOS?

For a challenge at OWASP WrongSecrets I have build a self-contained binary to be reverse engineered (see https://github.com/OWASP/wrongsecrets-binaries/actions/runs/8244751569), but, I have not been ...
0 votes
0 answers
81 views

Deobfuscating WPF obfuscated code

The project uses WPF : What should i do for XAML links de4dot supporting that ? I have been trying to deobfuscate an encrypted code for days but no matter what I did, I bypassed the debugger ...
0 votes
0 answers
72 views

What is this .Net Obfuscator?

I'm analysing a .Net executable and de4dot doesn't detect its obfuscator. Class/Method/Property names start with #=. Does anybody know what obfuscator this is? // Token: 0x0600EE8B RID: 61067 RVA: ...
0 votes
1 answer
176 views

.NET Packer/Protector

I have been trying to analyse a .NET trojanized software, here is the link for reference:https://www.virustotal.com/gui/file/6186e0b5b1d820744f8f7aa682eec6b043ba11c7737a64e173522b8b55d06f81/detection ...
7 votes
1 answer
3k views

Is it possible to use GHIDRA to decode .NET ? (1 lvl crackmes with solution, but not in GHIDRA)

I am a beginner, I want to decode 1 lvl in crackmes, I downloaded a GHIDRA as my main tool. I've got a simple keygen app. Here it is: https://crackmes.one/crackme/5ab77f6433c5d40ad448cb2d. The ...
0 votes
0 answers
16 views

System.ComponentModel.LicenseException: 'Not correct assembly name.' error

I'm trying to decompile a dll using dnspy and changing the method names to my own name. The dll compiles sucessfully, but i get this error when i call any method - System.ComponentModel....
4 votes
0 answers
160 views

How can I generated the function call graph (with API calls) of a .NET executable?

For native executables, I can use IDA to generate the function call graph (FCG) of that executable (which includes API calls as well, for example function sub_xxx has an arrow to CreateFile which ...
2 votes
1 answer
495 views

Use 3rd-party DLL in my own application

Sorry if this is a bit long; I figured it might be helpful to provide some information on why I'm trying to do what I'm doing. If not, just skip to the "My Problem" section. Background I'm ...
1 vote
1 answer
425 views

dnSpy not showing locals after hitting breakpoint

I'm trying to debug .NET app DLL. I'm attaching to the process, open DLL module from memory and I'm setting the breakpoint inside of DLL. After hitiing the breakpoint dnSpy didn't show Locals and I ...
1 vote
2 answers
288 views

Reversing .net crypter with obfuscated imports

I have started recently with reverse engineering. I came across the linked file. It is a packed/crypted putty.exe. (WARNING: IT MAY BE BACKDOORED!!) How it's working and loading putty.exe with runpe ...
1 vote
1 answer
695 views

.NET: How to debug or decompile a DanamicMethod with dnSpy?

I have a managed .NET executable that supplies the msil bytecode of a function as raw bytes. It constructs a DynamicMethod object, sets the bytecode with DynamicMethod.DynamicILInfo.SetCode() and ...
5 votes
1 answer
741 views

How to use dnSpyEx or some other .NET debugger to attach to a .NET process started with a process-hollowing technique?

I have a .NET executable that is started using the process-hollowing technique. Here's how it looks from the Detect-It-Easy tool: I can open the image file for that process (from disk) with dnSpyEx, ...
2 votes
1 answer
1k views

How to change the DLL name in the already compiled application?

I am trying to change the name of the DLL file I had specified for my application before compiling it. When I change the DLL file name I get the error message like: System.IO.FileNotFoundException: ...
2 votes
0 answers
303 views

Dumping .NET Dynamic Methods

I have a .NET exe that creates DynamicMethods whose bodies are built from a byte array and later called. I'm able to access the array, and even to disassemble it "raw" starting from the ...
1 vote
2 answers
2k views

How to attach and step through a running .NET process?

This is quite easy to do with a low-level debugger, like x64dbg (for instance). Say, if I have a running native process I can attach to it, set a breakpoint, and then step through native code with it. ...
1 vote
0 answers
74 views

debug native code and net code

I have a .net dll with a lot of calculations and formulas. From this dll, I want to set breakpoints to see the calculated results for a specific field. The main program is written in native code. So, ...
1 vote
0 answers
160 views

How to debug C++ module/function call used in .net application?

I'm currently debugging a .net application by using dnSpy. There is a function where I have call like this <Module>.X.Y.Z.Initialize(ptr, ptr2, flag); The function belongs to a DLL and ...
5 votes
0 answers
15k views

Deobfuscating Unknown C# obfuscator?

Hello, I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my ...
1 vote
0 answers
100 views

Retrieve all parameters of specific function: How to automate

I'm trying to reverse engineer.NET binary with dnspy. I have a decryption routine that is used to display useful strings. It takes one integer value as a parameter and uses it in the decryption ...
1 vote
1 answer
222 views

what is metaData of assemblies and what is used for

hi there I hope you doing well lately, I have searched about ildasm and how to protect my DLLs from reverse engineering, so I found some great open source projects (ConfuseEx..), it works when I tried ...
2 votes
1 answer
756 views

Patch .net executable via hex editor

What I am trying to do: I have an .exe written in C#. Ilspy shows the code. Inside it has a class DoWork with static field SomeValue: // Program.DoWork public static int SomeValue => 15; In code, ...
1 vote
1 answer
1k views

How to step into an invoked method from a DotNet DLL in dnSpy?

I've been analyzing a malware written in C# using dnSpy. It loaded a dotnet assembly DLL from its Resources: I tried stepping into InvokeMember function, but could not go further when hitting this ...
0 votes
1 answer
89 views

Modify main function for C++ game file

I am trying to modify the main function for a specific decompiled .exe. More specifically, I want to remove the reference to GUI from that .exe file, so that GUI doesn't get initialised on the startup ...
1 vote
1 answer
2k views

How to debug a .net DLL?

I'm trying to reverse engineer a .net malicious EXE but it loads a DLL inside its memory. I have tried to debug this DLL using a tool called SharpDllLoader and dnspy but I have 2 issues: First one: (...
0 votes
1 answer
572 views

dnSpy works really slow. How can I fix it?

I've been doing some stuff with a pre-compiled .NET executable. It is my first time reversing something, so I don't know much. I got a bunch of programs like ILSpy, dnSpy and dotPeek. They all do as ...
0 votes
0 answers
2k views

dnSpy - change software value during run

Im working on old software written in C# .NET for increase skills in dnSpy. im new in dnSpy. When I step-in dnSpy, the program get license information from another dll file. and the dll class are only ...
1 vote
1 answer
153 views

Inserting two digits into binary per Hex - without making EXE corrupt

I dont have much knowledge with assemblers. I beg ur pardon in advance. I need to change an IP address in a win-binary (Net) where the IP its hard-coded. Just changing the IP with an Hex Editor would ...
0 votes
0 answers
3k views

How to disassemble an obfuscated .NET DLL?

I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL: Any idea how to unpack it?
1 vote
0 answers
1k views

C# Console Application can't load file or assembly, but needs a dll which doesn't exists?

I have a strange error. I created for testing purposes a normal Console Application and run my own Tracer which is written with the help of Mono.Cecil on this application. I embedd a Stopwatch at the ...
2 votes
1 answer
810 views

Disassemble and debug dynamic generated code executed via delegate in c#

I'm trying to reverse engeneer a malware using dnSpy that at some point do this: delegate IntPtr H7IREAEBYY(string path, IntPtr data); byte[] array = new byte[] { 233, 151, ... } IntPtr value ...
3 votes
1 answer
2k views

Unable to unpack heavly obfuscated malware

I'm trying to unpack malware packed with ConfuserEx 1.0.0 and I can't seem to get it to work. Each time I remove the anti-tamper the whole file gets corrupted. I tried all possible tools that I found ...
0 votes
0 answers
262 views

new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?

just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
2 votes
1 answer
275 views

Where are the .NET IL bytes stored in an .NET executable?

