Questions tagged [c#]
A multi-paradigm programming language encompassing strong typing, imperative, declarative, functional, generic, object-oriented (class-based), and component-oriented programming disciplines
98 questions
0
votes
0
answers
18
views
JSON mapping with obfuscated property names
I'm building a replacement server for the 2013 Android-based PlayJam GameStick micro console and implemented the server-side leaderboard APIs.
One game crashes when retrieving the leaderboard data, ...
- 125
1
vote
1
answer
103
views
Finding entrypoints (native functions) in games/programs
I'm working on a personal project involving reverse engineering a game executable to hook specific functions. The goal is to create a modding framework similar to ScriptHookV for GTA5 or F4SE for ...
- 11
0
votes
1
answer
76
views
C# reverse engineering bypass obfuscation
I have to extract a flag from a test.exe file. The respective flag is run as an argument for the test.exe file => "test.exe FlagName" and in this way I will reach the next flag.
I managed ...
0
votes
0
answers
32
views
Modifying a Bundled .NET 7 Application
I am attempting to reverse a .NET 7 program and patch it, but it is a bundled file.
When importing the EXE into dnSpy I get the headings of a PE file (.text, etc.) and nothing else. However, if I ...
- 1
0
votes
0
answers
80
views
What is this .Net Obfuscator?
I'm analysing a .Net executable and de4dot doesn't detect its obfuscator. Class/Method/Property names start with #=. Does anybody know what obfuscator this is?
// Token: 0x0600EE8B RID: 61067 RVA: ...
- 123
2
votes
1
answer
517
views
Use 3rd-party DLL in my own application
Sorry if this is a bit long; I figured it might be helpful to provide some information on why I'm trying to do what I'm doing. If not, just skip to the "My Problem" section.
Background
I'm ...
- 31
4
votes
0
answers
175
views
How can I generated the function call graph (with API calls) of a .NET executable?
For native executables, I can use IDA to generate the function call graph (FCG) of that executable (which includes API calls as well, for example function sub_xxx has an arrow to CreateFile which ...
- 518
3
votes
1
answer
84
views
Double constructor when reversing Unity game
When reversing Unity dll, the decompiler (i.e. dnSpy) sometimes would create a class with 2 constructors, which are mostly identical apart from some specific field set / not set.
Here is an example:
...
- 328
1
vote
0
answers
103
views
How do I reverse engineer a file uploading api?
The API is pretty old and is written in C#, I tried debugging the API calls with mitmproxy.
This is the successful API call (manually uploading file)
but when I tried curling it, it gave me this error ...
- 11
2
votes
0
answers
89
views
Decoding CalibrationL6.dll
I am having problems with a dll, it is called CalibrationL6.dll, I have been able to see the code inside, and the function that interests me is this:
public static int CalculateCoefficients(
...
- 21
2
votes
1
answer
532
views
Can #if DEBUG in C# become true in the released binary?
I have something like this in my code that checks for user's license:
// C# code:
#if DEBUG
MakeLicenseValidForever();
#else
CheckLicense();
#endif
Now, I need to know if these directives ...
- 123
2
votes
0
answers
86
views
Need help with modifying DOS game extracting graphics codes
I have the following two Codes which make up a DOS Game Graphics Image Extracting Program, written in C# :-
using System;
using System.Collections.Generic;
using System.Text;
using System.IO;
...
- 79
3
votes
0
answers
1k
views
Find constant variables with float values using Ghidra
I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet:
// Namespace:
public class ...
- 309
2
votes
0
answers
259
views
How this data can be referenced in Ghidra?
I reverse engineered libil2cpp.so using ghidra. I found these lines of code in a function in the decompiler view:
UnityEngine.PlayerPrefs$$GetInt(*(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8),5,...
- 309
1
vote
1
answer
106
views
Turning very complicated arithmetic and reverse engineered check into useable code in C#
so I have this problem of me not understanding how to convert this one function into useable code in C#. Problem being that I am currently hooking into a game via C# and I want to rebuild a function ...
3
votes
1
answer
460
views
Compress Xamarin assemblies after decompression
I have an APK that has assemblies in a single blob file. I could extract them successfully using decompress-assemblies.
Is there anyway I can compress them again into assemblies.blob file or at least ...
