Hot answers tagged

14 votes

Is there any way to decompile a .NET assembly or program?

Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code https://github.com/0xd4d/dnSpy Main difference from ...
  • 159
13 votes
Accepted

Recovering .NET sources into full blown project

JetBrains dotPeek is a free decompiler that has the option of decompiling whole assemblies into VS projects:
  • 400
10 votes
Accepted

How to tell if a particular .NET assembly was written in C# or F#?

Why does decompiling an F# assembly produce C# code? It doesn't. It produces IL code which then can be interpreted as C#, F# or VB.NET. dotPeek doesn't allow you to use any other language for ...
8 votes
Accepted

Can my C# program be dumped from memory and reversed into source code?

It is in fact trivial to dump the byte array or the module directly from dnSpy. To mimic the described scenario I wrote some trivial example code: using System.IO; using System.Reflection; ...
  • 1,602
7 votes

Modify code with ILSpy

For reference to those still looking for an answer to this question, I would recommend trying dnSpy - it allows you to do exactly what the requester asked - modify the high level code and recompile. ...
  • 171
7 votes
Accepted

dnSpy - What do these symbols mean?

These are Unicode characters that are not supported by the font used by dnSpy. Usually, you'll see it when the code is obfuscated or in cases where the developer used languages as Chinese and Russian ...
  • 8,689
5 votes
Accepted

In-memory patching of .net code

Low-level details and implementation for patching and intercepting .NET code at runtime: http://www.ntcore.com/files/netint_injection.htm High-level details and implementation for patching and ...
5 votes
Accepted

Opening mono droid .so files in .NET decompiler

If you're looking at a "normal" mono droid application (compiled with something like Xamarin) then you'll see some of these structures in the APK/ZIP' /assemblies/Sikur.Monodroid.dll /assemblies/...
  • 348
5 votes

Recovering .NET sources into full blown project

Update: dnSpy is now my go to tool for .net decompiling. It's open-source, it exports to Visual Studio projects and the debugger works like a charm. https://github.com/0xd4d/dnSpy Original answer: ...
  • 2,168
5 votes

What kind of obfuscate is this?

This is definitely one of the naming schemes from Crypto Obfuscator. As listed on their features page: Fake Renaming Scheme Crypto Obfuscator also has a renaming mode which renames all ...
  • 151
5 votes

Decompiling .NET marshaled code

I'm trying to get to the code behind newObject(), which is apparently instantiated from marshaled code. I'm no .Net expert, but from what I read marshaled code is some kind of serialization that can ...
  • 400
5 votes

Modify code with ILSpy

You may work according to the following pattern: Save code in ILSpy (or in Reflector) as .cs files (as you already described) Try to create a Visual Studio project from that code Make all ...
  • 1,814
5 votes
Accepted

Do .NET functions have function prologs?

There is no real prolog in IL code because it does not need to manage the stack, save clobbered registers, or do any other standard bookkeeping necessary in the native code. However, the bytecode ...
  • 35.1k
5 votes

Trace Method Calls in .NET/C# Binary

that instrumentation is not easily possible because of JIT compilation of IL instructions. Well it's actually the opposite. Tracing methods is quite easy - it would be difficult if we would like to ...
4 votes
Accepted

Methods of discovering the location of nag/pop-up screens besides string search?

EDIT: The OP updated his question yesterday to say that he's dealing with a .NET application, so the advice below no longer applies. I'll leave this answer here though since it might help others for ...
4 votes
Accepted

How to retrieve native asm code from .NET mixed mode dll file?

The Linked Dll's native method is here you can load the dll directly in ollydbg too to find a resolved disassembly of the native method E:\1dll>ls -l 1.dll -rwxr-xr-x 1 Admin Administ ...
  • 15.1k
4 votes
Accepted

How to disassemble .NET after using Confuser

Try http://de4dot.com its a powerful .net deobfuscator. I've authored a serie of tutorials dubbed "demystifying dot net reverse engineering" google it, its a great point of start if you are new on ....
4 votes

Is it possible ( or how) to dump source code/machine code from memory?

Just to be clear: You can not reconstruct source code from .net or c++ binaries. You can try to recover it using heuristics, embedded symbols and knowledge about the assembler, but you already lost ...
  • 2,836
4 votes

Do .NET functions have function prologs?

I dont think .NET is as simple.. you can clearly see it in IDA Pro - there at least a few different one byte function prologues. Why not use a decompiler library for dnSpy/de4dot - dnlib to decompile ...
  • 586
4 votes

android unity intercept w/ Frida

Heh, it's some kind of necroposting, but why not? Well, under hood unity3d use 2 variants: mono, that loads C# dlls and il2cpp, that convert it to C++ before build. For 2nd case u can use ...
  • 41
4 votes

How to disassemble a packed .NET executable?

OK, I think I got it. The tool I needed was MegaDumper. (I couldn't find the executable on its Github, so I had to build it myself.) Then here's the steps how I used it: (I'm obviously doing all ...
  • 1,335
4 votes
Accepted

Structure of operand bytes in .NET call and data access IL instructions?

the last byte of API/library call instructions is always 0x0A It's because calls needs to have method (ref) as a parameter and methods are defined in the table that has an id of 0x0A. Having bytes of ...
3 votes

Edit codes in .Net Reflector with Reflexil (Compile Window)

Decompile a function with .NET Reflector, and in the Instructions tab of the Reflexil window, right click on an instruction and choose Replace all with code...: https://www.youtube.com/watch?v=...
3 votes
Accepted

Reverse Engineering Chinese laser engraver

VB Decompiler is for decompiling native programs and P-code programs. But as @ebux said, your target appears to be written in .NET, so you'd need to use something like ILSpy or .NET Reflector. ...
3 votes

How to retrieve native asm code from .NET mixed mode dll file?

You need to select Portable executable for 80386 (PE) from the list of loaders in IDA instead of confirming the default (Microsoft.NET assembly).
  • 35.1k
3 votes

Is it possible to debug a .Net executable with IDA?

No. https://www.hex-rays.com/products/ida/debugger/index.shtml Ask on their support forum if you want.
3 votes

Techniques for reverse engineering an unknown or protected file format

If you can, you should post links to 2-3 of your real targa images, and the corresponding game targa images (beware of license issues though). Sometimes, looking at the files rings a bell, and i could ...
3 votes
Accepted

How can I use an x64 debugger to reroute a .NET application's logic?

Modifying a Release-Mode .NET Assembly Since IL is so simple, one way to achieve the same result without a debugger is to simply decompile the executable using ILDASM on a corresponding .NET release ...
  • 144
3 votes

How can I use an x64 debugger to reroute a .NET application's logic?

C# is a bad language to compare source code with assembly, because your source code doesn't get compiled to assembly (*). Instead, the source is translated to some intermediate code; running the ...
3 votes

Is there any way to decompile a .NET assembly or program?

If you are interested into a decompiler on API level: https://code.google.com/p/facile-api/ (in Java though)

Only top scored, non community-wiki answers of a minimum length are eligible