Skip to main content

Questions tagged [.net]

The .NET framework is a software framework designed mainly for the Microsoft Windows operating system. It includes an implementation of the Base Class Library, Common Language Runtime (commonly referred to as CLI) and Dynamic Language Runtime. It supports many programming languages, including C#, VB.NET, F# and C++.

Filter by
Sorted by
Tagged with
42 votes
8 answers
82k views

Is there any way to decompile a .NET assembly or program?

Are there any tools available to take an already compiled .dll or .exe file that you know was compiled from C# or Visual Basic and obtain the original source code from it?
APerson's user avatar
  • 927
13 votes
4 answers
30k views

Recovering .NET sources into full blown project

I wonder if total decompilation of arbitrary non packed project .NET is possible? If no, what is the conditions that should be met to make it possible? If yes, is there tools that can automate this? I'...
see ya's user avatar
  • 823
11 votes
1 answer
2k views

Rename obfuscated names with .NET Reflector?

I have some obfuscated C# .NET code I want to analyze. Is it possible to rename those obfuscated symbols? So I can more easily track them? Like IDA Pro can work with renaming functions and so forth.
samuirai's user avatar
  • 3,079
9 votes
4 answers
55k views

Modify code with ILSpy

I want to modify an exe a little bit. With ILSpy I see all the code that I need but I don't know how to modify the code. I tried "save code" on ILSpy that exports a .cs file, but when I open the .cs ...
sivlab's user avatar
  • 91
9 votes
1 answer
972 views

Decompile "Internal Call"

I have a .NET method which is marked as an "Internal Call", meaning that it is implemented within the CLR itself. Is there any way to locate the code for and/or decompile such a method?
Levi Botelho's user avatar
8 votes
2 answers
4k views

How to retrieve native asm code from .NET mixed mode dll file?

This is seriously one question I couldn't find the answer to anywhere on Google.com When I mean mixed mode I mean .NET application which has unmanaged and managed code together. I used tools .NET ...
SSpoke's user avatar
  • 759
8 votes
1 answer
3k views

Is it possible to use GHIDRA to decode .NET ? (1 lvl crackmes with solution, but not in GHIDRA)

I am a beginner, I want to decode 1 lvl in crackmes, I downloaded a GHIDRA as my main tool. I've got a simple keygen app. Here it is: https://crackmes.one/crackme/5ab77f6433c5d40ad448cb2d. The ...
OREN YT's user avatar
  • 81
8 votes
1 answer
522 views

Reversing .Net CLR exceptions handlers chain

I investigating .Net Framework JITter compilation results and I want to get programmatically exceptions handlers chain. May be somebody can help me with this investigation? To make task easier, I ...
Alexus's user avatar
  • 181
7 votes
3 answers
5k views

Reverse Engineering Managed Code

Is reverse engineering managed code from .NET easier or harder? I think it might be Java bytecode that can be easily converted back into source code. Is managed code from .NET similar, and why?
zer's user avatar
  • 157
7 votes
3 answers
4k views

Patching a .Net 4.0 Binary in Olly or CFF Explorer

I have a challenge compiled in C# .net 4.0. I can see the source completely fine in Reflector. I'd like to change the source. I guess I do this by patching some bytes in the binary. The problem I'm ...
4r4r4r's user avatar
  • 71
6 votes
1 answer
917 views

How to tell if a particular .NET assembly was written in C# or F#?

The motivation for this question is that I used JetBrains dotPeek to decompile an .exe written in F#, but the output project directory produced C# code. Why does decompiling an F# assembly produce C# ...
Samantha's user avatar
  • 225
6 votes
1 answer
7k views

dnSpy - What do these symbols mean?

When decompiling a dll file there are certain lines of code that read like this: return \u0013.\u0002.\u0001(url, info); I have two questions on this: 1) does \u00xx mean that it is obfuscated, if ...
pzirkind's user avatar
  • 437
6 votes
2 answers
1k views

Decompiling .NET marshaled code

There's a .NET malware sample I'm trying to analyze, which goes more or less like this: internal static class Class1 { public static byte[] Code = new byte[] { 9, 249, ...
Thomas Chopitea's user avatar
6 votes
2 answers
928 views

Reverse Engineering Chinese laser engraver

I would like to reverse-engineer the software that came with my Chinese-made laser engraver. Unfortunately the hardware does not play at all with other software out there... The original software is ...
Jason's user avatar
  • 63
5 votes
2 answers
2k views

Trace Method Calls in .NET/C# Binary

I have a heavily obfuscated Windows service binary. Fields, types and methods are renamed. While it is possible to decompile the binary using dnSpy, it is still very cumbersome to identify important/...
DucatiNerd's user avatar
5 votes
1 answer
767 views

How to use dnSpyEx or some other .NET debugger to attach to a .NET process started with a process-hollowing technique?

