Questions tagged [.net]

The .NET framework is a software framework designed mainly for the Microsoft Windows operating system. It includes an implementation of the Base Class Library, Common Language Runtime (commonly referred to as CLI) and Dynamic Language Runtime. It supports many programming languages, including C#, VB.NET, F# and C++.

Filter by
Sorted by
Tagged with
3
votes
0answers
3k views

View static field values in dnSpy

I'm using dnSpy (version: 4.5.3) to debug a .NET binary. I can successfully view the values of Local variables in the Locals window but I cannot view the values of static fields. However, per this ...
2
votes
1answer
990 views

How to find the name of the method in Managed Code using Windbg and SOS?

I've got a crash dump, the application definitely crash in JIT optimized assembler code. I know the start address of the method. How do I find its name using using Windbg and SOS extension? Currently ...
3
votes
1answer
1k views

Unable to unpack heavly obfuscated malware

I'm trying to unpack malware packed with ConfuserEx 1.0.0 and I can't seem to get it to work. Each time I remove the anti-tamper the whole file gets corrupted. I tried all possible tools that I found ...
2
votes
1answer
595 views

How to deobfuscation the public class names .NET

I already try de4dot with all dlls and exe and try remove strong name and don't work. what am I doing wrong?
1
vote
1answer
1k views

Reverse engineering of Managed C++/C# CrackMe

I'm reverse engineering the CrackMe which is written on Managed C++/C#. Arguments are "string" (email in this case) and "serial". Serial is somehow depends on string and I need to understand how. I ...
1
vote
1answer
259 views

Modified dll works as original without debugger attached

I'm trying to make some changes to .Net dll (note: dll is mixed mode module) used by an exe, ProtectionID detected nothing, so I happily jumped into dnSpy and made changes. I ran executable with ...
1
vote
0answers
1k views

de4dot and Dotfuscator: IL looks different, not DotPeek decompiled code

From the obfuscated to the deobfuscated assemblies, IL code looks different using ILDASM; however, DotPeek decompiled C# code looks exactly the same for both. Any clue why? The obfuscation software ...
0
votes
2answers
174 views

Do .NET functions have function prologs?

If I'm looking at a binary compiled with VC++ in a hex editor and I want to identify the start of functions - I can look for the hex "55 8B" - which is a common function prolog. Is there something ...
3
votes
0answers
518 views

Is there an existing tool to reverse engineer Xamarin AOTDATA files?

I am currently examining a xamarin application. It has used the "ahead of time compilation" feature, which has left some of the associated .net assemblies (.dlls) as lists of function signatures ...
0
votes
2answers
1k views

Trying to call a function in an unknown DLL

My goal is far from nefarious. After several polite attempts to try and get Lenovo to implement a proper keyboard backlight control, I've had no response. They do have a Windows Store app which adds ...
3
votes
1answer
1k views

Modifying a string in a .net binary

I have a .net exe called foo.exe I open foo in a hex editor (HxD) and search for myString. I do not see it. I open foo.exe in ILSpy and was able to find myString. I do see human readable text in the ...
0
votes
1answer
2k views

Extracting embedded dlls from .NET executable

I have a .NET executable that apparently has some embedded DLLs. It's just one standalone executable. I opened this executable with JetBrains dotPeek and ILSPY, both decomiplier are showing DLL names ...
2
votes
0answers
391 views

Is there a static data flow analysis tool for .net assemblies?

I read here that CAT.NET and FxCop are dead. As far as I understand, the successor Roslyn requires a visual studio project and source code. Is there a tool that reads in a compiled .NET program and ...
0
votes
1answer
150 views

How is .NET related to Windows system calls?

My understanding is that .NET (C#) code compiles to Common Intermediate Language (CIL) code, which then (usually) gets Just-In-Time compiled to native machine code at run-time on the deployment ...
1
vote
1answer
671 views

Encryption (AES-128) in automatic meters reading

I have theoretical questions about encryption when there's a lot of devices involved. Specifically it's about reading meters (water/gas/heat meters). Here's some introduction. I was trying to read a ...
3
votes
1answer
18k views

What to do with ILSpy error "This file does not contain a managed assembly"?

