Questions tagged [c#]

A multi-paradigm programming language encompassing strong typing, imperative, declarative, functional, generic, object-oriented (class-based), and component-oriented programming disciplines

Filter by
Sorted by
Tagged with
1
vote
1answer
16 views

Is there a way to find the implementation of methods with MethodImplOptions.InternalCall attribute?

Background: The Unity engine provides a number of PlayerPrefs.SetXxx functions that can be used to save user data. However, it will automatically append a hash to the name of what you saved. For ...
0
votes
1answer
52 views

Decode byte numbers into string

There is this grabber called Itroublve grabber, which a lot of people use, and I wondered what it's aes encryption key is, so I looked at the code, and I found this: Key = new byte[] { ...
0
votes
1answer
59 views

How can I detect if my application is running in x64debug?

I am writing my own applications to practice reversing. I want to be able to detect debuggers and change the execution in response. When building the application, I am easily able to detect it is ...
0
votes
0answers
69 views

dnSpy - change software value during run

Im working on old software written in C# .NET for increase skills in dnSpy. im new in dnSpy. When I step-in dnSpy, the program get license information from another dll file. and the dll class are only ...
1
vote
1answer
50 views

Mono.Cecil throws SymbolsNotMatchingException, how to find out Method line number?

I tried to use a PDB file to map the Instructions to the Sequencepoints in Mono.Cecil and find out the line number of a method. But none of the answers in any forum seems to work, because no matter ...
0
votes
0answers
52 views

HTTPS post request not showing up in http debuggers

There is this program I'd like to debug of which I already have the source code. When I run the program, it sends a post request to a specific URL with JSON data, but it doesn't show up in http ...
1
vote
0answers
143 views

C# Console Application can't load file or assembly, but needs a dll which doesn't exists?

I have a strange error. I created for testing purposes a normal Console Application and run my own Tracer which is written with the help of Mono.Cecil on this application. I embedd a Stopwatch at the ...
1
vote
1answer
102 views

Is there a way to decompress a Fody-Costura generated exe in c#?

There is a program that is possibly a RAT, and I would like to view the source code. After opening the .exe in dnSpy, I was able to tell that it was compressed with Fody-Costura. (https://github.com/...
1
vote
0answers
32 views

Can i follow the invoke function?

im trying to debug some C# app. Flow: main -> load dll into mem -> main invoke some function (i want to be here after invoke called). Im using dnspy.
1
vote
0answers
72 views

How to add Instructions (OpCodes) after a If Statement in C#?

I hope someone can help me out with my problem. Currently I'm working with C# and use the library Mono.Cecil to add Instruction Code before a method exits. There is this one case, when a if statement ...
1
vote
1answer
53 views

How to repack the monobundleapp

I recently had to make a version of a survivalcraft 2 mod that allowed circuits to run faster I found this script by stack overflow to unpack a mono bundle app I already modified the .dll, but I need ...
0
votes
0answers
161 views

Deobfuscating C# sample with de4dot failed

I have a C# sample that is obfuscated by Agile.NET. Can someone give me a tip , when de4dot is not able to deobfuscate it(ERROR: Hmmmm... something didn't work. Try the latest version.)? I use the ...
6
votes
1answer
2k views

Why can C# applications be reverse-compiled with variable names while C++ ones can't?

Why can programs written in C# be reverse-compiled essentially to their original form with variables names (such as dnSpy) while C++ decompilers (such as Ghidra) are unable to decode the variable ...
1
vote
0answers
114 views

How to patch C# binary?

I have C# binary. I was able to use dnSpy to decompile it, and analyze. The binary was obfuscated with xenocode obfuscator. I figured out that I can directly manipulate IL instructions if I just find ...
0
votes
0answers
43 views

c# - Eject Injected Dll From Proc. Then Re-Inject Capability

I made a simple c# application to inject .dll to given process. But I also want to have a capability to eject then depending on user's choice, can re-inject the same .dll to same process. I'm working ...
0
votes
0answers
62 views

.NET Crypto Deobfuscation Help

i have been working on reversing a little app that i have been tasked with, and im kinda at a road block. I need to start an instance of the main form, however the app is obfuscated with Crypto ...
0
votes
0answers
44 views

Access violation writing location

I am currently playing with C# and detours/trampolines using a library I found here: https://github.com/xcvd/Detours I am attempting to hook a known function in a game and then call the original ...
1
vote
1answer
84 views

Where are the .NET IL bytes stored in an .NET executable?

When i compile a c# code, it compiles into a .NET executable, that only imports _CorExeMain from mscoree.dll, now my questions are : Is _CorExeMain the interpreter that fetches ILs and executes their ...
2
votes
1answer
268 views

Reverse engineering a .byte file format

I've dug into files of a game that was made in Unity (which uses C# language)... and i was interested in extracting 3D models and textures etc. I understand that data and obb are separate, BUT! In my ...
0
votes
1answer
145 views

Best way to protect source code of exe that being loaded by Assembly.Load method

I am protecting an exe that being loaded by Assembly.Load... This makes everything difficult because most obfuscators causing it to not work properly or not load at all. I used confuserEx Ameteurz ...
-2
votes
1answer
145 views

What obfuscator is used?

In version 3.7.3.7 I was able to modify some parts of the code using dnSpy. The language is C#. But in the new(next) version, I did not succeed and I guess the code is obfuscated. De4dot did not help. ...
0
votes
0answers
56 views

Cannot find C# obfuscator

I'm trying to deobfuscate C# assembly. The names of functions are as follows #=gibberish= I've seen this kind of obfuscation before... But I don't remember where. Can anyone have any clues?
3
votes
0answers
30 views

How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?

Preface: This question is about source code reverse engineering and static analysis. Meaning, there is no built code available but I have access to the source code of the program. Imagine I'm looking ...
2
votes
1answer
249 views

How to start out in reversing?

I'm new in reversing and I'd like a lot to learn about it. I have little to no knowledge about it. Is still worth to learn x86 Assembly? Since almost everything these days work on x64 architecture. ...
0
votes
0answers
409 views

Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata

I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify. The first ELF "(binary1)" I have already successfully modified from ...
2
votes
0answers
4k views

Deobfuscating Unknown C# obfuscator?

Hello, I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my ...
1
vote
1answer
692 views

How to know where a sequences of bytes are used in a .NET application with Dnspy?

There are a sequence of bytes that i need to find out where are used in dnspy i tried going to hex editor and found the bytes, but right clicking and saying go to code or structure or follow reference ...
0
votes
1answer
60 views

Why does an executable still run despite changes to checksum, or changes to data section without new checksum?

I have a "Hello World" console app compiled with Flat Assembler. The size of the executable is 2048 bytes and the checksum is 0x3797. Questions: Does it matter if I make changes to the data section ...
-2
votes
1answer
2k views

Debug and crack .NET executable PE

i'm trying to learn reverse engineering for penetration testing my codes and i believe i won't learn unless i can do some practical so I'm trying to crack an application that is written in C# and all ...
0
votes
1answer
269 views

Loading a PE32 executable DLL Intel 80386 into a c# program

I'm new here so I'm sorry if this isn't the right section for my question. I'm reverse engineering a software that's written in .net 3.5 c# which loads a weird dynamic dll, which has an important ...
1
vote
1answer
2k views

IDA Pro sp-analysis failed

I'm trying to reverse engineer a C# file that requires a password to continue running. When I load it in IDA Pro I get nothing in the functions window and a sp-analysis failed What I see when loaded
0
votes
0answers
775 views

How can I have a breakpoint once a value changes in DnSpy?

I am trying to track a certain value in a game to analyze the cause of a crash (basically, it goes to null at one point and I would like to know what exactly puts that to null as it causes issues ...
1
vote
1answer
126 views

C# - Identical block of code, but IL instructions changed after update. How do I modify the more convoluted update?

Background info - For the game 7 Days To Die, there is a C# wrapper that implements the Harmony API, which allows us to intercept the game's function calls, as well as changing the IL instructions ...
0
votes
0answers
201 views

reverse engineering obfuscated .net dll

I am decompiling a third party .NET dll which was obfuscated using codeveil my aim is to get full source code, I tried decompiling using dnSpy, JustDecompile & Reflector however it just shows the ...
5
votes
2answers
1k views

Trace Method Calls in .NET/C# Binary

I have a heavily obfuscated Windows service binary. Fields, types and methods are renamed. While it is possible to decompile the binary using dnSpy, it is still very cumbersome to identify important/...
0
votes
1answer
122 views

Writing a DLL in C# vs C++? [closed]

I am trying to make a client-sided anticheat which would work similar to BattlEye or GameGuard. In order to do this, I want to create a DLL which would do the cheat verification, which then I would ...
1
vote
1answer
164 views

How to figure out which button I'm pressing

I'm working on an app, that I'm trying to get to work on a android device that has additional buttons. The device is called a BH95, from BATL. It has 4 side buttons(1 volume up, 1 power button, 2 ...
1
vote
2answers
3k views

How to debug a DLL written in .NET/C#?

I want to reverse engineer an application written in C#. I would like to set a breakpoint at a function and observe the input passed to it during the normal course of the application's functioning.
1
vote
1answer
245 views

Is it possible to hijack a C++ DLL after it has been loaded into the memory space? How?

I have a .Net application, in which a C++ DLL is embedded as a resource into the application. When the .Net application is running, I will extract the C++ DLL to a temporary folder, and after that, ...
0
votes
1answer
415 views

ASCII strings not showing up in CPU in OllyDbg, but rather in dump

I'm pretty much new to the Reverse Engineering and assembly language. I've watched some videos about OllyDbg and cracking serial numbers in programs and I got interested in them and I want to learn ...
2
votes
0answers
203 views

Decompress from file with crush32

I have some files *.bli, *.ilg, *.pix, etc. These files are from technical documentation LinkOne, and compressed with old C/Win32 compression library crush32.dll. information can be found here ...
2
votes
2answers
396 views

Calculating offset from push instruction in exe to string in data section

So I'm looking for some guidance on this topic. If I open up my exe in a Hexeditor and go to the location where the address of the string is pushed as argument I have the following: 68 7C 9D F1 01 - ...
1
vote
1answer
4k views

C# Changing method body in runtime

I am trying to change a part in a third party library, it has a bug, however, there are no fixes and source code is not available as well. At first, I tried to modify IL Opcodes directly by ...
0
votes
1answer
169 views

Is there a way to see & keep track of registers in dnSpy?

Hello I am trying to see if there is a way to see & keep track of the IP, and other registers as you would in OllyDbg or x64Dbg?
0
votes
1answer
393 views

What methods exist for adding new windows form controls into compiled assembly using dnSpy?

I am trying to add another button into windows form using dnSpy. Is it possible to add another? I want the end result be like this one. Any help will be highly appreciated.Thanks
0
votes
1answer
3k views

How to export function from exe file?

I open exe file (running on Windows) in Ida , and saw a function (for example sub_ABC) that I want to export , so I can call this function from c# code. How can I export function that I Know the name ...
2
votes
0answers
217 views

Patching an app that updates frequently

Hello i am working with an app coded in c# which updates very often usually within 2-3 days or sometimes every 12 hours The updates are really needed for the app to work So i was wondering what can i ...
1
vote
0answers
127 views

Re-engineering to create UML Diagrams from .NET binary assembly

What is the base way to generate UML diagrams (both class and sequence) from .NET assembly using OpenSource tools? The 200% Reflective Class Diagram Creation Tool cannot be used due on problems ...
1
vote
0answers
473 views

C# Hidden Method through transparent proxy object?

I'm dealing with an interesting form of obfuscation. A C# program I am reversing has a central API, let's call it "Central API". This Central API has several functions that aren't exactly defined. ...
1
vote
0answers
65 views

Can I see Stack and Heap value/addresses from this simple C# program process?

I am studying reading dumped memory image and analyzing it with volatility. I wrote this c# program and I was hoping to see the analyzed data from Volatiliy namespace CSharpEx1 { class Program ...