14
votes
Is there any way to decompile a .NET assembly or program?
Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code
https://github.com/0xd4d/dnSpy
Main difference from ...
- 159
13
votes
Accepted
Recovering .NET sources into full blown project
JetBrains dotPeek is a free decompiler that has the option of decompiling whole assemblies into VS projects:
- 390
10
votes
Accepted
How to tell if a particular .NET assembly was written in C# or F#?
Why does decompiling an F# assembly produce C# code?
It doesn't. It produces IL code which then can be interpreted as C#, F# or VB.NET. dotPeek doesn't allow you to use any other language for ...
- 4,512
8
votes
Accepted
Can my C# program be dumped from memory and reversed into source code?
It is in fact trivial to dump the byte array or the module directly from dnSpy.
To mimic the described scenario I wrote some trivial example code:
using System.IO;
using System.Reflection;
...
- 1,602
7
votes
Accepted
dnSpy - What do these symbols mean?
These are Unicode characters that are not supported by the font used by dnSpy.
Usually, you'll see it when the code is obfuscated or in cases where the developer used languages as Chinese and Russian ...
- 8,579
5
votes
Recovering .NET sources into full blown project
Update: dnSpy is now my go to tool for .net decompiling. It's open-source, it exports to Visual Studio projects and the debugger works like a charm.
https://github.com/0xd4d/dnSpy
Original answer: ...
- 2,158
5
votes
Accepted
In-memory patching of .net code
Low-level details and implementation for patching and intercepting .NET code at runtime: http://www.ntcore.com/files/netint_injection.htm
High-level details and implementation for patching and ...
- 20.4k
5
votes
Accepted
Opening mono droid .so files in .NET decompiler
If you're looking at a "normal" mono droid application (compiled with something like Xamarin) then you'll see some of these structures in the APK/ZIP'
/assemblies/Sikur.Monodroid.dll
/assemblies/...
- 338
5
votes
What kind of obfuscate is this?
This is definitely one of the naming schemes from Crypto Obfuscator.
As listed on their features page:
Fake Renaming Scheme
Crypto Obfuscator also has a renaming mode which renames all ...
- 151
5
votes
Decompiling windows photo viewer
The problem you face is quite common. A .NET application still loads many native DLLs. Most surprising for many people is that the .NET framework itself is native.
You can identify .NET DLLs in ...
- 950
5
votes
Decompiling .NET marshaled code
I'm trying to get to the code behind newObject(), which is apparently instantiated from marshaled code. I'm no .Net expert, but from what I read marshaled code is some kind of serialization that can ...
- 390
5
votes
Modify code with ILSpy
For reference to those still looking for an answer to this question, I would recommend trying dnSpy - it allows you to do exactly what the requester asked - modify the high level code and recompile.
...
- 151
5
votes
Modify code with ILSpy
You may work according to the following pattern:
Save code in ILSpy (or in Reflector) as .cs files (as you already described)
Try to create a Visual Studio project from that code
Make all ...
- 1,804
5
votes
Accepted
Do .NET functions have function prologs?
There is no real prolog in IL code because it does not need to manage the stack, save clobbered registers, or do any other standard bookkeeping necessary in the native code.
However, the bytecode ...
- 34.6k
5
votes
Trace Method Calls in .NET/C# Binary
that instrumentation is not easily possible because of JIT compilation of IL instructions.
Well it's actually the opposite. Tracing methods is quite easy - it would be difficult if we would like to ...
- 4,512
4
votes
Accepted
Methods of discovering the location of nag/pop-up screens besides string search?
EDIT: The OP updated his question yesterday to say that he's dealing with a .NET application, so the advice below no longer applies. I'll leave this answer here though since it might help others for ...
- 20.4k
4
votes
Accepted
How to retrieve native asm code from .NET mixed mode dll file?
The Linked Dll's native method is here you can load the dll directly in ollydbg too to find a resolved disassembly of the native method
E:\1dll>ls -l 1.dll
-rwxr-xr-x 1 Admin Administ ...
- 14.8k
4
votes
Accepted
How to disassemble .NET after using Confuser
Try http://de4dot.com its a powerful .net deobfuscator. I've authored a serie of tutorials dubbed "demystifying dot net reverse engineering" google it, its a great point of start if you are new on ....
- 259
4
votes
Is it possible ( or how) to dump source code/machine code from memory?
Just to be clear: You can not reconstruct source code from .net or c++ binaries. You can try to recover it using heuristics, embedded symbols and knowledge about the assembler, but you already lost ...
- 2,806
4
votes
Do .NET functions have function prologs?
I dont think .NET is as simple.. you can clearly see it in IDA Pro - there at least a few different one byte function prologues.
Why not use a decompiler library for dnSpy/de4dot - dnlib to decompile ...
- 586
4
votes
How to disassemble a packed .NET executable?
OK, I think I got it. The tool I needed was MegaDumper. (I couldn't find the executable on its Github, so I had to build it myself.)
Then here's the steps how I used it:
(I'm obviously doing all ...
- 1,275
4
votes
Accepted
Structure of operand bytes in .NET call and data access IL instructions?
the last byte of API/library call instructions is always 0x0A
It's because calls needs to have method (ref) as a parameter and methods are defined in the table that has an id of 0x0A.
Having bytes of ...
- 4,512
3
votes
Techniques for reverse engineering an unknown or protected file format
If you can, you should post links to 2-3 of your real targa images, and the corresponding game targa images (beware of license issues though). Sometimes, looking at the files rings a bell, and i could ...
- 12.6k
3
votes
Accepted
How can I use an x64 debugger to reroute a .NET application's logic?
Modifying a Release-Mode .NET Assembly
Since IL is so simple, one way to achieve the same result without a debugger is to simply decompile the executable using ILDASM on a corresponding .NET release ...
- 144
3
votes
How can I use an x64 debugger to reroute a .NET application's logic?
C# is a bad language to compare source code with assembly, because your source code doesn't get compiled to assembly (*). Instead, the source is translated to some intermediate code; running the ...
- 12.6k
3
votes
Accepted
Reverse Engineering Chinese laser engraver
VB Decompiler is for decompiling native programs and P-code programs.
But as @ebux said, your target appears to be written in .NET, so you'd need to use something like ILSpy or .NET Reflector.
...
- 20.4k
3
votes
Is there any way to decompile a .NET assembly or program?
If you are interested into a decompiler on API level: https://code.google.com/p/facile-api/ (in Java though)
- 131
3
votes
Decompiling windows photo viewer
It's probably a native dll. You can probably decompile the main photo viewer binary (which presumably is managed code, based on your statement) to get some information about the native dll to assist ...
- 1,561
3
votes
Is it possible to debug a .Net executable with IDA?
No. https://www.hex-rays.com/products/ida/debugger/index.shtml
Ask on their support forum if you want.
- 833
3
votes
Edit codes in .Net Reflector with Reflexil (Compile Window)
Decompile a function with .NET Reflector, and in the Instructions tab of the Reflexil window, right click on an instruction and choose Replace all with code...:
https://www.youtube.com/watch?v=...
- 20.4k
Only top scored, non community-wiki answers of a minimum length are eligible