Skip to main content

Questions tagged [c#]

A multi-paradigm programming language encompassing strong typing, imperative, declarative, functional, generic, object-oriented (class-based), and component-oriented programming disciplines

Filter by
Sorted by
Tagged with
0 votes
0 answers
23 views

Modifying a Bundled .NET 7 Application

I am attempting to reverse a .NET 7 program and patch it, but it is a bundled file. When importing the EXE into dnSpy I get the headings of a PE file (.text, etc.) and nothing else. However, if I ...
YeAight's user avatar
0 votes
0 answers
70 views

What is this .Net Obfuscator?

I'm analysing a .Net executable and de4dot doesn't detect its obfuscator. Class/Method/Property names start with #=. Does anybody know what obfuscator this is? // Token: 0x0600EE8B RID: 61067 RVA: ...
Gudarzi's user avatar
  • 123
2 votes
1 answer
487 views

Use 3rd-party DLL in my own application

Sorry if this is a bit long; I figured it might be helpful to provide some information on why I'm trying to do what I'm doing. If not, just skip to the "My Problem" section. Background I'm ...
Chris's user avatar
  • 31
4 votes
0 answers
156 views

How can I generated the function call graph (with API calls) of a .NET executable?

For native executables, I can use IDA to generate the function call graph (FCG) of that executable (which includes API calls as well, for example function sub_xxx has an arrow to CreateFile which ...
OneAndOnly's user avatar
3 votes
1 answer
83 views

Double constructor when reversing Unity game

When reversing Unity dll, the decompiler (i.e. dnSpy) sometimes would create a class with 2 constructors, which are mostly identical apart from some specific field set / not set. Here is an example: ...
Irbis77's user avatar
  • 328
1 vote
0 answers
101 views

How do I reverse engineer a file uploading api?

The API is pretty old and is written in C#, I tried debugging the API calls with mitmproxy. This is the successful API call (manually uploading file) but when I tried curling it, it gave me this error ...
cantcode023's user avatar
2 votes
0 answers
85 views

Decoding CalibrationL6.dll

I am having problems with a dll, it is called CalibrationL6.dll, I have been able to see the code inside, and the function that interests me is this: public static int CalculateCoefficients( ...
raulelerma's user avatar
2 votes
1 answer
522 views

Can #if DEBUG in C# become true in the released binary?

I have something like this in my code that checks for user's license: // C# code: #if DEBUG MakeLicenseValidForever(); #else CheckLicense(); #endif Now, I need to know if these directives ...
Gudarzi's user avatar
  • 123
2 votes
0 answers
82 views

Need help with modifying DOS game extracting graphics codes

I have the following two Codes which make up a DOS Game Graphics Image Extracting Program, written in C# :- using System; using System.Collections.Generic; using System.Text; using System.IO; ...
Edward Winch's user avatar
3 votes
0 answers
1k views

Find constant variables with float values using Ghidra

I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet: // Namespace: public class ...
hanan's user avatar
  • 309
2 votes
0 answers
256 views

How this data can be referenced in Ghidra?

I reverse engineered libil2cpp.so using ghidra. I found these lines of code in a function in the decompiler view: UnityEngine.PlayerPrefs$$GetInt(*(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8),5,...
hanan's user avatar
  • 309
1 vote
1 answer
103 views

Turning very complicated arithmetic and reverse engineered check into useable code in C#

so I have this problem of me not understanding how to convert this one function into useable code in C#. Problem being that I am currently hooking into a game via C# and I want to rebuild a function ...
Oliver Vedel Rasmussen's user avatar
3 votes
1 answer
441 views

Compress Xamarin assemblies after decompression

I have an APK that has assemblies in a single blob file. I could extract them successfully using decompress-assemblies. Is there anyway I can compress them again into assemblies.blob file or at least ...
paddle.code's user avatar
1 vote
0 answers
772 views

Decompile C#, xaml and wpf application

I saw the image of an app and I want to use it's source code but when using some decompiler I get over 500 errors. How do I use the code there are two files? I want to decompile the installer and the ...
ThatIdleBoy's user avatar
1 vote
1 answer
221 views

what is metaData of assemblies and what is used for

hi there I hope you doing well lately, I have searched about ildasm and how to protect my DLLs from reverse engineering, so I found some great open source projects (ConfuseEx..), it works when I tried ...
makri aymen abderraouf's user avatar
1 vote
0 answers
243 views

Constructor takes it's own class pointer as param

So, I need to call a constructor to start an action in a game made with Unity, compiled with Il2cpp. The constructor itself by Ghidra: void Client.Model.Gameplay.Battle.Commands.CreatePveBattleCmd$$....
Hanndel's user avatar
  • 11
1 vote
1 answer
1k views

Is there a way to find the implementation of methods with MethodImplOptions.InternalCall attribute?

Background: The Unity engine provides a number of PlayerPrefs.SetXxx functions that can be used to save user data. However, it will automatically append a hash to the name of what you saved. For ...
user239216's user avatar
0 votes
1 answer
178 views

Decode byte numbers into string

There is this grabber called Itroublve grabber, which a lot of people use, and I wondered what it's aes encryption key is, so I looked at the code, and I found this: Key = new byte[] { ...
Nqndi's user avatar
  • 35
0 votes
1 answer
642 views

How can I detect if my application is running in x64debug?

I am writing my own applications to practice reversing. I want to be able to detect debuggers and change the execution in response. When building the application, I am easily able to detect it is ...
Srackers's user avatar
0 votes
0 answers
2k views

dnSpy - change software value during run

Im working on old software written in C# .NET for increase skills in dnSpy. im new in dnSpy. When I step-in dnSpy, the program get license information from another dll file. and the dll class are only ...
Jason's user avatar
  • 89
1 vote
1 answer
507 views

Mono.Cecil throws SymbolsNotMatchingException, how to find out Method line number?

I tried to use a PDB file to map the Instructions to the Sequencepoints in Mono.Cecil and find out the line number of a method. But none of the answers in any forum seems to work, because no matter ...
programming_is_bae's user avatar
0 votes
0 answers
171 views

HTTPS post request not showing up in http debuggers

There is this program I'd like to debug of which I already have the source code. When I run the program, it sends a post request to a specific URL with JSON data, but it doesn't show up in http ...
Nqndi's user avatar
  • 35
1 vote
0 answers
1k views

C# Console Application can't load file or assembly, but needs a dll which doesn't exists?

I have a strange error. I created for testing purposes a normal Console Application and run my own Tracer which is written with the help of Mono.Cecil on this application. I embedd a Stopwatch at the ...
programming_is_bae's user avatar
3 votes
2 answers
1k views

Is there a way to decompress a Fody-Costura generated exe in c#?

There is a program that is possibly a RAT, and I would like to view the source code. After opening the .exe in dnSpy, I was able to tell that it was compressed with Fody-Costura. (https://github.com/...
Nqndi's user avatar
  • 35
1 vote
0 answers
102 views

Can i follow the invoke function?

im trying to debug some C# app. Flow: main -> load dll into mem -> main invoke some function (i want to be here after invoke called). Im using dnspy.
Brian MJ's user avatar
1 vote
0 answers
410 views

How to add Instructions (OpCodes) after a If Statement in C#?

I hope someone can help me out with my problem. Currently I'm working with C# and use the library Mono.Cecil to add Instruction Code before a method exits. There is this one case, when a if statement ...
programming_is_bae's user avatar
1 vote
1 answer
117 views

How to repack the monobundleapp

I recently had to make a version of a survivalcraft 2 mod that allowed circuits to run faster I found this script by stack overflow to unpack a mono bundle app I already modified the .dll, but I need ...
nome criativo's user avatar
7 votes
1 answer
3k views

Why can C# applications be reverse-compiled with variable names while C++ ones can't?

Why can programs written in C# be reverse-compiled essentially to their original form with variables names (such as dnSpy) while C++ decompilers (such as Ghidra) are unable to decode the variable ...
Polydynamical's user avatar
1 vote
0 answers
633 views

How to patch C# binary?

I have C# binary. I was able to use dnSpy to decompile it, and analyze. The binary was obfuscated with xenocode obfuscator. I figured out that I can directly manipulate IL instructions if I just find ...
warchantua's user avatar
2 votes
1 answer
273 views

Where are the .NET IL bytes stored in an .NET executable?

When i compile a c# code, it compiles into a .NET executable, that only imports _CorExeMain from mscoree.dll, now my questions are : Is _CorExeMain the interpreter that fetches ILs and executes their ...
Notoriouss's user avatar
2 votes
1 answer
1k views

Reverse engineering a .byte file format

I've dug into files of a game that was made in Unity (which uses C# language)... and i was interested in extracting 3D models and textures etc. I understand that data and obb are separate, BUT! In my ...
user35770's user avatar
2 votes
1 answer
437 views

Best way to protect source code of exe that being loaded by Assembly.Load method

I am protecting an exe that being loaded by Assembly.Load... This makes everything difficult because most obfuscators causing it to not work properly or not load at all. I used confuserEx Ameteurz ...
dreamerx's user avatar
-2 votes
1 answer
868 views

What obfuscator is used?

