Questions tagged [c#]
A multi-paradigm programming language encompassing strong typing, imperative, declarative, functional, generic, object-oriented (class-based), and component-oriented programming disciplines
93
questions
2
votes
1
answer
214
views
Use 3rd-party DLL in my own application
Sorry if this is a bit long; I figured it might be helpful to provide some information on why I'm trying to do what I'm doing. If not, just skip to the "My Problem" section.
Background
I'm ...
- 31
4
votes
0
answers
81
views
How can I generated the function call graph (with API calls) of a .NET executable?
For native executables, I can use IDA to generate the function call graph (FCG) of that executable (which includes API calls as well, for example function sub_xxx has an arrow to CreateFile which ...
- 519
3
votes
1
answer
81
views
Double constructor when reversing Unity game
When reversing Unity dll, the decompiler (i.e. dnSpy) sometimes would create a class with 2 constructors, which are mostly identical apart from some specific field set / not set.
Here is an example:
...
- 326
1
vote
0
answers
84
views
How do I reverse engineer a file uploading api?
The API is pretty old and is written in C#, I tried debugging the API calls with mitmproxy.
This is the successful API call (manually uploading file)
but when I tried curling it, it gave me this error ...
- 11
2
votes
0
answers
61
views
Decoding CalibrationL6.dll
I am having problems with a dll, it is called CalibrationL6.dll, I have been able to see the code inside, and the function that interests me is this:
public static int CalculateCoefficients(
...
- 21
2
votes
1
answer
306
views
Can #if DEBUG in C# become true in the released binary?
I have something like this in my code that checks for user's license:
// C# code:
#if DEBUG
MakeLicenseValidForever();
#else
CheckLicense();
#endif
Now, I need to know if these directives ...
- 123
2
votes
0
answers
75
views
Need help with modifying DOS game extracting graphics codes
I have the following two Codes which make up a DOS Game Graphics Image Extracting Program, written in C# :-
using System;
using System.Collections.Generic;
using System.Text;
using System.IO;
...
- 79
3
votes
0
answers
709
views
Find constant variables with float values using Ghidra
I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet:
// Namespace:
public class ...
- 309
2
votes
0
answers
205
views
How this data can be referenced in Ghidra?
I reverse engineered libil2cpp.so using ghidra. I found these lines of code in a function in the decompiler view:
UnityEngine.PlayerPrefs$$GetInt(*(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8),5,...
- 309
1
vote
1
answer
95
views
Turning very complicated arithmetic and reverse engineered check into useable code in C#
so I have this problem of me not understanding how to convert this one function into useable code in C#. Problem being that I am currently hooking into a game via C# and I want to rebuild a function ...
3
votes
1
answer
287
views
Compress Xamarin assemblies after decompression
I have an APK that has assemblies in a single blob file. I could extract them successfully using decompress-assemblies.
Is there anyway I can compress them again into assemblies.blob file or at least ...
- 31
1
vote
0
answers
596
views
Decompile C#, xaml and wpf application
I saw the image of an app and I want to use it's source code but when using some decompiler I get over 500 errors. How do I use the code there are two files? I want to decompile the installer and the ...
- 11
1
vote
1
answer
174
views
what is metaData of assemblies and what is used for
hi there I hope you doing well
lately, I have searched about ildasm and how to protect my DLLs from reverse engineering,
so I found some great open source projects (ConfuseEx..), it works when I tried ...
1
vote
0
answers
222
views
Constructor takes it's own class pointer as param
So, I need to call a constructor to start an action in a game made with Unity, compiled with Il2cpp.
The constructor itself by Ghidra:
void Client.Model.Gameplay.Battle.Commands.CreatePveBattleCmd$$....
- 11
1
vote
1
answer
846
views
Is there a way to find the implementation of methods with MethodImplOptions.InternalCall attribute?
Background:
The Unity engine provides a number of PlayerPrefs.SetXxx functions that can be used to save user data. However, it will automatically append a hash to the name of what you saved. For ...
- 163
0
votes
1
answer
138
views
Decode byte numbers into string
There is this grabber called Itroublve grabber, which a lot of people use, and I wondered what it's aes encryption key is, so I looked at the code, and I found this:
Key = new byte[]
{
...
- 35
0
votes
1
answer
502
views
How can I detect if my application is running in x64debug?
