Questions tagged [c#]
A multi-paradigm programming language encompassing strong typing, imperative, declarative, functional, generic, object-oriented (class-based), and component-oriented programming disciplines
90
questions
0
votes
0
answers
41
views
How do I reverse engineer a file uploading api?
The API is pretty old and is written in C#, I tried debugging the API calls with mitmproxy.
This is the successful API call (manually uploading file)
but when I tried curling it, it gave me this error ...
1
vote
0
answers
35
views
Decoding CalibrationL6.dll
I am having problems with a dll, it is called CalibrationL6.dll, I have been able to see the code inside, and the function that interests me is this:
public static int CalculateCoefficients(
...
- 11
2
votes
1
answer
56
views
Can #if DEBUG in C# become true in the released binary?
I have something like this in my code that checks for user's license:
// C# code:
#if DEBUG
MakeLicenseValidForever();
#else
CheckLicense();
#endif
Now, I need to know if these directives ...
- 123
1
vote
0
answers
46
views
Need help with modifying DOS game extracting graphics codes
I have the following two Codes which make up a DOS Game Graphics Image Extracting Program, written in C# :-
using System;
using System.Collections.Generic;
using System.Text;
using System.IO;
...
- 11
2
votes
0
answers
320
views
Find constant variables with float values using Ghidra
I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet:
// Namespace:
public class ...
- 199
1
vote
0
answers
90
views
How this data can be referenced in Ghidra?
I reverse engineered libil2cpp.so using ghidra. I found these lines of code in a function in the decompiler view:
UnityEngine.PlayerPrefs$$GetInt(*(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8),5,...
- 199
1
vote
1
answer
78
views
Turning very complicated arithmetic and reverse engineered check into useable code in C#
so I have this problem of me not understanding how to convert this one function into useable code in C#. Problem being that I am currently hooking into a game via C# and I want to rebuild a function ...
1
vote
0
answers
126
views
Compress Xamarin assemblies after decompression
I have an APK that has assemblies in a single blob file. I could extract them successfully using decompress-assemblies.
Is there anyway I can compress them again into assemblies.blob file or at least ...
- 11
0
votes
0
answers
308
views
Decompile C#, xaml and wpf application
I saw the image of an app and I want to use it's source code but when using some decompiler I get over 500 errors. How do I use the code there are two files? I want to decompile the installer and the ...
1
vote
1
answer
72
views
what is metaData of assemblies and what is used for
hi there I hope you doing well
lately, I have searched about ildasm and how to protect my DLLs from reverse engineering,
so I found some great open source projects (ConfuseEx..), it works when I tried ...
1
vote
0
answers
107
views
Constructor takes it's own class pointer as param
So, I need to call a constructor to start an action in a game made with Unity, compiled with Il2cpp.
The constructor itself by Ghidra:
void Client.Model.Gameplay.Battle.Commands.CreatePveBattleCmd$$....
- 11
1
vote
1
answer
462
views
Is there a way to find the implementation of methods with MethodImplOptions.InternalCall attribute?
Background:
The Unity engine provides a number of PlayerPrefs.SetXxx functions that can be used to save user data. However, it will automatically append a hash to the name of what you saved. For ...
- 153
0
votes
1
answer
111
views
Decode byte numbers into string
There is this grabber called Itroublve grabber, which a lot of people use, and I wondered what it's aes encryption key is, so I looked at the code, and I found this:
Key = new byte[]
{
...
- 35
0
votes
1
answer
277
views
How can I detect if my application is running in x64debug?
I am writing my own applications to practice reversing. I want to be able to detect debuggers and change the execution in response.
When building the application, I am easily able to detect it is ...
- 3
0
votes
0
answers
735
views
dnSpy - change software value during run
Im working on old software written in C# .NET for increase skills in dnSpy. im new in dnSpy.
When I step-in dnSpy, the program get license information from another dll file. and the dll class are only ...
- 79
1
vote
1
answer
257
views
Mono.Cecil throws SymbolsNotMatchingException, how to find out Method line number?
I tried to use a PDB file to map the Instructions to the Sequencepoints in Mono.Cecil and find out the line number of a method. But none of the answers in any forum seems to work, because no matter ...
0
votes
0
answers
64
views
HTTPS post request not showing up in http debuggers
There is this program I'd like to debug of which I already have the source code.
When I run the program, it sends a post request to a specific URL with JSON data, but it doesn't show up in http ...
- 35
1
vote
0
answers
867
views
C# Console Application can't load file or assembly, but needs a dll which doesn't exists?
I have a strange error. I created for testing purposes a normal Console Application and run my own Tracer which is written with the help of Mono.Cecil on this application. I embedd a Stopwatch at the ...
