Questions tagged [c#]

A multi-paradigm programming language encompassing strong typing, imperative, declarative, functional, generic, object-oriented (class-based), and component-oriented programming disciplines

Filter by
Sorted by
Tagged with
10
votes
1answer
2k views

Rename obfuscated names with .NET Reflector?

I have some obfuscated C# .NET code I want to analyze. Is it possible to rename those obfuscated symbols? So I can more easily track them? Like IDA Pro can work with renaming functions and so forth.
7
votes
3answers
10k views

How to decompile a C# .exe on macOS?

It this even possible? Are there any free tools?
6
votes
1answer
559 views

How to tell if a particular .NET assembly was written in C# or F#?

The motivation for this question is that I used JetBrains dotPeek to decompile an .exe written in F#, but the output project directory produced C# code. Why does decompiling an F# assembly produce C# ...
5
votes
4answers
35k views

Modify code with ILSpy

I want to modify an exe a little bit. With ILSpy I see all the code that I need but I don't know how to modify the code. I tried "save code" on ILSpy that exports a .cs file, but when I open the .cs ...
5
votes
2answers
535 views

Trace Method Calls in .NET/C# Binary

I have a heavily obfuscated Windows service binary. Fields, types and methods are renamed. While it is possible to decompile the binary using dnSpy, it is still very cumbersome to identify important/...
4
votes
1answer
328 views

Compile C# like C++?

After reading the ins and outs of compilation differences between C# and C++ , my question is, cant we compile the C#application (or dll) with Visual Studio (or with other program), so similarly to C++...
4
votes
2answers
6k views

How to edit and modify a class with ILSpy + Reflexil

In the Maxsea.SmartDesktop.dll, I want to edit and modify class b1g. There is this in : if (isCrackedResult != null && isCrackedResult.IsCracked) and I want to modify for this : if (...
4
votes
1answer
2k views

Having keys and binary, how do I reverse/decrypt a stream encryption?

I would like to ask if you have any idea or approach to reverse engineer a decryption algorithm to find the opposite encryption function. I do have all required keys and fields and of course the ...
3
votes
5answers
44k views

Recover source code for C# .exe

I paid a freelancer programmer for an app to tun my clinic. He got about 95% of the project done, but then got a job elsewhere and vanished into thin air, along with my source code... So, I have a ...
3
votes
0answers
28 views

How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?

Preface: This question is about source code reverse engineering and static analysis. Meaning, there is no built code available but I have access to the source code of the program. Imagine I'm looking ...
2
votes
1answer
1k views

IDApro subroutine analysis

I am using IDA to find out parameters of a routine in a DLL. I browsed to the routine in question and saw that IDA has automatically done that job for me and put a comment like this: ; ==============...
2
votes
1answer
156 views

How to start out in reversing?

I'm new in reversing and I'd like a lot to learn about it. I have little to no knowledge about it. Is still worth to learn x86 Assembly? Since almost everything these days work on x64 architecture. ...
2
votes
2answers
244 views

Calculating offset from push instruction in exe to string in data section

So I'm looking for some guidance on this topic. If I open up my exe in a Hexeditor and go to the location where the address of the string is pushed as argument I have the following: 68 7C 9D F1 01 - ...
2
votes
1answer
514 views

How to deobfuscation the public class names .NET

I already try de4dot with all dlls and exe and try remove strong name and don't work. what am I doing wrong?
2
votes
0answers
162 views

Decompress from file with crush32

I have some files *.bli, *.ilg, *.pix, etc. These files are from technical documentation LinkOne, and compressed with old C/Win32 compression library crush32.dll. information can be found here ...
2
votes
0answers
99 views

Patching an app that updates frequently

Hello i am working with an app coded in c# which updates very often usually within 2-3 days or sometimes every 12 hours The updates are really needed for the app to work So i was wondering what can i ...
2
votes
0answers
321 views

COM interface call from managed code

I have managed assembly that calls COM interface methods. I am interested in IManager interface, here is the code from NET Reflector: namespace Lib { [ComImport, CompilerGenerated, CoClass(...
1
vote
1answer
2k views

C# Changing method body in runtime

I am trying to change a part in a third party library, it has a bug, however, there are no fixes and source code is not available as well. At first, I tried to modify IL Opcodes directly by ...
1
vote
2answers
549 views

Identifying cryptography algorithm

I have a decryption algorithm that has been pulled from an x86 binary and converted into C# code. The C# works perfectly to decrypt data, but I'd like to identify the algorithm in use, so I could (...
1
vote
1answer
183 views

Reverse code check

I'm currently only patching this code to return true, do you guys have any idea of how I could start making a generator to make valid codes? I can't understand the logic here. public static bool ...
1
vote
1answer
47k views

Can we decompile an .exe or .dll as %100? [closed]

Can we decompile a .exe or .dll file as 100%? Also sometimes seems some mistakes on somewhere (like mainfrm.cs) , how can we fix that? What is the best .NET decompiler? or What would you prefer? I ...
1
vote
1answer
147 views

Malware checks for hwid

Recently, I received malware executable to analyse - it's written in C#, and it's packed/obfuscated with unknown tool, so I started analysis from analysing it's traffic - what it's sending and ...
1
vote
1answer
515 views

IDA Pro sp-analysis failed

I'm trying to reverse engineer a C# file that requires a password to continue running. When I load it in IDA Pro I get nothing in the functions window and a sp-analysis failed What I see when loaded
1
vote
1answer
326 views

See how classes are used in a Unity 3D game [closed]

I'm trying to understand how the procedural generation in a particular Unity 3D game works. I do not have the source code/project file, just a windows build. I've opened up a dll called Assembly-...
1
vote
1answer
1k views

Convert assembly ADC to C#

I have this dissassembled routine from an executable but I am having troubles to translate it to C#. .text:005C9290 ; =============== S U B R O U T I N E ======================================= .text:...
1
vote
2answers
830 views

Patch a Java class inside a jar using C# [closed]

Being a beginner in C# I wonder if it is possible to patch a .class file inside a .jar? Since jar files tend to act like "zip" files, the approach I think might work is to decompress the jar, patch ...
1
vote
1answer
123 views

How to know where a sequences of bytes are used in a .NET application with Dnspy?

There are a sequence of bytes that i need to find out where are used in dnspy i tried going to hex editor and found the bytes, but right clicking and saying go to code or structure or follow reference ...
1
vote
1answer
76 views

C# - Identical block of code, but IL instructions changed after update. How do I modify the more convoluted update?

Background info - For the game 7 Days To Die, there is a C# wrapper that implements the Harmony API, which allows us to intercept the game's function calls, as well as changing the IL instructions ...
1
vote
1answer
126 views

How to figure out which button I'm pressing

I'm working on an app, that I'm trying to get to work on a android device that has additional buttons. The device is called a BH95, from BATL. It has 4 side buttons(1 volume up, 1 power button, 2 ...
1
vote
2answers
1k views

How to debug a DLL written in .NET/C#?

I want to reverse engineer an application written in C#. I would like to set a breakpoint at a function and observe the input passed to it during the normal course of the application's functioning.
1
vote
1answer
138 views

Is it possible to hijack a C++ DLL after it has been loaded into the memory space? How?

I have a .Net application, in which a C++ DLL is embedded as a resource into the application. When the .Net application is running, I will extract the C++ DLL to a temporary folder, and after that, ...
1
vote
1answer
893 views

Reverse engineering of Managed C++/C# CrackMe

I'm reverse engineering the CrackMe which is written on Managed C++/C#. Arguments are "string" (email in this case) and "serial". Serial is somehow depends on string and I need to understand how. I ...
1
vote
1answer
369 views

Question of analysing function of DLL and write program to call it [closed]

I have a customized DLL in a large software. The DLL compress/decompress image files. I need to use the DLL separately to get my important images back to decompressed version. I can see its function ...
1
vote
0answers
201 views

Deobfuscating Unknown C# obfuscator?