I am writing my own applications to practice reversing. I want to be able to detect debuggers and change the execution in response.
When building the application, I am easily able to detect it is ...
- 3
0
votes
0
answers
1k
views
dnSpy - change software value during run
Im working on old software written in C# .NET for increase skills in dnSpy. im new in dnSpy.
When I step-in dnSpy, the program get license information from another dll file. and the dll class are only ...
- 89
1
vote
1
answer
413
views
Mono.Cecil throws SymbolsNotMatchingException, how to find out Method line number?
I tried to use a PDB file to map the Instructions to the Sequencepoints in Mono.Cecil and find out the line number of a method. But none of the answers in any forum seems to work, because no matter ...
0
votes
0
answers
132
views
HTTPS post request not showing up in http debuggers
There is this program I'd like to debug of which I already have the source code.
When I run the program, it sends a post request to a specific URL with JSON data, but it doesn't show up in http ...
- 35
1
vote
0
answers
1k
views
C# Console Application can't load file or assembly, but needs a dll which doesn't exists?
I have a strange error. I created for testing purposes a normal Console Application and run my own Tracer which is written with the help of Mono.Cecil on this application. I embedd a Stopwatch at the ...
3
votes
2
answers
867
views
Is there a way to decompress a Fody-Costura generated exe in c#?
There is a program that is possibly a RAT, and I would like to view the source code.
After opening the .exe in dnSpy, I was able to tell that it was compressed with Fody-Costura. (https://github.com/...
- 35
1
vote
0
answers
94
views
Can i follow the invoke function?
im trying to debug some C# app.
Flow: main -> load dll into mem -> main invoke some function (i want to be here after invoke called).
Im using dnspy.
- 67
1
vote
0
answers
349
views
How to add Instructions (OpCodes) after a If Statement in C#?
I hope someone can help me out with my problem. Currently I'm working with C# and use the library Mono.Cecil to add Instruction Code before a method exits. There is this one case, when a if statement ...
1
vote
1
answer
105
views
How to repack the monobundleapp
I recently had to make a version of a survivalcraft 2 mod that allowed circuits to run faster
I found this script by stack overflow to unpack a mono bundle app
I already modified the .dll, but I need ...
7
votes
1
answer
3k
views
Why can C# applications be reverse-compiled with variable names while C++ ones can't?
Why can programs written in C# be reverse-compiled essentially to their original form with variables names (such as dnSpy) while C++ decompilers (such as Ghidra) are unable to decode the variable ...
- 173
1
vote
0
answers
556
views
How to patch C# binary?
I have C# binary. I was able to use dnSpy to decompile it, and analyze. The binary was obfuscated with xenocode obfuscator.
I figured out that I can directly manipulate IL instructions if I just find ...
- 111
2
votes
1
answer
210
views
Where are the .NET IL bytes stored in an .NET executable?
When i compile a c# code, it compiles into a .NET executable, that only imports _CorExeMain from mscoree.dll, now my questions are :
Is _CorExeMain the interpreter that fetches ILs and executes their ...
- 176
2
votes
1
answer
1k
views
Reverse engineering a .byte file format
I've dug into files of a game that was made in Unity (which uses C# language)... and i was interested in extracting 3D models and textures etc. I understand that data and obb are separate, BUT! In my ...
- 21
2
votes
1
answer
386
views
Best way to protect source code of exe that being loaded by Assembly.Load method
I am protecting an exe that being loaded by Assembly.Load... This makes everything difficult because most obfuscators causing it to not work properly or not load at all. I used confuserEx Ameteurz ...
- 21
-2
votes
1
answer
703
views
What obfuscator is used?
In version 3.7.3.7 I was able to modify some parts of the code using dnSpy. The language is C#. But in the new(next) version, I did not succeed and I guess the code is obfuscated. De4dot did not help. ...
- 1
2
votes
0
answers
37
views
How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?
Preface: This question is about source code reverse engineering and static analysis. Meaning, there is no built code available but I have access to the source code of the program.
Imagine I'm looking ...
- 1,830
2
votes
1
answer
450
views
How to start out in reversing?
I'm new in reversing and I'd like a lot to learn about it. I have little to no knowledge about it. Is still worth to learn x86 Assembly? Since almost everything these days work on x64 architecture. ...