- 33
1
vote
0
answers
791
views
Decompile C#, xaml and wpf application
I saw the image of an app and I want to use it's source code but when using some decompiler I get over 500 errors. How do I use the code there are two files? I want to decompile the installer and the ...
- 11
1
vote
1
answer
227
views
what is metaData of assemblies and what is used for
hi there I hope you doing well
lately, I have searched about ildasm and how to protect my DLLs from reverse engineering,
so I found some great open source projects (ConfuseEx..), it works when I tried ...
1
vote
0
answers
251
views
Constructor takes it's own class pointer as param
So, I need to call a constructor to start an action in a game made with Unity, compiled with Il2cpp.
The constructor itself by Ghidra:
void Client.Model.Gameplay.Battle.Commands.CreatePveBattleCmd$$....
- 11
1
vote
1
answer
1k
views
Is there a way to find the implementation of methods with MethodImplOptions.InternalCall attribute?
Background:
The Unity engine provides a number of PlayerPrefs.SetXxx functions that can be used to save user data. However, it will automatically append a hash to the name of what you saved. For ...
- 163
0
votes
1
answer
179
views
Decode byte numbers into string
There is this grabber called Itroublve grabber, which a lot of people use, and I wondered what it's aes encryption key is, so I looked at the code, and I found this:
Key = new byte[]
{
...
- 35
0
votes
1
answer
708
views
How can I detect if my application is running in x64debug?
I am writing my own applications to practice reversing. I want to be able to detect debuggers and change the execution in response.
When building the application, I am easily able to detect it is ...
- 3
0
votes
0
answers
2k
views
dnSpy - change software value during run
Im working on old software written in C# .NET for increase skills in dnSpy. im new in dnSpy.
When I step-in dnSpy, the program get license information from another dll file. and the dll class are only ...
- 89
1
vote
1
answer
528
views
Mono.Cecil throws SymbolsNotMatchingException, how to find out Method line number?
I tried to use a PDB file to map the Instructions to the Sequencepoints in Mono.Cecil and find out the line number of a method. But none of the answers in any forum seems to work, because no matter ...
0
votes
0
answers
189
views
HTTPS post request not showing up in http debuggers
There is this program I'd like to debug of which I already have the source code.
When I run the program, it sends a post request to a specific URL with JSON data, but it doesn't show up in http ...
- 35
1
vote
0
answers
1k
views
C# Console Application can't load file or assembly, but needs a dll which doesn't exists?
I have a strange error. I created for testing purposes a normal Console Application and run my own Tracer which is written with the help of Mono.Cecil on this application. I embedd a Stopwatch at the ...
3
votes
2
answers
1k
views
Is there a way to decompress a Fody-Costura generated exe in c#?
There is a program that is possibly a RAT, and I would like to view the source code.
After opening the .exe in dnSpy, I was able to tell that it was compressed with Fody-Costura. (https://github.com/...
- 35
1
vote
0
answers
102
views
Can i follow the invoke function?
im trying to debug some C# app.
Flow: main -> load dll into mem -> main invoke some function (i want to be here after invoke called).
Im using dnspy.
- 67
1
vote
0
answers
414
views
How to add Instructions (OpCodes) after a If Statement in C#?
I hope someone can help me out with my problem. Currently I'm working with C# and use the library Mono.Cecil to add Instruction Code before a method exits. There is this one case, when a if statement ...
1
vote
1
answer
118
views
How to repack the monobundleapp
I recently had to make a version of a survivalcraft 2 mod that allowed circuits to run faster
I found this script by stack overflow to unpack a mono bundle app
I already modified the .dll, but I need ...
7
votes
1
answer
3k
views
Why can C# applications be reverse-compiled with variable names while C++ ones can't?
Why can programs written in C# be reverse-compiled essentially to their original form with variables names (such as dnSpy) while C++ decompilers (such as Ghidra) are unable to decode the variable ...
- 173
1
vote
0
answers
647
views
How to patch C# binary?
I have C# binary. I was able to use dnSpy to decompile it, and analyze. The binary was obfuscated with xenocode obfuscator.
I figured out that I can directly manipulate IL instructions if I just find ...
- 111
2
votes
1
answer
282
views
Where are the .NET IL bytes stored in an .NET executable?