I have a .NET executable that is started using the process-hollowing technique. Here's how it looks from the Detect-It-Easy tool: I can open the image file for that process (from disk) with dnSpyEx, ...
c00000fd's user avatar
  • 1,711
5 votes
0 answers
15k views

Deobfuscating Unknown C# obfuscator?

Hello, I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my ...
mo5br's user avatar
  • 51
4 votes
2 answers
8k views

How to disassemble a packed .NET executable?

I'm trying to reverse a Windows executable that shows as having been packed with ENIGMA(5.X): If I later check the class name for one of its UI elements, when the process is unpacked and running, it ...
c00000fd's user avatar
  • 1,711
4 votes
3 answers
15k views

Edit codes in .Net Reflector with Reflexil (Compile Window)

I'm Using .Net Reflector with Reflexil to edit or view .net Assembly codes. I see this picture in reflexil.net: It Shows the "Compile" window. How can I see this window and edit codes?
56356356356's user avatar
4 votes
1 answer
3k views

In-memory patching of .net code

Are there techniques for patching .net executables in memory? Let's say we've have a .net dll/exe, we identified what method we want to patch and what IL to replace the existing code with. Executing ...
Andrew Savinykh's user avatar
4 votes
0 answers
162 views

How can I generated the function call graph (with API calls) of a .NET executable?

For native executables, I can use IDA to generate the function call graph (FCG) of that executable (which includes API calls as well, for example function sub_xxx has an arrow to CreateFile which ...
OneAndOnly's user avatar
4 votes
0 answers
5k views

View static field values in dnSpy

I'm using dnSpy (version: 4.5.3) to debug a .NET binary. I can successfully view the values of Local variables in the Locals window but I cannot view the values of static fields. However, per this ...
Neon Flash's user avatar
3 votes
3 answers
8k views

Decompiling windows photo viewer

I'm trying to decompile the windows photo viewer DLL files to try to tweak them, such as editing speed etc. Since this wasn't possible in the registry. When opening the files in a program such as ...
Paradoxis's user avatar
  • 173
3 votes
2 answers
5k views

android unity intercept w/ Frida

I'm trying to extract symbols from an Android Unity game to detect something related to the game which I can intercept and replace variables. The following code will enumerate symbols from libmain.so,...
whoopdedoo's user avatar
3 votes
3 answers
17k views

Unity game: Assembly dll embedded inside the exe

I'm trying to reverse engineer a game made with the Unity engine, and usually all of the games's scripts are in the files \<Game>_Data\Managed\Assembly-CSharp.dll and \<Game>_Data\Managed\...
imad's user avatar
  • 41
3 votes
1 answer
25k views

What to do with ILSpy error "This file does not contain a managed assembly"?

I'm trying to decompile an unknown Win32 executable using ILSpy. However, it only answers by giving me the useless message: This file does not contain a managed assembly. I have also tried to use ...
not2qubit's user avatar
  • 145
3 votes
1 answer
2k views

Unable to unpack heavly obfuscated malware

I'm trying to unpack malware packed with ConfuserEx 1.0.0 and I can't seem to get it to work. Each time I remove the anti-tamper the whole file gets corrupted. I tried all possible tools that I found ...
Potato's user avatar
  • 31
3 votes
1 answer
2k views

Modifying a string in a .net binary

I have a .net exe called foo.exe I open foo in a hex editor (HxD) and search for myString. I do not see it. I open foo.exe in ILSpy and was able to find myString. I do see human readable text in the ...
user20610's user avatar
3 votes
0 answers
662 views

Is there an existing tool to reverse engineer Xamarin AOTDATA files?

I am currently examining a xamarin application. It has used the "ahead of time compilation" feature, which has left some of the associated .net assemblies (.dlls) as lists of function signatures ...
MrSynAckSter's user avatar
  • 1,258
2 votes
1 answer
4k views

Can my C# program be dumped from memory and reversed into source code?

I have a client application that, once the user is authenticated with my server, sends a byte array which is then loaded using Assembly.Load. I am pretty sure once that happens, even if the loaded ...
DynamicKeyword's user avatar
2 votes
1 answer
4k views

Methods of discovering the location of nag/pop-up screens besides string search?

I would like to remove a nag screen from a popular program. To do this I need to make sure the screen never gets called. So, the first task is to find the actual location of the nag (where it is ...
Nopslide__'s user avatar
2 votes
1 answer
124 views

Structure of operand bytes in .NET call and data access IL instructions?

I tried googling but couldn't find any good source that explains the structure of memory access instructions like ldstr and call instructions for example based on experience, the last byte of API/...
OneAndOnly's user avatar
2 votes
1 answer
12k views

How to disassemble .NET after using Confuser

I want to test malware that wrote in .NET 4.5 and obfuscated by Confuser 1.9. I have tried to open it with .NET Reflector, ILSpy and dotpeek, but all of them can't open it. How can I debug (and ...
nrofis's user avatar
  • 211
2 votes
2 answers
3k views

Techniques for reverse engineering an unknown or protected file format

I'm working on converting a game originally developed to run on Windows for the web. I have a bunch of artwork for the game received from the artist in .tga image files which open fine in Photoshop. ...
Matt Harrison's user avatar
2 votes
1 answer
828 views

ildasm on Linux: "original" ildasm.exe same as dotnet-ildasm?