I'm trying to decompile an unknown Win32 executable using ILSpy. However, it only answers by giving me the useless message: This file does not contain a managed assembly. I have also tried to use ...
1
vote
2answers
537 views

How to programatically extract function names, function arguments and strings from a .NET binary?

My goal is to extract function names, the libraries they come from (if the functions were imported), function arguments, and strings from a .NET binary. How can I do this? Is this possible using ...
1
vote
0answers
83 views

Am I seeing this dll's innards correctly? [closed]

The dll in question is custom, from a retail/consumer software package that was first offered for sale in 2006/2007. I am fairly confident that it was compiled with Visual Studio .NET (2003). My ...
2
votes
1answer
3k views

Can my C# program be dumped from memory and reversed into source code?

I have a client application that, once the user is authenticated with my server, sends a byte array which is then loaded using Assembly.Load. I am pretty sure once that happens, even if the loaded ...
1
vote
1answer
2k views

Is it possible ( or how) to dump source code/machine code from memory?

I am actually working for the side of software protection. But in order to properly protect my source code ( be it .Net or C++), I would need to understand what is achievable ( and not achievable) ...
1
vote
1answer
1k views

Are .NET DLLs, even the best obfuscated ones, less secure than C++ DLLs?

From what I understand about .NET code, it is first compiled to Microsoft Common Intermediate Language (MSIL) before being translated to machine code at runtime. Whereas C++ code is compiled directly ...
4
votes
3answers
13k views

Edit codes in .Net Reflector with Reflexil (Compile Window)

I'm Using .Net Reflector with Reflexil to edit or view .net Assembly codes. I see this picture in reflexil.net: It Shows the "Compile" window. How can I see this window and edit codes?
1
vote
1answer
1k views

Cannot detect obfuscator of the obfuscated DLL

I want to do a reverse-engineering of an obfuscated Unity DLL assembly, but de4dot doesn't work. It says "Unknown Obfuscator". Also tried iMPROVE and it says that there is a 97% chance that it is a ...
1
vote
2answers
7k views

Is it possible to debug a .Net executable with IDA?

When I load a .Net executable into IDA then there is no Debug menu as when I load a normal binary. Is there any way to enable the debug functionality for .Net as well? I'd like to step into some ...
1
vote
1answer
72 views

Compressed stream unopenable with external tools

I'm trying to reverse-engineer the file format of a game's save files. The game is written in Unity, thus .NET, so it was possible to view an approximated code with RedGate Reflector. Right now I ...
6
votes
2answers
832 views

Reverse Engineering Chinese laser engraver

I would like to reverse-engineer the software that came with my Chinese-made laser engraver. Unfortunately the hardware does not play at all with other software out there... The original software is ...
8
votes
2answers
3k views

How to retrieve native asm code from .NET mixed mode dll file?

This is seriously one question I couldn't find the answer to anywhere on Google.com When I mean mixed mode I mean .NET application which has unmanaged and managed code together. I used tools .NET ...
2
votes
1answer
10k views

How to disassemble .NET after using Confuser

I want to test malware that wrote in .NET 4.5 and obfuscated by Confuser 1.9. I have tried to open it with .NET Reflector, ILSpy and dotpeek, but all of them can't open it. How can I debug (and ...
3
votes
1answer
2k views

In-memory patching of .net code

Are there techniques for patching .net executables in memory? Let's say we've have a .net dll/exe, we identified what method we want to patch and what IL to replace the existing code with. Executing ...
1
vote
1answer
4k views

Opening mono droid .so files in .NET decompiler

What is the format for .so native android files developed in Xamarin Mono droid? From this SO post it appears they are actually .NET IL binaries (not native machine code). However, this other SO post ...
2
votes
2answers
3k views

Techniques for reverse engineering an unknown or protected file format

I'm working on converting a game originally developed to run on Windows for the web. I have a bunch of artwork for the game received from the artist in .tga image files which open fine in Photoshop. ...
1
vote
1answer
237 views

How can I find the implementation/source code of an interface in .NET?

So I'm disassembling the Winnov.Amalga.Core.Session.Common.dll, and trying to figure out how the WriteScriptCommand works. I'm absolutely new to .NET, so go easy on me, please. You can find the dll ...
0
votes
0answers
858 views

How to change the DLL name in the already compiled application?

I am trying to change the name of the DLL file I had specified for my application before compiling it. When I change the DLL file name I get the error message like: System.IO.FileNotFoundException: ...
-1
votes
2answers
3k views

How can I use an x64 debugger to reroute a .NET application's logic?

I'd like to improve my reverse engineering skills, so I made this WPF application (targeting x64, of course): MainWindow.xaml: <Window x:Class="ApplicationTest.MainWindow" xmlns="http://...
5
votes
4answers
41k views

Modify code with ILSpy

I want to modify an exe a little bit. With ILSpy I see all the code that I need but I don't know how to modify the code. I tried "save code" on ILSpy that exports a .cs file, but when I open the .cs ...
2
votes
1answer
3k views

Methods of discovering the location of nag/pop-up screens besides string search?

I would like to remove a nag screen from a popular program. To do this I need to make sure the screen never gets called. So, the first task is to find the actual location of the nag (where it is ...
0
votes
1answer
55 views

Is the security of this .net application flawed? [closed]

Ok, I know that every obfuscated .Net application can be reverse engineered. And I know that it is better if I go the open source way if possible. But unfortunately I cannot because there is no ...
13
votes
4answers
23k views

Recovering .NET sources into full blown project

I wonder if total decompilation of arbitrary non packed project .NET is possible? If no, what is the conditions that should be met to make it possible? If yes, is there tools that can automate this? I'...
6
votes
2answers
861 views

Decompiling .NET marshaled code

There's a .NET malware sample I'm trying to analyze, which goes more or less like this: internal static class Class1 { public static byte[] Code = new byte[] { 9, 249, ...
1
vote
1answer
3k views

What kind of obfuscate is this?

I'm trying to deobfuscate a .NET exe file, using de4dot. I have many dll files, when I open the dll file with .NET Reflector, it appears like this: And when I did the deobfuscation again with de4dot, ...
3
votes
3answers
8k views

Decompiling windows photo viewer

I'm trying to decompile the windows photo viewer DLL files to try to tweak them, such as editing speed etc. Since this wasn't possible in the registry. When opening the files in a program such as ...
8
votes
1answer
463 views

Reversing .Net CLR exceptions handlers chain

I investigating .Net Framework JITter compilation results and I want to get programmatically exceptions handlers chain. May be somebody can help me with this investigation? To make task easier, I ...
10
votes
1answer
2k views

Rename obfuscated names with .NET Reflector?

I have some obfuscated C# .NET code I want to analyze. Is it possible to rename those obfuscated symbols? So I can more easily track them? Like IDA Pro can work with renaming functions and so forth.
7
votes
1answer
842 views

Decompile "Internal Call"

I have a .NET method which is marked as an "Internal Call", meaning that it is implemented within the CLR itself. Is there any way to locate the code for and/or decompile such a method?
5
votes
3answers
4k views

Patching a .Net 4.0 Binary in Olly or CFF Explorer

I have a challenge compiled in C# .net 4.0. I can see the source completely fine in Reflector. I'd like to change the source. I guess I do this by patching some bytes in the binary. The problem I'm ...
5
votes
3answers
5k views

Reverse Engineering Managed Code

Is reverse engineering managed code from .NET easier or harder? I think it might be Java bytecode that can be easily converted back into source code. Is managed code from .NET similar, and why?
40
votes
8answers
76k views

Is there any way to decompile a .NET assembly or program?

Are there any tools available to take an already compiled .dll or .exe file that you know was compiled from C# or Visual Basic and obtain the original source code from it?

1
2