- 153
0
votes
0
answers
1k
views
Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata
I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify.
The first ELF "(binary1)" I have already successfully modified from ...
- 83
5
votes
0
answers
13k
views
Deobfuscating Unknown C# obfuscator?
Hello,
I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my ...
- 51
1
vote
1
answer
2k
views
How to know where a sequences of bytes are used in a .NET application with Dnspy?
There are a sequence of bytes that i need to find out where are used in dnspy
i tried going to hex editor and found the bytes, but right clicking and saying go to code or structure or follow reference ...
- 232
0
votes
1
answer
204
views
Why does an executable still run despite changes to checksum, or changes to data section without new checksum?
I have a "Hello World" console app compiled with Flat Assembler. The size of the executable is 2048 bytes and the checksum is 0x3797.
Questions:
Does it matter if I make changes to the data section ...
user33509
-2
votes
1
answer
3k
views
Debug and crack .NET executable PE
i'm trying to learn reverse engineering for penetration testing my codes and i believe i won't learn unless i can do some practical so
I'm trying to crack an application that is written in C# and all ...
- 101
0
votes
1
answer
891
views
Loading a PE32 executable DLL Intel 80386 into a c# program
I'm new here so I'm sorry if this isn't the right section for my question.
I'm reverse engineering a software that's written in .net 3.5 c# which loads a weird dynamic dll, which has an important ...
2
votes
2
answers
5k
views
IDA Pro sp-analysis failed
I'm trying to reverse engineer a C# file that requires a password to continue running. When I load it in IDA Pro I get nothing in the functions window and a sp-analysis failed
What I see when loaded
- 21
0
votes
0
answers
1k
views
How can I have a breakpoint once a value changes in DnSpy?
I am trying to track a certain value in a game to analyze the cause of a crash (basically, it goes to null at one point and I would like to know what exactly puts that to null as it causes issues ...
1
vote
1
answer
207
views
C# - Identical block of code, but IL instructions changed after update. How do I modify the more convoluted update?
Background info - For the game 7 Days To Die, there is a C# wrapper that implements the Harmony API, which allows us to intercept the game's function calls, as well as changing the IL instructions ...
- 65
0
votes
0
answers
348
views
reverse engineering obfuscated .net dll
I am decompiling a third party .NET dll which was obfuscated using codeveil
my aim is to get full source code,
I tried decompiling using dnSpy, JustDecompile & Reflector
however it just shows the ...
- 101
5
votes
2
answers
2k
views
Trace Method Calls in .NET/C# Binary
I have a heavily obfuscated Windows service binary. Fields, types and methods are renamed. While it is possible to decompile the binary using dnSpy, it is still very cumbersome to identify important/...
- 151
0
votes
1
answer
208
views
Writing a DLL in C# vs C++? [closed]
I am trying to make a client-sided anticheat which would work similar to BattlEye or GameGuard. In order to do this, I want to create a DLL which would do the cheat verification, which then I would ...
- 103
1
vote
1
answer
255
views
How to figure out which button I'm pressing
I'm working on an app, that I'm trying to get to work on a android device that has additional buttons.
The device is called a BH95, from BATL. It has 4 side buttons(1 volume up, 1 power button, 2 ...
- 121
1
vote
2
answers
4k
views
How to debug a DLL written in .NET/C#?
I want to reverse engineer an application written in C#. I would like to set a breakpoint at a function and observe the input passed to it during the normal course of the application's functioning.
1
vote
1
answer
349
views
Is it possible to hijack a C++ DLL after it has been loaded into the memory space? How?
I have a .Net application, in which a C++ DLL is embedded as a resource into the application.
When the .Net application is running, I will extract the C++ DLL to a temporary folder, and after that, ...
- 133
0
votes
1
answer
607
views
ASCII strings not showing up in CPU in OllyDbg, but rather in dump
I'm pretty much new to the Reverse Engineering and assembly language. I've watched some videos about OllyDbg and cracking serial numbers in programs and I got interested in them and I want to learn ...
- 103
2
votes
0
answers
302
views
Decompress from file with crush32
I have some files *.bli, *.ilg, *.pix, etc. These files are from technical documentation LinkOne, and compressed with old C/Win32 compression library crush32.dll.
information can be found here
...
- 21