When i compile a c# code, it compiles into a .NET executable, that only imports _CorExeMain from mscoree.dll, now my questions are : Is _CorExeMain the interpreter that fetches ILs and executes their ...
2 votes
1 answer
4k views

Can my C# program be dumped from memory and reversed into source code?

I have a client application that, once the user is authenticated with my server, sends a byte array which is then loaded using Assembly.Load. I am pretty sure once that happens, even if the loaded ...
0 votes
1 answer
3k views

dnSpy: how to start 32 bit version

I am very unsure if this is the right place to as or if I need to ask this at another forum, but here it goes. I am trying to reverse engineer a .NET program with the use of dnspy. I installed dnspy ...
-2 votes
1 answer
875 views

What obfuscator is used?

In version 3.7.3.7 I was able to modify some parts of the code using dnSpy. The language is C#. But in the new(next) version, I did not succeed and I guess the code is obfuscated. De4dot did not help. ...
9 votes
4 answers
55k views

Modify code with ILSpy

I want to modify an exe a little bit. With ILSpy I see all the code that I need but I don't know how to modify the code. I tried "save code" on ILSpy that exports a .cs file, but when I open the .cs ...
42 votes
8 answers
82k views

Is there any way to decompile a .NET assembly or program?

Are there any tools available to take an already compiled .dll or .exe file that you know was compiled from C# or Visual Basic and obtain the original source code from it?
1 vote
0 answers
123 views

Failed to load .net binary on IDA Pro

I tried to use IDA Pro to load a binary file. IDA detected it as a .NET file: but when I click OK to load the program, the following error occured, and the program can't be loaded: I tried to google ...
2 votes
1 answer
124 views

Structure of operand bytes in .NET call and data access IL instructions?

I tried googling but couldn't find any good source that explains the structure of memory access instructions like ldstr and call instructions for example based on experience, the last byte of API/...
1 vote
2 answers
5k views

How to debug a DLL written in .NET/C#?

I want to reverse engineer an application written in C#. I would like to set a breakpoint at a function and observe the input passed to it during the normal course of the application's functioning.
1 vote
1 answer
265 views

Determine Control-Flow Of A .NET Assembly?

Using DnSpy is great, but it's very awkward to ascertain the control-flow of an executable. Is anyone able to advise on free-of-charge helpful apps that display a control-flow graph? IDA Home does not ...
2 votes
0 answers
1k views

How To Deobfuscate ConfuserEx .NET Assembly?

No matter what I try I cannot deobfuscate this crackme https://crackmes.one/crackme/5d6c847433c5d46f00e2c390. I have tried each & every tutorial on youTube of which this one is the best https://...
1 vote
1 answer
2k views

How to know where a sequences of bytes are used in a .NET application with Dnspy?

There are a sequence of bytes that i need to find out where are used in dnspy i tried going to hex editor and found the bytes, but right clicking and saying go to code or structure or follow reference ...
3 votes
3 answers
17k views

Unity game: Assembly dll embedded inside the exe

I'm trying to reverse engineer a game made with the Unity engine, and usually all of the games's scripts are in the files \<Game>_Data\Managed\Assembly-CSharp.dll and \<Game>_Data\Managed\...
1 vote
1 answer
998 views

Attach one debugger to a DotNet application, and a second one to a loaded DLL

I'm trying to reverse an application that is using a DLL that i'm interested in. I can properly disassemble the application itself with DnSpy, as it is a .Net application, and I can disassemble the ...
2 votes
2 answers
11k views

Is it possible to debug a .Net executable with IDA?

When I load a .Net executable into IDA then there is no Debug menu as when I load a normal binary. Is there any way to enable the debug functionality for .Net as well? I'd like to step into some ...