When i compile a c# code, it compiles into a .NET executable, that only imports _CorExeMain from mscoree.dll, now my questions are :
Is _CorExeMain the interpreter that fetches ILs and executes their ...
- 176
2
votes
1
answer
2k
views
Reverse engineering a .byte file format
I've dug into files of a game that was made in Unity (which uses C# language)... and i was interested in extracting 3D models and textures etc. I understand that data and obb are separate, BUT! In my ...
- 21
2
votes
1
answer
470
views
Best way to protect source code of exe that being loaded by Assembly.Load method
I am protecting an exe that being loaded by Assembly.Load... This makes everything difficult because most obfuscators causing it to not work properly or not load at all. I used confuserEx Ameteurz ...
- 21
-2
votes
1
answer
877
views
What obfuscator is used?
In version 3.7.3.7 I was able to modify some parts of the code using dnSpy. The language is C#. But in the new(next) version, I did not succeed and I guess the code is obfuscated. De4dot did not help. ...
- 1
2
votes
0
answers
41
views
How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?
Preface: This question is about source code reverse engineering and static analysis. Meaning, there is no built code available but I have access to the source code of the program.
Imagine I'm looking ...
- 1,880
2
votes
1
answer
511
views
How to start out in reversing?
I'm new in reversing and I'd like a lot to learn about it. I have little to no knowledge about it. Is still worth to learn x86 Assembly? Since almost everything these days work on x64 architecture. ...
- 153
0
votes
0
answers
1k
views
Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata
I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify.
The first ELF "(binary1)" I have already successfully modified from ...
- 83
5
votes
0
answers
15k
views
Deobfuscating Unknown C# obfuscator?
Hello,
I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my ...
- 51
1
vote
1
answer
2k
views
How to know where a sequences of bytes are used in a .NET application with Dnspy?
There are a sequence of bytes that i need to find out where are used in dnspy
i tried going to hex editor and found the bytes, but right clicking and saying go to code or structure or follow reference ...
- 232
0
votes
1
answer
252
views
Why does an executable still run despite changes to checksum, or changes to data section without new checksum?
I have a "Hello World" console app compiled with Flat Assembler. The size of the executable is 2048 bytes and the checksum is 0x3797.
Questions:
Does it matter if I make changes to the data section ...
user33509
-2
votes
1
answer
4k
views
Debug and crack .NET executable PE
i'm trying to learn reverse engineering for penetration testing my codes and i believe i won't learn unless i can do some practical so
I'm trying to crack an application that is written in C# and all ...
- 101
0
votes
1
answer
1k
views
Loading a PE32 executable DLL Intel 80386 into a c# program
I'm new here so I'm sorry if this isn't the right section for my question.
I'm reverse engineering a software that's written in .net 3.5 c# which loads a weird dynamic dll, which has an important ...
2
votes
2
answers
5k
views
IDA Pro sp-analysis failed
I'm trying to reverse engineer a C# file that requires a password to continue running. When I load it in IDA Pro I get nothing in the functions window and a sp-analysis failed
What I see when loaded
- 21
0
votes
0
answers
2k
views
How can I have a breakpoint once a value changes in DnSpy?
I am trying to track a certain value in a game to analyze the cause of a crash (basically, it goes to null at one point and I would like to know what exactly puts that to null as it causes issues ...
1
vote
1
answer
218
views
C# - Identical block of code, but IL instructions changed after update. How do I modify the more convoluted update?
Background info - For the game 7 Days To Die, there is a C# wrapper that implements the Harmony API, which allows us to intercept the game's function calls, as well as changing the IL instructions ...
- 65
0
votes
0
answers
375
views
reverse engineering obfuscated .net dll
I am decompiling a third party .NET dll which was obfuscated using codeveil
my aim is to get full source code,
I tried decompiling using dnSpy, JustDecompile & Reflector
however it just shows the ...
- 101
5
votes
2
answers
2k
views
Trace Method Calls in .NET/C# Binary
I have a heavily obfuscated Windows service binary. Fields, types and methods are renamed. While it is possible to decompile the binary using dnSpy, it is still very cumbersome to identify important/...
- 151
0
votes
1
answer
241
views
Writing a DLL in C# vs C++? [closed]
I am trying to make a client-sided anticheat which would work similar to BattlEye or GameGuard. In order to do this, I want to create a DLL which would do the cheat verification, which then I would ...
- 103