3
votes
2
answers
583
views
Is there a way to decompress a Fody-Costura generated exe in c#?
There is a program that is possibly a RAT, and I would like to view the source code.
After opening the .exe in dnSpy, I was able to tell that it was compressed with Fody-Costura. (https://github.com/...
- 35
1
vote
0
answers
72
views
Can i follow the invoke function?
im trying to debug some C# app.
Flow: main -> load dll into mem -> main invoke some function (i want to be here after invoke called).
Im using dnspy.
- 57
1
vote
0
answers
262
views
How to add Instructions (OpCodes) after a If Statement in C#?
I hope someone can help me out with my problem. Currently I'm working with C# and use the library Mono.Cecil to add Instruction Code before a method exits. There is this one case, when a if statement ...
1
vote
1
answer
84
views
How to repack the monobundleapp
I recently had to make a version of a survivalcraft 2 mod that allowed circuits to run faster
I found this script by stack overflow to unpack a mono bundle app
I already modified the .dll, but I need ...
6
votes
1
answer
3k
views
Why can C# applications be reverse-compiled with variable names while C++ ones can't?
Why can programs written in C# be reverse-compiled essentially to their original form with variables names (such as dnSpy) while C++ decompilers (such as Ghidra) are unable to decode the variable ...
- 163
1
vote
0
answers
371
views
How to patch C# binary?
I have C# binary. I was able to use dnSpy to decompile it, and analyze. The binary was obfuscated with xenocode obfuscator.
I figured out that I can directly manipulate IL instructions if I just find ...
- 111
1
vote
1
answer
139
views
Where are the .NET IL bytes stored in an .NET executable?
When i compile a c# code, it compiles into a .NET executable, that only imports _CorExeMain from mscoree.dll, now my questions are :
Is _CorExeMain the interpreter that fetches ILs and executes their ...
- 136
2
votes
1
answer
625
views
Reverse engineering a .byte file format
I've dug into files of a game that was made in Unity (which uses C# language)... and i was interested in extracting 3D models and textures etc. I understand that data and obb are separate, BUT! In my ...
- 21
2
votes
1
answer
308
views
Best way to protect source code of exe that being loaded by Assembly.Load method
I am protecting an exe that being loaded by Assembly.Load... This makes everything difficult because most obfuscators causing it to not work properly or not load at all. I used confuserEx Ameteurz ...
- 21
-1
votes
1
answer
473
views
What obfuscator is used?
In version 3.7.3.7 I was able to modify some parts of the code using dnSpy. The language is C#. But in the new(next) version, I did not succeed and I guess the code is obfuscated. De4dot did not help. ...
- 11
2
votes
0
answers
33
views
How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?
Preface: This question is about source code reverse engineering and static analysis. Meaning, there is no built code available but I have access to the source code of the program.
Imagine I'm looking ...
- 1,738
2
votes
1
answer
389
views
How to start out in reversing?
I'm new in reversing and I'd like a lot to learn about it. I have little to no knowledge about it. Is still worth to learn x86 Assembly? Since almost everything these days work on x64 architecture. ...
- 153
0
votes
0
answers
976
views
Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata
I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify.
The first ELF "(binary1)" I have already successfully modified from ...
- 73
5
votes
0
answers
10k
views
Deobfuscating Unknown C# obfuscator?
Hello,
I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my ...
- 51
1
vote
1
answer
1k
views
How to know where a sequences of bytes are used in a .NET application with Dnspy?
There are a sequence of bytes that i need to find out where are used in dnspy
i tried going to hex editor and found the bytes, but right clicking and saying go to code or structure or follow reference ...
- 222
0
votes
1
answer
139
views
Why does an executable still run despite changes to checksum, or changes to data section without new checksum?
I have a "Hello World" console app compiled with Flat Assembler. The size of the executable is 2048 bytes and the checksum is 0x3797.
Questions:
Does it matter if I make changes to the data section ...
user33509
-2
votes
1
answer
3k
views
Debug and crack .NET executable PE
i'm trying to learn reverse engineering for penetration testing my codes and i believe i won't learn unless i can do some practical so
I'm trying to crack an application that is written in C# and all ...
- 101
0
votes
1
answer
641
views
Loading a PE32 executable DLL Intel 80386 into a c# program
I'm new here so I'm sorry if this isn't the right section for my question.
I'm reverse engineering a software that's written in .net 3.5 c# which loads a weird dynamic dll, which has an important ...
2
votes
2
answers
4k
views
IDA Pro sp-analysis failed
I'm trying to reverse engineer a C# file that requires a password to continue running. When I load it in IDA Pro I get nothing in the functions window and a sp-analysis failed
What I see when loaded
- 21
0
votes
0
answers
1k
views
How can I have a breakpoint once a value changes in DnSpy?