In version 3.7.3.7 I was able to modify some parts of the code using dnSpy. The language is C#. But in the new(next) version, I did not succeed and I guess the code is obfuscated. De4dot did not help. ...
turb1te's user avatar
2 votes
0 answers
39 views

How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?

Preface: This question is about source code reverse engineering and static analysis. Meaning, there is no built code available but I have access to the source code of the program. Imagine I'm looking ...
the_endian's user avatar
  • 1,870
2 votes
1 answer
503 views

How to start out in reversing?

I'm new in reversing and I'd like a lot to learn about it. I have little to no knowledge about it. Is still worth to learn x86 Assembly? Since almost everything these days work on x64 architecture. ...
Sharki's user avatar
  • 153
0 votes
0 answers
1k views

Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata

I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify. The first ELF "(binary1)" I have already successfully modified from ...
Alonia's user avatar
  • 83
5 votes
0 answers
15k views

Deobfuscating Unknown C# obfuscator?

Hello, I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my ...
mo5br's user avatar
  • 51
1 vote
1 answer
2k views

How to know where a sequences of bytes are used in a .NET application with Dnspy?

There are a sequence of bytes that i need to find out where are used in dnspy i tried going to hex editor and found the bytes, but right clicking and saying go to code or structure or follow reference ...
Mery Ted's user avatar
  • 232
0 votes
1 answer
249 views

Why does an executable still run despite changes to checksum, or changes to data section without new checksum?

I have a "Hello World" console app compiled with Flat Assembler. The size of the executable is 2048 bytes and the checksum is 0x3797. Questions: Does it matter if I make changes to the data section ...
user avatar
-2 votes
1 answer
4k views

Debug and crack .NET executable PE

i'm trying to learn reverse engineering for penetration testing my codes and i believe i won't learn unless i can do some practical so I'm trying to crack an application that is written in C# and all ...
Ebrahim Karimi's user avatar
0 votes
1 answer
1k views

Loading a PE32 executable DLL Intel 80386 into a c# program

I'm new here so I'm sorry if this isn't the right section for my question. I'm reverse engineering a software that's written in .net 3.5 c# which loads a weird dynamic dll, which has an important ...
Hassan Abdul-Kareem's user avatar
2 votes
2 answers
5k views

IDA Pro sp-analysis failed

I'm trying to reverse engineer a C# file that requires a password to continue running. When I load it in IDA Pro I get nothing in the functions window and a sp-analysis failed What I see when loaded
KibbeWater's user avatar
0 votes
0 answers
2k views

How can I have a breakpoint once a value changes in DnSpy?

I am trying to track a certain value in a game to analyze the cause of a crash (basically, it goes to null at one point and I would like to know what exactly puts that to null as it causes issues ...
aldelaro5's user avatar
1 vote
1 answer
215 views

C# - Identical block of code, but IL instructions changed after update. How do I modify the more convoluted update?

Background info - For the game 7 Days To Die, there is a C# wrapper that implements the Harmony API, which allows us to intercept the game's function calls, as well as changing the IL instructions ...
FiftyTifty's user avatar
0 votes
0 answers
369 views

reverse engineering obfuscated .net dll

I am decompiling a third party .NET dll which was obfuscated using codeveil my aim is to get full source code, I tried decompiling using dnSpy, JustDecompile & Reflector however it just shows the ...
Nitin Sawant's user avatar
5 votes
2 answers
2k views

Trace Method Calls in .NET/C# Binary

I have a heavily obfuscated Windows service binary. Fields, types and methods are renamed. While it is possible to decompile the binary using dnSpy, it is still very cumbersome to identify important/...
DucatiNerd's user avatar
0 votes
1 answer
239 views

Writing a DLL in C# vs C++? [closed]

I am trying to make a client-sided anticheat which would work similar to BattlEye or GameGuard. In order to do this, I want to create a DLL which would do the cheat verification, which then I would ...
Radu's user avatar
  • 103
1 vote
1 answer
290 views

How to figure out which button I'm pressing

I'm working on an app, that I'm trying to get to work on a android device that has additional buttons. The device is called a BH95, from BATL. It has 4 side buttons(1 volume up, 1 power button, 2 ...
MartinArrJay's user avatar
1 vote
2 answers
5k views

How to debug a DLL written in .NET/C#?

I want to reverse engineer an application written in C#. I would like to set a breakpoint at a function and observe the input passed to it during the normal course of the application's functioning.
Japjit Singh N.'s user avatar
1 vote
1 answer
370 views

Is it possible to hijack a C++ DLL after it has been loaded into the memory space? How?

I have a .Net application, in which a C++ DLL is embedded as a resource into the application. When the .Net application is running, I will extract the C++ DLL to a temporary folder, and after that, ...
Graviton's user avatar
  • 133