11
votes
Modify code with ILSpy
For reference to those still looking for an answer to this question, I would recommend trying dnSpy - it allows you to do exactly what the requester asked - modify the high level code and recompile.
...
- 211
10
votes
Accepted
How to tell if a particular .NET assembly was written in C# or F#?
Why does decompiling an F# assembly produce C# code?
It doesn't. It produces IL code which then can be interpreted as C#, F# or VB.NET. dotPeek doesn't allow you to use any other language for ...
- 4,952
8
votes
Accepted
Can my C# program be dumped from memory and reversed into source code?
It is in fact trivial to dump the byte array or the module directly from dnSpy.
To mimic the described scenario I wrote some trivial example code:
using System.IO;
using System.Reflection;
...
- 1,707
7
votes
Accepted
dnSpy - What do these symbols mean?
These are Unicode characters that are not supported by the font used by dnSpy.
Usually, you'll see it when the code is obfuscated or in cases where the developer used languages as Chinese and Russian ...
- 9,019
5
votes
Accepted
Do .NET functions have function prologs?
There is no real prolog in IL code because it does not need to manage the stack, save clobbered registers, or do any other standard bookkeeping necessary in the native code.
However, the bytecode ...
- 36.9k
5
votes
How to disassemble a packed .NET executable?
OK, I think I got it. The tool I needed was MegaDumper. (I couldn't find the executable on its Github, so I had to build it myself.)
Then here's the steps how I used it:
(I'm obviously doing all ...
- 1,761
5
votes
Trace Method Calls in .NET/C# Binary
that instrumentation is not easily possible because of JIT compilation of IL instructions.
Well it's actually the opposite. Tracing methods is quite easy - it would be difficult if we would like to ...
- 4,952
4
votes
android unity intercept w/ Frida
Heh, it's some kind of necroposting, but why not?
Well, under hood unity3d use 2 variants: mono, that loads C# dlls and il2cpp, that convert it to C++ before build.
For 2nd case u can use ...
- 41
4
votes
Do .NET functions have function prologs?
I dont think .NET is as simple.. you can clearly see it in IDA Pro - there at least a few different one byte function prologues.
Why not use a decompiler library for dnSpy/de4dot - dnlib to decompile ...
- 586
4
votes
Accepted
Structure of operand bytes in .NET call and data access IL instructions?
the last byte of API/library call instructions is always 0x0A
It's because calls needs to have method (ref) as a parameter and methods are defined in the table that has an id of 0x0A.
Having bytes of ...
- 4,952
4
votes
Is it possible to use GHIDRA to decode .NET ? (1 lvl crackmes with solution, but not in GHIDRA)
You mentioned that you are a beginner so I'll give you a more generic answer with a concrete recommendation in the end.
Compared to other industries, like software development, or generally white-...
- 272
3
votes
How to deobfuscation the public class names .NET
Converting multiple comments of mine to an answer for future readers:
You can't always deobfuscate .NET binaries. If, when the binaries are compiled, the obfuscation implementation modifies the name ...
- 2,254
3
votes
Accepted
What to do with ILSpy error "This file does not contain a managed assembly"?
This looks like a Win32 executable, .NET executables typically imports _CorExeMain from mscoree.dll. You can use an identification tool like PEiD or Detect It Easy to confirm it.
- 2,208
3
votes
Edit codes in .Net Reflector with Reflexil (Compile Window)
This blog that I wrote a a few years ago describes all the steps to modify a .net binary with Reflector and Reflexil. Not sure which steps you're missing but I recommended to read&compare.
...
- 3,283
3
votes
How to debug a DLL written in .NET/C#?
I've used dnSpy in production for debugging as it can be put on a USB. It's perfectly capable of decompiling and debugging dll's.
It has a pretty rich set of features. It's able to attach to ...
- 131
3
votes
Trace Method Calls in .NET/C# Binary
You can use de4dot (https://github.com/0xd4d/de4dot) to deobfuscate the binary. Static analysis of dotnet binaries can be done easily by using de4dot and then using ILSpy to create a visual studio ...
- 31
3
votes
Accepted
ildasm on Linux: "original" ildasm.exe same as dotnet-ildasm?
The original one was a native executable and this one is build in .NET by utilizing a Mono.Cecil library to get the assembly information so if I would have to answer your first question I would answer ...
- 4,952
3
votes
Accepted
dnSpy: how to start 32 bit version
By default choco doesn't want to install 32bit if you are on 64bit system. But, with a little bit of effort, I found that to install 32bit you will need to add either add: --x86 or --forcex86 to force ...
- 120
3
votes
.NET: How to debug or decompile a DanamicMethod with dnSpy?
You can debug DynamicMethod's using the EventPipe API. I've written a library that uses it to allow for code injection via DynamicMethod that can be debugged: https://github.com/damieng/DamienG....
- 74
3
votes
How to use dnSpyEx or some other .NET debugger to attach to a .NET process started with a process-hollowing technique?
You can insert an infinite loop in the code that you can find once you attach to the process.
Right click the method you want to put a breakpoint on and select Edit Method.
Add an infinite loop ...
2
votes
Accepted
Modifying a string in a .net binary
C# encodes its string literals as UTF-16.
(http://csharpindepth.com/Articles/General/Strings.aspx)
To search the hex in HxD you need to check the Unicode string checkbox in HxD and after that you are ...
- 51
2
votes
Extracting embedded dlls from .NET executable
They are not inside the application, there should be somewhere on your machine and will be loaded at runtime. You can use Process Monitor to check from where they are loaded.
ILSpy should be able to ...
- 4,952
2
votes
Unable to unpack heavly obfuscated malware
ConfuserEx unpacks your executable at runtime and then gives control to it.
After the ConfuserEx loader finishes its job you can dump the memory and the assembly.
In order to avoid detection, you can ...
- 297
2
votes
Unity game: Assembly dll embedded inside the exe
Nexide, wild guess but your game is complied with il2cpp.
You could use Scylla to dump GameAssembly.DLL
and you'll get a dumb folder and with that you use Il2cppDumper, drag both the Globalmeta.dat ...
- 21
2
votes
Accepted
Attach one debugger to a DotNet application, and a second one to a loaded DLL
The best way to debug this in my opinion is to use WinDbg from Windows SDK or WinDbg Preview from Windows Store. In Windows it is not possible to attach two debuggers to the same process. WinDbg ...
- 1,267
2
votes
Accepted
Where are the .NET IL bytes stored in an .NET executable?
For .NET assemblies there's a .NET MetaData Directory that can be found in the Data Directories. From that you can get access to MetaData Header and MetaData Streams that holds all the info for you to ...
- 4,952
2
votes
Accepted
Inserting two digits into binary per Hex - without making EXE corrupt
Since you are dealing with a dot Net application, this will be super easy.
As dot Net application are 'compiled' using an Intermediate Language (IL), you may be able to recover something very close to ...
- 709
2
votes
Accepted
How to debug a .net DLL?
By far the easiest way to work with a .NET DLL is to just add it to a console app in the IDE.
Create a new console app in Visual Studio / Rider, etc. - make sure it's the right Core / Framework ...
- 190
2
votes
Accepted
Patch .net executable via hex editor
Turned out the executable is a ReadyToRun executable, so it contains both IL and prebuilt x86-64 image. Modifying IL wasn't working because only x86 image was used at runtime. Modifying x86 image ...
- 185
Only top scored, non community-wiki answers of a minimum length are eligible