Questions tagged [dnspy]
The dnspy tag has no usage guidance.
21
questions
0
votes
0
answers
7
views
Disable follow on click in dnSpy decompilation view
In the C# decompilation in dnSpy, single clicking on a class or method name takes you to the definition of it. This is handy, but I don't want it to happen every time I click almost anywhere. ...
2
votes
0
answers
122
views
What could be the reason-s for a exe not to load after a Dnspy modification to a DLL
After modifying a method of a DLL with Dnspy, the related EXE won't start.
What could be the reason for it not starting?
Here's what I did:
I modified a method from a DLL with Dnspy using edit Method ...
- 121
1
vote
1
answer
140
views
dnSpy not showing locals after hitting breakpoint
I'm trying to debug .NET app DLL. I'm attaching to the process, open DLL module from memory and I'm setting the breakpoint inside of DLL. After hitiing the breakpoint dnSpy didn't show Locals and I ...
- 11
4
votes
0
answers
66
views
How can I generated the function call graph (with API calls) of a .NET executable?
For native executables, I can use IDA to generate the function call graph (FCG) of that executable (which includes API calls as well, for example function sub_xxx has an arrow to CreateFile which ...
- 519
2
votes
1
answer
154
views
Deobfuscating IOS dll file (I think arm64)
I am just starting out my journey with modding IAP files. I use dnSPY to find the offsets of the methods I want to change and then use an arm64 to hex converter to then apply these changes.
I have ...
5
votes
1
answer
336
views
How to use dnSpyEx or some other .NET debugger to attach to a .NET process started with a process-hollowing technique?
I have a .NET executable that is started using the process-hollowing technique. Here's how it looks from the Detect-It-Easy tool:
I can open the image file for that process (from disk) with dnSpyEx, ...
- 1,517
2
votes
0
answers
252
views
Dumping .NET Dynamic Methods
I have a .NET exe that creates DynamicMethods whose bodies are built from a byte array and later called. I'm able to access the array, and even to disassemble it "raw" starting from the ...
- 21
1
vote
1
answer
590
views
.NET: How to debug or decompile a DanamicMethod with dnSpy?
I have a managed .NET executable that supplies the msil bytecode of a function as raw bytes. It constructs a DynamicMethod object, sets the bytecode with DynamicMethod.DynamicILInfo.SetCode() and ...
- 453
1
vote
1
answer
242
views
Assign a constant value to an ARM register
I was reversing an libil2cpp.so and decompiled it using ghidra and as of now my assembly language knowledge is very limited and studied it long time btw I had an assembly code like this:
...
- 299
1
vote
0
answers
117
views
How to debug C++ module/function call used in .net application?
I'm currently debugging a .net application by using dnSpy. There is a function where I have call like this
<Module>.X.Y.Z.Initialize(ptr, ptr2, flag);
The function belongs to a DLL and ...
1
vote
0
answers
70
views
Retrieve all parameters of specific function: How to automate
I'm trying to reverse engineer.NET binary with dnspy. I have a decryption routine that is used to display useful strings. It takes one integer value as a parameter and uses it in the decryption ...
- 163
1
vote
0
answers
117
views
Custom Chromium build - find registered extension's JS code
I have a custom chromium browser build which has a bunch of "native" functions which I would like to have definitions for.
Apparently, these are registered as en extension using this ...
- 11
1
vote
1
answer
665
views
How to step into an invoked method from a DotNet DLL in dnSpy?
I've been analyzing a malware written in C# using dnSpy. It loaded a dotnet assembly DLL from its Resources:
I tried stepping into InvokeMember function, but could not go further when hitting this ...
- 11
1
vote
1
answer
1k
views
How to debug a .net DLL?
I'm trying to reverse engineer a .net malicious EXE but it loads a DLL inside its memory. I have tried to debug this DLL using a tool called SharpDllLoader and dnspy but I have 2 issues:
First one:
(...
- 55
0
votes
1
answer
446
views
dnSpy works really slow. How can I fix it?
I've been doing some stuff with a pre-compiled .NET executable. It is my first time reversing something, so I don't know much.
I got a bunch of programs like ILSpy, dnSpy and dotPeek. They all do as ...
- 1
3
votes
2
answers
785
views
Is there a way to decompress a Fody-Costura generated exe in c#?
There is a program that is possibly a RAT, and I would like to view the source code.
After opening the .exe in dnSpy, I was able to tell that it was compressed with Fody-Costura. (https://github.com/...
- 35
1
vote
0
answers
88
views
Can i follow the invoke function?
im trying to debug some C# app.
Flow: main -> load dll into mem -> main invoke some function (i want to be here after invoke called).
Im using dnspy.
- 67
1
vote
0
answers
508
views
How to patch C# binary?
I have C# binary. I was able to use dnSpy to decompile it, and analyze. The binary was obfuscated with xenocode obfuscator.
I figured out that I can directly manipulate IL instructions if I just find ...
- 111
0
votes
1
answer
2k
views
dnSpy: how to start 32 bit version
I am very unsure if this is the right place to as or if I need to ask this at another forum, but here it goes.
I am trying to reverse engineer a .NET program with the use of dnspy. I installed dnspy ...
- 33
1
vote
1
answer
2k
views
How to know where a sequences of bytes are used in a .NET application with Dnspy?
There are a sequence of bytes that i need to find out where are used in dnspy
i tried going to hex editor and found the bytes, but right clicking and saying go to code or structure or follow reference ...
- 232
3
votes
2
answers
3k
views
Is there a tool to reverse engineer UWP apps, similar to dnSpy for .NET?
I've been long fascinated with dnSpy and how easily it can reverse engineer .NET apps into a readable C#. So I was wondering if there's a similar tool to RE Windows 10 UWP apps?
For instance, I tried ...
- 1,517