Hot answers tagged

14 votes

Is there any way to decompile a .NET assembly or program?

Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code https://github.com/0xd4d/dnSpy Main difference from ...
Kalibr's user avatar
  • 159
10 votes
Accepted

How to tell if a particular .NET assembly was written in C# or F#?

Why does decompiling an F# assembly produce C# code? It doesn't. It produces IL code which then can be interpreted as C#, F# or VB.NET. dotPeek doesn't allow you to use any other language for ...
Paweł Łukasik's user avatar
8 votes
Accepted

Can my C# program be dumped from memory and reversed into source code?

It is in fact trivial to dump the byte array or the module directly from dnSpy. To mimic the described scenario I wrote some trivial example code: using System.IO; using System.Reflection; ...
mrexodia's user avatar
  • 1,652
7 votes

Modify code with ILSpy

For reference to those still looking for an answer to this question, I would recommend trying dnSpy - it allows you to do exactly what the requester asked - modify the high level code and recompile. ...
Raithlin's user avatar
  • 171
7 votes
Accepted

dnSpy - What do these symbols mean?

These are Unicode characters that are not supported by the font used by dnSpy. Usually, you'll see it when the code is obfuscated or in cases where the developer used languages as Chinese and Russian ...
Megabeets's user avatar
  • 8,919
5 votes
Accepted

Do .NET functions have function prologs?

There is no real prolog in IL code because it does not need to manage the stack, save clobbered registers, or do any other standard bookkeeping necessary in the native code. However, the bytecode ...
Igor Skochinsky's user avatar
  • 36.4k
5 votes
Accepted

In-memory patching of .net code

Low-level details and implementation for patching and intercepting .NET code at runtime: http://www.ntcore.com/files/netint_injection.htm High-level details and implementation for patching and ...
Jason Geffner's user avatar
5 votes
Accepted

Opening mono droid .so files in .NET decompiler

If you're looking at a "normal" mono droid application (compiled with something like Xamarin) then you'll see some of these structures in the APK/ZIP' /assemblies/Sikur.Monodroid.dll /assemblies/...
diff's user avatar
  • 358
5 votes

How to disassemble a packed .NET executable?

OK, I think I got it. The tool I needed was MegaDumper. (I couldn't find the executable on its Github, so I had to build it myself.) Then here's the steps how I used it: (I'm obviously doing all ...
c00000fd's user avatar
  • 1,639
5 votes

Trace Method Calls in .NET/C# Binary

that instrumentation is not easily possible because of JIT compilation of IL instructions. Well it's actually the opposite. Tracing methods is quite easy - it would be difficult if we would like to ...
Paweł Łukasik's user avatar
4 votes

Is it possible ( or how) to dump source code/machine code from memory?

Just to be clear: You can not reconstruct source code from .net or c++ binaries. You can try to recover it using heuristics, embedded symbols and knowledge about the assembler, but you already lost ...
Nordwald's user avatar
  • 2,896
4 votes
Accepted

How to retrieve native asm code from .NET mixed mode dll file?

The Linked Dll's native method is here you can load the dll directly in ollydbg too to find a resolved disassembly of the native method E:\1dll>ls -l 1.dll -rwxr-xr-x 1 Admin Administ ...
blabb's user avatar
  • 16.3k
4 votes
Accepted

How to disassemble .NET after using Confuser

Try http://de4dot.com its a powerful .net deobfuscator. I've authored a serie of tutorials dubbed "demystifying dot net reverse engineering" google it, its a great point of start if you are new on ....
Soufiane Tahiri's user avatar
4 votes

Do .NET functions have function prologs?

