Hot answers tagged

14 votes

Is there any way to decompile a .NET assembly or program?

Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code https://github.com/0xd4d/dnSpy Main difference from ...
user avatar
  • 159
13 votes
Accepted

Recovering .NET sources into full blown project

JetBrains dotPeek is a free decompiler that has the option of decompiling whole assemblies into VS projects:
user avatar
  • 390
10 votes
Accepted

How to tell if a particular .NET assembly was written in C# or F#?

Why does decompiling an F# assembly produce C# code? It doesn't. It produces IL code which then can be interpreted as C#, F# or VB.NET. dotPeek doesn't allow you to use any other language for ...
user avatar
8 votes
Accepted

Can my C# program be dumped from memory and reversed into source code?

It is in fact trivial to dump the byte array or the module directly from dnSpy. To mimic the described scenario I wrote some trivial example code: using System.IO; using System.Reflection; ...
user avatar
  • 1,602
7 votes
Accepted

dnSpy - What do these symbols mean?

These are Unicode characters that are not supported by the font used by dnSpy. Usually, you'll see it when the code is obfuscated or in cases where the developer used languages as Chinese and Russian ...
user avatar
  • 8,579
5 votes

Recovering .NET sources into full blown project

Update: dnSpy is now my go to tool for .net decompiling. It's open-source, it exports to Visual Studio projects and the debugger works like a charm. https://github.com/0xd4d/dnSpy Original answer: ...
user avatar
  • 2,158
5 votes
Accepted

In-memory patching of .net code

Low-level details and implementation for patching and intercepting .NET code at runtime: http://www.ntcore.com/files/netint_injection.htm High-level details and implementation for patching and ...
user avatar
5 votes
Accepted

Opening mono droid .so files in .NET decompiler

If you're looking at a "normal" mono droid application (compiled with something like Xamarin) then you'll see some of these structures in the APK/ZIP' /assemblies/Sikur.Monodroid.dll /assemblies/...
user avatar
  • 338
5 votes

What kind of obfuscate is this?

This is definitely one of the naming schemes from Crypto Obfuscator. As listed on their features page: Fake Renaming Scheme Crypto Obfuscator also has a renaming mode which renames all ...
user avatar
  • 151
5 votes

Decompiling windows photo viewer

The problem you face is quite common. A .NET application still loads many native DLLs. Most surprising for many people is that the .NET framework itself is native. You can identify .NET DLLs in ...
user avatar
5 votes

Decompiling .NET marshaled code

I'm trying to get to the code behind newObject(), which is apparently instantiated from marshaled code. I'm no .Net expert, but from what I read marshaled code is some kind of serialization that can ...
user avatar
  • 390
5 votes

Modify code with ILSpy

For reference to those still looking for an answer to this question, I would recommend trying dnSpy - it allows you to do exactly what the requester asked - modify the high level code and recompile. ...
user avatar
  • 151
5 votes

Modify code with ILSpy

You may work according to the following pattern: Save code in ILSpy (or in Reflector) as .cs files (as you already described) Try to create a Visual Studio project from that code Make all ...
user avatar
  • 1,804
5 votes
Accepted

Do .NET functions have function prologs?

There is no real prolog in IL code because it does not need to manage the stack, save clobbered registers, or do any other standard bookkeeping necessary in the native code. However, the bytecode ...
user avatar
  • 34.6k
5 votes

Trace Method Calls in .NET/C# Binary

that instrumentation is not easily possible because of JIT compilation of IL instructions. Well it's actually the opposite. Tracing methods is quite easy - it would be difficult if we would like to ...
user avatar
4 votes
Accepted

Methods of discovering the location of nag/pop-up screens besides string search?

EDIT: The OP updated his question yesterday to say that he's dealing with a .NET application, so the advice below no longer applies. I'll leave this answer here though since it might help others for ...
user avatar
4 votes
Accepted

How to retrieve native asm code from .NET mixed mode dll file?

The Linked Dll's native method is here you can load the dll directly in ollydbg too to find a resolved disassembly of the native method E:\1dll>ls -l 1.dll -rwxr-xr-x 1 Admin Administ ...
user avatar
  • 14.8k
4 votes
Accepted

How to disassemble .NET after using Confuser

Try http://de4dot.com its a powerful .net deobfuscator. I've authored a serie of tutorials dubbed "demystifying dot net reverse engineering" google it, its a great point of start if you are new on ....
user avatar
4 votes

Is it possible ( or how) to dump source code/machine code from memory?

Just to be clear: You can not reconstruct source code from .net or c++ binaries. You can try to recover it using heuristics, embedded symbols and knowledge about the assembler, but you already lost ...
user avatar
  • 2,806
4 votes

Do .NET functions have function prologs?

I dont think .NET is as simple.. you can clearly see it in IDA Pro - there at least a few different one byte function prologues. Why not use a decompiler library for dnSpy/de4dot - dnlib to decompile ...
user avatar
  • 586
4 votes

How to disassemble a packed .NET executable?

OK, I think I got it. The tool I needed was MegaDumper. (I couldn't find the executable on its Github, so I had to build it myself.) Then here's the steps how I used it: (I'm obviously doing all ...
user avatar
  • 1,275
4 votes
Accepted

Structure of operand bytes in .NET call and data access IL instructions?

the last byte of API/library call instructions is always 0x0A It's because calls needs to have method (ref) as a parameter and methods are defined in the table that has an id of 0x0A. Having bytes of ...
user avatar
3 votes

Techniques for reverse engineering an unknown or protected file format

If you can, you should post links to 2-3 of your real targa images, and the corresponding game targa images (beware of license issues though). Sometimes, looking at the files rings a bell, and i could ...
user avatar
3 votes
Accepted

How can I use an x64 debugger to reroute a .NET application's logic?

Modifying a Release-Mode .NET Assembly Since IL is so simple, one way to achieve the same result without a debugger is to simply decompile the executable using ILDASM on a corresponding .NET release ...
user avatar
  • 144
3 votes

How can I use an x64 debugger to reroute a .NET application's logic?

C# is a bad language to compare source code with assembly, because your source code doesn't get compiled to assembly (*). Instead, the source is translated to some intermediate code; running the ...
user avatar
3 votes
Accepted

Reverse Engineering Chinese laser engraver

VB Decompiler is for decompiling native programs and P-code programs. But as @ebux said, your target appears to be written in .NET, so you'd need to use something like ILSpy or .NET Reflector. ...
user avatar
3 votes

Is there any way to decompile a .NET assembly or program?

If you are interested into a decompiler on API level: https://code.google.com/p/facile-api/ (in Java though)
user avatar
3 votes

Decompiling windows photo viewer

It's probably a native dll. You can probably decompile the main photo viewer binary (which presumably is managed code, based on your statement) to get some information about the native dll to assist ...
user avatar
  • 1,561
3 votes

Is it possible to debug a .Net executable with IDA?

No. https://www.hex-rays.com/products/ida/debugger/index.shtml Ask on their support forum if you want.
user avatar
3 votes

Edit codes in .Net Reflector with Reflexil (Compile Window)

Decompile a function with .NET Reflector, and in the Instructions tab of the Reflexil window, right click on an instruction and choose Replace all with code...: https://www.youtube.com/watch?v=...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible