Questions tagged [.net]

The .NET framework is a software framework designed mainly for the Microsoft Windows operating system. It includes an implementation of the Base Class Library, Common Language Runtime (commonly referred to as CLI) and Dynamic Language Runtime. It supports many programming languages, including C#, VB.NET, F# and C++.

29 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5 votes
0 answers
8k views

Deobfuscating Unknown C# obfuscator?

Hello, I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my ...
  • 51
3 votes
0 answers
4k views

View static field values in dnSpy

I'm using dnSpy (version: 4.5.3) to debug a .NET binary. I can successfully view the values of Local variables in the Locals window but I cannot view the values of static fields. However, per this ...
3 votes
0 answers
584 views

Is there an existing tool to reverse engineer Xamarin AOTDATA files?

I am currently examining a xamarin application. It has used the "ahead of time compilation" feature, which has left some of the associated .net assemblies (.dlls) as lists of function signatures ...
  • 1,216
2 votes
0 answers
631 views

How To Deobfuscate ConfuserEx .NET Assembly?

No matter what I try I cannot deobfuscate this crackme https://crackmes.one/crackme/5d6c847433c5d46f00e2c390. I have tried each & every tutorial on youTube of which this one is the best https://...
  • 31
2 votes
0 answers
3k views

Can de4dot deobfuscate Dotfuscator Professional?

I ran de4dot on a Xamarin app obfuscated using Dotfuscator Professional. However, there's still the random switches and strange ints everywhere. Can de4dot decode this? If not, is there another tool ...
2 votes
0 answers
409 views

Is there a static data flow analysis tool for .net assemblies?

I read here that CAT.NET and FxCop are dead. As far as I understand, the successor Roslyn requires a visual studio project and source code. Is there a tool that reads in a compiled .NET program and ...
  • 1,456
1 vote
0 answers
643 views

C# Console Application can't load file or assembly, but needs a dll which doesn't exists?

I have a strange error. I created for testing purposes a normal Console Application and run my own Tracer which is written with the help of Mono.Cecil on this application. I embedd a Stopwatch at the ...
1 vote
0 answers
808 views

How can I debug a non-main .NET assembly using dnSpy?

I am performing a security assessment on a .NET application. dnSpy is a great tool to do this. However, I've reached a module which is not in the "main" section of the program... It is loaded by the ...
  • 1,625
1 vote
0 answers
39 views

.NET manifest resource format

Currently I'm writing a parser for .NET files and stuck on manifest resources. My main resources: Huge documentation Short summary For resource format I have found this project made in 2005, all ...
  • 789
1 vote
0 answers
132 views

Parse / statically analyzing .NET binaries using python

Which libraries do you use to parse and statically analyze .NET binaries? Is there a python module, or do I have to use a .NET library such as dnlib? Does it make sense to write a python wrapper for ...
  • 1,456
1 vote
0 answers
64 views

.NET Method Tracing with Parameters

Is there a tool which can profile the .NET binaries (32-bit and 64-bit) during execution to generate an API trace providing details of the methods called and the parameters passed to each method? ...
1 vote
0 answers
134 views

Re-engineering to create UML Diagrams from .NET binary assembly

What is the base way to generate UML diagrams (both class and sequence) from .NET assembly using OpenSource tools? The 200% Reflective Class Diagram Creation Tool cannot be used due on problems ...
  • 111
1 vote
0 answers
34 views

How to tell when Cor20 starts for DLL's that are supposed to meet ECMA-335?

When I look at a .Net compiled DLL that is supposed to conform to ECMA-335, I see the PE Header well defined up to 0x1EF, but there seems to be block between 0x1F0 and 0x208 which is mainly 00's that ...
1 vote
0 answers
600 views

C# Hidden Method through transparent proxy object?

I'm dealing with an interesting form of obfuscation. A C# program I am reversing has a central API, let's call it "Central API". This Central API has several functions that aren't exactly defined. ...
  • 131
1 vote
0 answers
119 views

Decompiling DotNet2JScript malware?

I've got a .NET malware sample that was transpiled to JScript using DotNet2JScript. The .NET malware assembly was serialized to binary form using BinaryFormatter and then embedded into the JScript ...
1 vote
0 answers
1k views

de4dot and Dotfuscator: IL looks different, not DotPeek decompiled code

From the obfuscated to the deobfuscated assemblies, IL code looks different using ILDASM; however, DotPeek decompiled C# code looks exactly the same for both. Any clue why? The obfuscation software ...
0 votes
0 answers
13 views

debug native code and net code

I have a .net dll with a lot of calculations and formulas. From this dll, I want to set breakpoints to see the calculated results for a specific field. The main program is written in native code. So, ...
0 votes
0 answers
33 views

How to debug C++ module/function call used in .net application?

I'm currently debugging a .net application by using dnSpy. There is a function where I have call like this <Module>.X.Y.Z.Initialize(ptr, ptr2, flag); The function belongs to a DLL and ...
0 votes
0 answers
41 views

Retrieve all parameters of specific function: How to automate

I'm trying to reverse engineer.NET binary with dnspy. I have a decryption routine that is used to display useful strings. It takes one integer value as a parameter and uses it in the decryption ...
  • 83
0 votes
0 answers
172 views

How to debug a .NET windows service: "Cannot start service from the command line or a debugger"

I have a .NET windows service which I can stop and run through Process Hacker. I can also view it's code with dnSPY. I tried to debug it without a success by trying to attach to the process. I wanted ...
  • 471
0 votes
0 answers
485 views

dnSpy - change software value during run

Im working on old software written in C# .NET for increase skills in dnSpy. im new in dnSpy. When I step-in dnSpy, the program get license information from another dll file. and the dll class are only ...
  • 79
0 votes
0 answers
827 views

How to disassemble an obfuscated .NET DLL?

I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL: Any idea how to unpack it?
  • 1,335
0 votes
0 answers
81 views

new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?

just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
0 votes
0 answers
61 views

Failed to load .net binary on IDA Pro

I tried to use IDA Pro to load a binary file. IDA detected it as a .NET file: but when I click OK to load the program, the following error occured, and the program can't be loaded: I tried to google ...
0 votes
0 answers
119 views

Extract .NET code from React Native for Windows

I'm interested in reversing a UWP program made using React Native for Windows. Once such applications are compiled, the logic is contained in one dll. After opening this dll into IDA, it appears ...
  • 133
0 votes
0 answers
271 views

reverse engineering obfuscated .net dll

I am decompiling a third party .NET dll which was obfuscated using codeveil my aim is to get full source code, I tried decompiling using dnSpy, JustDecompile & Reflector however it just shows the ...
0 votes
0 answers
157 views

Is there a way to see 'imports' in a .NET binary?

Programs such as Detect It Easy or IDA can show functions and libraries (DLLs) imported by a binary in the case of C/C++ binaries. I have a collection of .NET malware that I'm analyzing and would like ...
  • 223
0 votes
0 answers
870 views

How to change the DLL name in the already compiled application?

I am trying to change the name of the DLL file I had specified for my application before compiling it. When I change the DLL file name I get the error message like: System.IO.FileNotFoundException: ...
  • 599
-2 votes
1 answer
294 views

What obfuscator is used?

In version 3.7.3.7 I was able to modify some parts of the code using dnSpy. The language is C#. But in the new(next) version, I did not succeed and I guess the code is obfuscated. De4dot did not help. ...