I dont think .NET is as simple.. you can clearly see it in IDA Pro - there at least a few different one byte function prologues. Why not use a decompiler library for dnSpy/de4dot - dnlib to decompile ...
Sigtran's user avatar
  • 586
4 votes

android unity intercept w/ Frida

Heh, it's some kind of necroposting, but why not? Well, under hood unity3d use 2 variants: mono, that loads C# dlls and il2cpp, that convert it to C++ before build. For 2nd case u can use ...
Demogor's user avatar
  • 41
4 votes
Accepted

Structure of operand bytes in .NET call and data access IL instructions?

the last byte of API/library call instructions is always 0x0A It's because calls needs to have method (ref) as a parameter and methods are defined in the table that has an id of 0x0A. Having bytes of ...
Paweł Łukasik's user avatar
3 votes

How to deobfuscation the public class names .NET

Converting multiple comments of mine to an answer for future readers: You can't always deobfuscate .NET binaries. If, when the binaries are compiled, the obfuscation implementation modifies the name ...
dsasmblr's user avatar
  • 2,234
3 votes
Accepted

What to do with ILSpy error "This file does not contain a managed assembly"?

This looks like a Win32 executable, .NET executables typically imports _CorExeMain from mscoree.dll. You can use an identification tool like PEiD or Detect It Easy to confirm it.
ekse's user avatar
  • 2,208
3 votes

Is there any way to decompile a .NET assembly or program?

If you are interested into a decompiler on API level: https://code.google.com/p/facile-api/ (in Java though)
TomSmartBishop's user avatar
3 votes

Edit codes in .Net Reflector with Reflexil (Compile Window)

This blog that I wrote a a few years ago describes all the steps to modify a .net binary with Reflector and Reflexil. Not sure which steps you're missing but I recommended to read&compare. ...
Remko's user avatar
  • 3,208
3 votes

Edit codes in .Net Reflector with Reflexil (Compile Window)

Decompile a function with .NET Reflector, and in the Instructions tab of the Reflexil window, right click on an instruction and choose Replace all with code...: https://www.youtube.com/watch?v=...
Jason Geffner's user avatar
3 votes
Accepted

Reverse Engineering Chinese laser engraver

VB Decompiler is for decompiling native programs and P-code programs. But as @ebux said, your target appears to be written in .NET, so you'd need to use something like ILSpy or .NET Reflector. ...
Jason Geffner's user avatar
3 votes

How to retrieve native asm code from .NET mixed mode dll file?

You need to select Portable executable for 80386 (PE) from the list of loaders in IDA instead of confirming the default (Microsoft.NET assembly).
Igor Skochinsky's user avatar
  • 36.4k
3 votes

Is it possible to debug a .Net executable with IDA?

No. https://www.hex-rays.com/products/ida/debugger/index.shtml Ask on their support forum if you want.
Vitaly Osipov's user avatar
3 votes

How to debug a DLL written in .NET/C#?

I've used dnSpy in production for debugging as it can be put on a USB. It's perfectly capable of decompiling and debugging dll's. It has a pretty rich set of features. It's able to attach to ...
Jonathan Van Dam's user avatar
3 votes

Trace Method Calls in .NET/C# Binary

You can use de4dot (https://github.com/0xd4d/de4dot) to deobfuscate the binary. Static analysis of dotnet binaries can be done easily by using de4dot and then using ILSpy to create a visual studio ...
oridamari's user avatar
3 votes
Accepted

ildasm on Linux: "original" ildasm.exe same as dotnet-ildasm?

The original one was a native executable and this one is build in .NET by utilizing a Mono.Cecil library to get the assembly information so if I would have to answer your first question I would answer ...
Paweł Łukasik's user avatar
3 votes
Accepted

dnSpy: how to start 32 bit version

By default choco doesn't want to install 32bit if you are on 64bit system. But, with a little bit of effort, I found that to install 32bit you will need to add either add: --x86 or --forcex86 to force ...
BadSugar's user avatar
  • 110
3 votes

.NET: How to debug or decompile a DanamicMethod with dnSpy?

You can debug DynamicMethod's using the EventPipe API. I've written a library that uses it to allow for code injection via DynamicMethod that can be debugged: https://github.com/damieng/DamienG....
user42194's user avatar
3 votes

How to use dnSpyEx or some other .NET debugger to attach to a .NET process started with a process-hollowing technique?

You can insert an infinite loop in the code that you can find once you attach to the process. Right click the method you want to put a breakpoint on and select Edit Method. Add an infinite loop ...
Ana María Martínez Gómez's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible