Skip to main content

Questions tagged [dnspy]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
25 views

Modifying a Bundled .NET 7 Application

I am attempting to reverse a .NET 7 program and patch it, but it is a bundled file. When importing the EXE into dnSpy I get the headings of a PE file (.text, etc.) and nothing else. However, if I ...
YeAight's user avatar
0 votes
0 answers
62 views

Disable follow on click in dnSpy decompilation view

In the C# decompilation in dnSpy, single clicking on a class or method name takes you to the definition of it. This is handy, but I don't want it to happen every time I click almost anywhere. ...
thejoelpatrol's user avatar
2 votes
0 answers
326 views

What could be the reason-s for a exe not to load after a Dnspy modification to a DLL

After modifying a method of a DLL with Dnspy, the related EXE won't start. What could be the reason for it not starting? Here's what I did: I modified a method from a DLL with Dnspy using edit Method ...
Lod's user avatar
  • 121
1 vote
1 answer
425 views

dnSpy not showing locals after hitting breakpoint

I'm trying to debug .NET app DLL. I'm attaching to the process, open DLL module from memory and I'm setting the breakpoint inside of DLL. After hitiing the breakpoint dnSpy didn't show Locals and I ...
unknown's user avatar
  • 11
4 votes
0 answers
159 views

How can I generated the function call graph (with API calls) of a .NET executable?

For native executables, I can use IDA to generate the function call graph (FCG) of that executable (which includes API calls as well, for example function sub_xxx has an arrow to CreateFile which ...
OneAndOnly's user avatar
2 votes
1 answer
351 views

Deobfuscating IOS dll file (I think arm64)

I am just starting out my journey with modding IAP files. I use dnSPY to find the offsets of the methods I want to change and then use an arm64 to hex converter to then apply these changes. I have ...
NOT Mike Oxmall epic duel's user avatar
5 votes
1 answer
736 views

How to use dnSpyEx or some other .NET debugger to attach to a .NET process started with a process-hollowing technique?

I have a .NET executable that is started using the process-hollowing technique. Here's how it looks from the Detect-It-Easy tool: I can open the image file for that process (from disk) with dnSpyEx, ...
c00000fd's user avatar
  • 1,711
2 votes
0 answers
303 views

Dumping .NET Dynamic Methods

I have a .NET exe that creates DynamicMethods whose bodies are built from a byte array and later called. I'm able to access the array, and even to disassemble it "raw" starting from the ...
Net_Newb's user avatar
1 vote
1 answer
695 views

.NET: How to debug or decompile a DanamicMethod with dnSpy?

I have a managed .NET executable that supplies the msil bytecode of a function as raw bytes. It constructs a DynamicMethod object, sets the bytecode with DynamicMethod.DynamicILInfo.SetCode() and ...
bernd feinman's user avatar
1 vote
1 answer
347 views

Assign a constant value to an ARM register

I was reversing an libil2cpp.so and decompiled it using ghidra and as of now my assembly language knowledge is very limited and studied it long time btw I had an assembly code like this: ...
hanan's user avatar
  • 309
1 vote
0 answers
160 views

How to debug C++ module/function call used in .net application?

I'm currently debugging a .net application by using dnSpy. There is a function where I have call like this <Module>.X.Y.Z.Initialize(ptr, ptr2, flag); The function belongs to a DLL and ...
programmerskitchen's user avatar
1 vote
0 answers
100 views

Retrieve all parameters of specific function: How to automate

I'm trying to reverse engineer.NET binary with dnspy. I have a decryption routine that is used to display useful strings. It takes one integer value as a parameter and uses it in the decryption ...
Raafat's user avatar
  • 163
1 vote
0 answers
120 views

Custom Chromium build - find registered extension's JS code

I have a custom chromium browser build which has a bunch of "native" functions which I would like to have definitions for. Apparently, these are registered as en extension using this ...
Seminko's user avatar
  • 11
1 vote
1 answer
1k views

How to step into an invoked method from a DotNet DLL in dnSpy?

I've been analyzing a malware written in C# using dnSpy. It loaded a dotnet assembly DLL from its Resources: I tried stepping into InvokeMember function, but could not go further when hitting this ...
gergeerew's user avatar
1 vote
1 answer
2k views

How to debug a .net DLL?

I'm trying to reverse engineer a .net malicious EXE but it loads a DLL inside its memory. I have tried to debug this DLL using a tool called SharpDllLoader and dnspy but I have 2 issues: First one: (...
ManJaro's user avatar
  • 55
0 votes
1 answer
572 views

dnSpy works really slow. How can I fix it?

I've been doing some stuff with a pre-compiled .NET executable. It is my first time reversing something, so I don't know much. I got a bunch of programs like ILSpy, dnSpy and dotPeek. They all do as ...
ymdred16's user avatar
3 votes
2 answers
1k views

Is there a way to decompress a Fody-Costura generated exe in c#?

There is a program that is possibly a RAT, and I would like to view the source code. After opening the .exe in dnSpy, I was able to tell that it was compressed with Fody-Costura. (https://github.com/...
Nqndi's user avatar
  • 35
1 vote
0 answers
102 views

Can i follow the invoke function?

im trying to debug some C# app. Flow: main -> load dll into mem -> main invoke some function (i want to be here after invoke called). Im using dnspy.
Brian MJ's user avatar
1 vote
0 answers
637 views

How to patch C# binary?

I have C# binary. I was able to use dnSpy to decompile it, and analyze. The binary was obfuscated with xenocode obfuscator. I figured out that I can directly manipulate IL instructions if I just find ...
warchantua's user avatar
0 votes
1 answer
3k views

dnSpy: how to start 32 bit version

I am very unsure if this is the right place to as or if I need to ask this at another forum, but here it goes. I am trying to reverse engineer a .NET program with the use of dnspy. I installed dnspy ...
Mr Krisey's user avatar
1 vote
1 answer
2k views

How to know where a sequences of bytes are used in a .NET application with Dnspy?

There are a sequence of bytes that i need to find out where are used in dnspy i tried going to hex editor and found the bytes, but right clicking and saying go to code or structure or follow reference ...
Mery Ted's user avatar
  • 232
4 votes
2 answers
4k views

Is there a tool to reverse engineer UWP apps, similar to dnSpy for .NET?

I've been long fascinated with dnSpy and how easily it can reverse engineer .NET apps into a readable C#. So I was wondering if there's a similar tool to RE Windows 10 UWP apps? For instance, I tried ...
c00000fd's user avatar
  • 1,711