I am trying to track a certain value in a game to analyze the cause of a crash (basically, it goes to null at one point and I would like to know what exactly puts that to null as it causes issues ...
1
vote
1
answer
194
views
C# - Identical block of code, but IL instructions changed after update. How do I modify the more convoluted update?
Background info - For the game 7 Days To Die, there is a C# wrapper that implements the Harmony API, which allows us to intercept the game's function calls, as well as changing the IL instructions ...
- 65
0
votes
0
answers
288
views
reverse engineering obfuscated .net dll
I am decompiling a third party .NET dll which was obfuscated using codeveil
my aim is to get full source code,
I tried decompiling using dnSpy, JustDecompile & Reflector
however it just shows the ...
- 101
5
votes
2
answers
2k
views
Trace Method Calls in .NET/C# Binary
I have a heavily obfuscated Windows service binary. Fields, types and methods are renamed. While it is possible to decompile the binary using dnSpy, it is still very cumbersome to identify important/...
- 151
0
votes
1
answer
178
views
Writing a DLL in C# vs C++? [closed]
I am trying to make a client-sided anticheat which would work similar to BattlEye or GameGuard. In order to do this, I want to create a DLL which would do the cheat verification, which then I would ...
- 103
1
vote
1
answer
219
views
How to figure out which button I'm pressing
I'm working on an app, that I'm trying to get to work on a android device that has additional buttons.
The device is called a BH95, from BATL. It has 4 side buttons(1 volume up, 1 power button, 2 ...
- 121
1
vote
2
answers
4k
views
How to debug a DLL written in .NET/C#?
I want to reverse engineer an application written in C#. I would like to set a breakpoint at a function and observe the input passed to it during the normal course of the application's functioning.
1
vote
1
answer
292
views
Is it possible to hijack a C++ DLL after it has been loaded into the memory space? How?
I have a .Net application, in which a C++ DLL is embedded as a resource into the application.
When the .Net application is running, I will extract the C++ DLL to a temporary folder, and after that, ...
- 133
0
votes
1
answer
567
views
ASCII strings not showing up in CPU in OllyDbg, but rather in dump
I'm pretty much new to the Reverse Engineering and assembly language. I've watched some videos about OllyDbg and cracking serial numbers in programs and I got interested in them and I want to learn ...
- 103
2
votes
0
answers
270
views
Decompress from file with crush32
I have some files *.bli, *.ilg, *.pix, etc. These files are from technical documentation LinkOne, and compressed with old C/Win32 compression library crush32.dll.
information can be found here
...
- 21
2
votes
2
answers
531
views
Calculating offset from push instruction in exe to string in data section
So I'm looking for some guidance on this topic.
If I open up my exe in a Hexeditor and go to the location where the address of the string is pushed as argument I have the following:
68 7C 9D F1 01 - ...
- 23
1
vote
1
answer
6k
views
C# Changing method body in runtime
I am trying to change a part in a third party library, it has a bug, however, there are no fixes and source code is not available as well.
At first, I tried to modify IL Opcodes directly by ...
- 113
0
votes
1
answer
391
views
Is there a way to see & keep track of registers in dnSpy?
Hello I am trying to see if there is a way to see & keep track of the IP, and other registers as you would in OllyDbg or x64Dbg?
- 51
Hot Network Questions
- Shimano components upgrade - Claris/Tiagra to 105 R-7000
- Practical usefulness of PCA
- What has changed in the last decade that causes tent cities to spring up?
- Intersection of Linestring with Polygon causes column mismatch in PostGIS
- What game is on the laptop in the background of this cat photo?
- XFLR5 vs AVL vs DATCOM vs OpenVSP
- Did MS-DOS have any support for multithreading?
- distinguish multiple iPhone hotspots
- Translation of the genitive gerund
- If one falls through the ice while ice fishing alone, how might one get out?
- Finite application of one of Reidemeister moves on a knot diagram
- Fair d5 with as few faces as possible
- Why is the Central Limit applicable in A/B testing?
- Have any bits of a space mission ever collided with a planet or large moon (not Earth) that was not a target of the mission?
- Applications for Comparators Stable in Linear Region
- Compute the sum of even numbers between two values
- What were the 20th century historical disputes?
- How can I connect multiple potentiometers (~20) to my Arduino without having to have 20 analogue pins?
- How can I avoid twisting wires in a circuit that rotates through a limited range of motion?
- What is the difference between "would be needed" and "may be needed"?
- On the solution of systems equations with exact coefficients
- What system calls create users and groups?
- Is the German 6-year long position of "researcher for habilitation" (called "Habilitationsstelle") a senior or junior position?
- Would a freeze ray be effective against modern military vehicles?