14
votes
Is there any way to decompile a .NET assembly or program?
Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code
https://github.com/0xd4d/dnSpy
Main difference from ...
- 159
10
votes
Accepted
How to tell if a particular .NET assembly was written in C# or F#?
Why does decompiling an F# assembly produce C# code?
It doesn't. It produces IL code which then can be interpreted as C#, F# or VB.NET. dotPeek doesn't allow you to use any other language for ...
- 4,912
8
votes
Accepted
Can my C# program be dumped from memory and reversed into source code?
It is in fact trivial to dump the byte array or the module directly from dnSpy.
To mimic the described scenario I wrote some trivial example code:
using System.IO;
using System.Reflection;
...
- 1,652
7
votes
Modify code with ILSpy
For reference to those still looking for an answer to this question, I would recommend trying dnSpy - it allows you to do exactly what the requester asked - modify the high level code and recompile.
...
- 171
7
votes
Accepted
dnSpy - What do these symbols mean?
These are Unicode characters that are not supported by the font used by dnSpy.
Usually, you'll see it when the code is obfuscated or in cases where the developer used languages as Chinese and Russian ...
- 8,919
5
votes
Accepted
Do .NET functions have function prologs?
There is no real prolog in IL code because it does not need to manage the stack, save clobbered registers, or do any other standard bookkeeping necessary in the native code.
However, the bytecode ...
- 36.4k
5
votes
Accepted
In-memory patching of .net code
Low-level details and implementation for patching and intercepting .NET code at runtime: http://www.ntcore.com/files/netint_injection.htm
High-level details and implementation for patching and ...
- 20.7k
5
votes
Accepted
Opening mono droid .so files in .NET decompiler
If you're looking at a "normal" mono droid application (compiled with something like Xamarin) then you'll see some of these structures in the APK/ZIP'
/assemblies/Sikur.Monodroid.dll
/assemblies/...
- 358
5
votes
How to disassemble a packed .NET executable?
OK, I think I got it. The tool I needed was MegaDumper. (I couldn't find the executable on its Github, so I had to build it myself.)
Then here's the steps how I used it:
(I'm obviously doing all ...
- 1,639
5
votes
Trace Method Calls in .NET/C# Binary
that instrumentation is not easily possible because of JIT compilation of IL instructions.
Well it's actually the opposite. Tracing methods is quite easy - it would be difficult if we would like to ...
- 4,912
4
votes
Is it possible ( or how) to dump source code/machine code from memory?
Just to be clear: You can not reconstruct source code from .net or c++ binaries. You can try to recover it using heuristics, embedded symbols and knowledge about the assembler, but you already lost ...
- 2,896
4
votes
Accepted
How to retrieve native asm code from .NET mixed mode dll file?
The Linked Dll's native method is here you can load the dll directly in ollydbg too to find a resolved disassembly of the native method
E:\1dll>ls -l 1.dll
-rwxr-xr-x 1 Admin Administ ...
- 16.3k
4
votes
Accepted
How to disassemble .NET after using Confuser
Try http://de4dot.com its a powerful .net deobfuscator. I've authored a serie of tutorials dubbed "demystifying dot net reverse engineering" google it, its a great point of start if you are new on ....
- 259
4
votes
Do .NET functions have function prologs?
I dont think .NET is as simple.. you can clearly see it in IDA Pro - there at least a few different one byte function prologues.
Why not use a decompiler library for dnSpy/de4dot - dnlib to decompile ...
- 586
4
votes
android unity intercept w/ Frida
Heh, it's some kind of necroposting, but why not?
Well, under hood unity3d use 2 variants: mono, that loads C# dlls and il2cpp, that convert it to C++ before build.
For 2nd case u can use ...
- 41
4
votes
Accepted
Structure of operand bytes in .NET call and data access IL instructions?
the last byte of API/library call instructions is always 0x0A
It's because calls needs to have method (ref) as a parameter and methods are defined in the table that has an id of 0x0A.
Having bytes of ...
- 4,912
3
votes
How to deobfuscation the public class names .NET
Converting multiple comments of mine to an answer for future readers:
You can't always deobfuscate .NET binaries. If, when the binaries are compiled, the obfuscation implementation modifies the name ...
- 2,234
3
votes
Accepted
What to do with ILSpy error "This file does not contain a managed assembly"?
This looks like a Win32 executable, .NET executables typically imports _CorExeMain from mscoree.dll. You can use an identification tool like PEiD or Detect It Easy to confirm it.
- 2,208
3
votes
Is there any way to decompile a .NET assembly or program?
If you are interested into a decompiler on API level: https://code.google.com/p/facile-api/ (in Java though)
- 131
3
votes
Edit codes in .Net Reflector with Reflexil (Compile Window)
This blog that I wrote a a few years ago describes all the steps to modify a .net binary with Reflector and Reflexil. Not sure which steps you're missing but I recommended to read&compare.
...
- 3,208
3
votes
Edit codes in .Net Reflector with Reflexil (Compile Window)
Decompile a function with .NET Reflector, and in the Instructions tab of the Reflexil window, right click on an instruction and choose Replace all with code...:
https://www.youtube.com/watch?v=...
- 20.7k
3
votes
Accepted
Reverse Engineering Chinese laser engraver
VB Decompiler is for decompiling native programs and P-code programs.
But as @ebux said, your target appears to be written in .NET, so you'd need to use something like ILSpy or .NET Reflector.
...
- 20.7k
3
votes
How to retrieve native asm code from .NET mixed mode dll file?
You need to select Portable executable for 80386 (PE) from the list of loaders in IDA instead of confirming the default (Microsoft.NET assembly).
- 36.4k
3
votes
Is it possible to debug a .Net executable with IDA?
No. https://www.hex-rays.com/products/ida/debugger/index.shtml
Ask on their support forum if you want.
- 843
3
votes
How to debug a DLL written in .NET/C#?
I've used dnSpy in production for debugging as it can be put on a USB. It's perfectly capable of decompiling and debugging dll's.
It has a pretty rich set of features. It's able to attach to ...
- 131
3
votes
Trace Method Calls in .NET/C# Binary
You can use de4dot (https://github.com/0xd4d/de4dot) to deobfuscate the binary. Static analysis of dotnet binaries can be done easily by using de4dot and then using ILSpy to create a visual studio ...
- 31
3
votes
Accepted
ildasm on Linux: "original" ildasm.exe same as dotnet-ildasm?
The original one was a native executable and this one is build in .NET by utilizing a Mono.Cecil library to get the assembly information so if I would have to answer your first question I would answer ...
- 4,912
3
votes
Accepted
dnSpy: how to start 32 bit version
By default choco doesn't want to install 32bit if you are on 64bit system. But, with a little bit of effort, I found that to install 32bit you will need to add either add: --x86 or --forcex86 to force ...
- 110
3
votes
.NET: How to debug or decompile a DanamicMethod with dnSpy?
You can debug DynamicMethod's using the EventPipe API. I've written a library that uses it to allow for code injection via DynamicMethod that can be debugged: https://github.com/damieng/DamienG....
- 74
3
votes
How to use dnSpyEx or some other .NET debugger to attach to a .NET process started with a process-hollowing technique?
You can insert an infinite loop in the code that you can find once you attach to the process.
Right click the method you want to put a breakpoint on and select Edit Method.
Add an infinite loop ...
Only top scored, non community-wiki answers of a minimum length are eligible