Hello, I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my ...
1
vote
0answers
120 views

Re-engineering to create UML Diagrams from .NET binary assembly

What is the base way to generate UML diagrams (both class and sequence) from .NET assembly using OpenSource tools? The 200% Reflective Class Diagram Creation Tool cannot be used due on problems ...
1
vote
0answers
357 views

C# Hidden Method through transparent proxy object?

I'm dealing with an interesting form of obfuscation. A C# program I am reversing has a central API, let's call it "Central API". This Central API has several functions that aren't exactly defined. ...
1
vote
0answers
63 views

Can I see Stack and Heap value/addresses from this simple C# program process?

I am studying reading dumped memory image and analyzing it with volatility. I wrote this c# program and I was hoping to see the analyzed data from Volatiliy namespace CSharpEx1 { class Program ...
1
vote
0answers
81 views

Am I seeing this dll's innards correctly? [closed]

The dll in question is custom, from a retail/consumer software package that was first offered for sale in 2006/2007. I am fairly confident that it was compiled with Visual Studio .NET (2003). My ...
1
vote
0answers
38 views

Field that is never assigned? [closed]

I am reversing a DLL insied a Unity game with .NET Reflector, and I found some weird fields. They are never assinged, there was no item under the Assigned by while there were some items under the Used ...
1
vote
0answers
637 views

Why does calling the original function from my hook fail?

I am trying to retrieve text from another program. I used Ollydbg to find the address for the function I need to hook to get the info. I used EasyHook to inject the code below. The hook works fine ...
0
votes
2answers
504 views

Can I extract .txt files from .exe if I know their addresses?

I have disassembled the exe in IDA 6.1 and I think I found a hand full of text files and was wondering how to go about dialing into the addresses and extracting the data. Here is what I found I know ...
0
votes
1answer
3k views

Extracting data from Filemaker application

I have an end user version of an application written in FileMaker 10 (FML10.dll) and I need the data behind the software. Anyone knows a way to extract the data? Looks like the USR file containts the ...
0
votes
1answer
217 views

What methods exist for adding new windows form controls into compiled assembly using dnSpy?

I am trying to add another button into windows form using dnSpy. Is it possible to add another? I want the end result be like this one. Any help will be highly appreciated.Thanks
0
votes
1answer
189 views

Help Needed reversing a function inside a DLL [closed]

I have a broken installation of Metalogix Archive Manager (MAM). Sometimes, I need to go and retrieve attachments that this has archived when it was previously working. The original attachment name ...
0
votes
1answer
207 views

Reversing C# exe,Questions.Help

I am trying to debugging c# .NET application which receives a set of doubles and keep it as DataSeries every second. I want to rewrite its dataseries before the new data comes with my own dataset. ...
0
votes
1answer
233 views

Encrypted String? [closed]

(I made a topic but I was ask'd to re-made it) Hi! I have a program and when I want to decompile/dissamble it finish and when I inspect the code everywhere where should be some filenames there are .(...
0
votes
1answer
1k views

Extracting embedded dlls from .NET executable

I have a .NET executable that apparently has some embedded DLLs. It's just one standalone executable. I opened this executable with JetBrains dotPeek and ILSPY, both decomiplier are showing DLL names ...
0
votes
1answer
3k views

Issue decompiling c# method

I'm trying to decompile a c# dll and on a particular method I'm getting this result public IEnumerable<Guid> GetDbIdentifiers(int classId) { switch ((794999935 == 794999935) ? 1 : 0) { ...
0
votes
1answer
945 views

Cannot compile native/unmanaged method

I disassembled a C# program with ildasm and modified the il code to my needs but now when i try to assemble it back into an exe i get these errors: Cannot compile native/unmanaged method Local (...
0
votes
1answer
47 views

Loading a PE32 executable DLL Intel 80386 into a c# program

I'm new here so I'm sorry if this isn't the right section for my question. I'm reverse engineering a software that's written in .net 3.5 c# which loads a weird dynamic dll, which has an important ...