I would like to use ildasm on Linux. The original one, that comes with the .NET SDK and can be found on Windows e.g. at c:\Program Files (x86)\Microsoft SDKs\Windows\v8.0A\bin\NETFX 4.0 Tools\. I ...
langlauf.io's user avatar
  • 1,560
2 votes
1 answer
796 views

How to deobfuscation the public class names .NET

I already try de4dot with all dlls and exe and try remove strong name and don't work. what am I doing wrong?
Luan Barbosa's user avatar
2 votes
2 answers
11k views

Is it possible to debug a .Net executable with IDA?

When I load a .Net executable into IDA then there is no Debug menu as when I load a normal binary. Is there any way to enable the debug functionality for .Net as well? I'd like to step into some ...
DarthGizka's user avatar
  • 2,010
2 votes
1 answer
761 views

Patch .net executable via hex editor

What I am trying to do: I have an .exe written in C#. Ilspy shows the code. Inside it has a class DoWork with static field SomeValue: // Program.DoWork public static int SomeValue => 15; In code, ...
Uprooted's user avatar
  • 185
2 votes
1 answer
277 views

Where are the .NET IL bytes stored in an .NET executable?

When i compile a c# code, it compiles into a .NET executable, that only imports _CorExeMain from mscoree.dll, now my questions are : Is _CorExeMain the interpreter that fetches ILs and executes their ...
Notoriouss's user avatar
2 votes
1 answer
1k views

How to change the DLL name in the already compiled application?

I am trying to change the name of the DLL file I had specified for my application before compiling it. When I change the DLL file name I get the error message like: System.IO.FileNotFoundException: ...
FreeMind's user avatar
  • 639
2 votes
1 answer
136 views

How to detect obfuscator and where to dig?

I have an .net assembly application written on c# Its target framework version is 4.5.2 Trying to decompile with ILSpy, mostly all files looks like this: using MyApp.Controller; using MyApp....
Alex's user avatar
  • 21
2 votes
1 answer
501 views

Use 3rd-party DLL in my own application

Sorry if this is a bit long; I figured it might be helpful to provide some information on why I'm trying to do what I'm doing. If not, just skip to the "My Problem" section. Background I'm ...
Chris's user avatar
  • 31
2 votes
1 answer
810 views

Disassemble and debug dynamic generated code executed via delegate in c#

I'm trying to reverse engeneer a malware using dnSpy that at some point do this: delegate IntPtr H7IREAEBYY(string path, IntPtr data); byte[] array = new byte[] { 233, 151, ... } IntPtr value ...
n0t0r1us's user avatar
2 votes
1 answer
1k views

How to find the name of the method in Managed Code using Windbg and SOS?

I've got a crash dump, the application definitely crash in JIT optimized assembler code. I know the start address of the method. How do I find its name using using Windbg and SOS extension? Currently ...
Anton Kukoba's user avatar
  • 1,850
2 votes
0 answers
305 views

Dumping .NET Dynamic Methods

I have a .NET exe that creates DynamicMethods whose bodies are built from a byte array and later called. I'm able to access the array, and even to disassemble it "raw" starting from the ...
Net_Newb's user avatar
2 votes
0 answers
1k views

How To Deobfuscate ConfuserEx .NET Assembly?

No matter what I try I cannot deobfuscate this crackme https://crackmes.one/crackme/5d6c847433c5d46f00e2c390. I have tried each & every tutorial on youTube of which this one is the best https://...
Dalski's user avatar
  • 31
2 votes
0 answers
4k views

Can de4dot deobfuscate Dotfuscator Professional?

I ran de4dot on a Xamarin app obfuscated using Dotfuscator Professional. However, there's still the random switches and strange ints everywhere. Can de4dot decode this? If not, is there another tool ...
ButteredQwaffles's user avatar
2 votes
0 answers
452 views

Is there a static data flow analysis tool for .net assemblies?

I read here that CAT.NET and FxCop are dead. As far as I understand, the successor Roslyn requires a visual studio project and source code. Is there a tool that reads in a compiled .NET program and ...
langlauf.io's user avatar
  • 1,560
1 vote
1 answer
5k views

Opening mono droid .so files in .NET decompiler

What is the format for .so native android files developed in Xamarin Mono droid? From this SO post it appears they are actually .NET IL binaries (not native machine code). However, this other SO post ...
Nederealm's user avatar
  • 277
1 vote
1 answer
3k views

What kind of obfuscate is this?

I'm trying to deobfuscate a .NET exe file, using de4dot. I have many dll files, when I open the dll file with .NET Reflector, it appears like this: And when I did the deobfuscation again with de4dot, ...
user8490's user avatar