Skip to main content
10 votes
Accepted

How to tell if a particular .NET assembly was written in C# or F#?

Why does decompiling an F# assembly produce C# code? It doesn't. It produces IL code which then can be interpreted as C#, F# or VB.NET. dotPeek doesn't allow you to use any other language for ...
Paweł Łukasik's user avatar
8 votes

Modify code with ILSpy

For reference to those still looking for an answer to this question, I would recommend trying dnSpy - it allows you to do exactly what the requester asked - modify the high level code and recompile. ...
Raithlin's user avatar
  • 181
8 votes
Accepted

Can my C# program be dumped from memory and reversed into source code?

It is in fact trivial to dump the byte array or the module directly from dnSpy. To mimic the described scenario I wrote some trivial example code: using System.IO; using System.Reflection; ...
mrexodia's user avatar
  • 1,652
7 votes
Accepted

dnSpy - What do these symbols mean?

These are Unicode characters that are not supported by the font used by dnSpy. Usually, you'll see it when the code is obfuscated or in cases where the developer used languages as Chinese and Russian ...
Megabeets's user avatar
  • 8,999
5 votes
Accepted

Do .NET functions have function prologs?

There is no real prolog in IL code because it does not need to manage the stack, save clobbered registers, or do any other standard bookkeeping necessary in the native code. However, the bytecode ...
Igor Skochinsky's user avatar
  • 36.8k
5 votes

How to disassemble a packed .NET executable?

OK, I think I got it. The tool I needed was MegaDumper. (I couldn't find the executable on its Github, so I had to build it myself.) Then here's the steps how I used it: (I'm obviously doing all ...
c00000fd's user avatar
  • 1,691
5 votes

Trace Method Calls in .NET/C# Binary

that instrumentation is not easily possible because of JIT compilation of IL instructions. Well it's actually the opposite. Tracing methods is quite easy - it would be difficult if we would like to ...
Paweł Łukasik's user avatar
4 votes

Is it possible ( or how) to dump source code/machine code from memory?

Just to be clear: You can not reconstruct source code from .net or c++ binaries. You can try to recover it using heuristics, embedded symbols and knowledge about the assembler, but you already lost ...
Nordwald's user avatar
  • 2,906
4 votes

Do .NET functions have function prologs?

I dont think .NET is as simple.. you can clearly see it in IDA Pro - there at least a few different one byte function prologues. Why not use a decompiler library for dnSpy/de4dot - dnlib to decompile ...
Sigtran's user avatar
  • 586
4 votes

android unity intercept w/ Frida

Heh, it's some kind of necroposting, but why not? Well, under hood unity3d use 2 variants: mono, that loads C# dlls and il2cpp, that convert it to C++ before build. For 2nd case u can use ...
Demogor's user avatar
  • 41
4 votes
Accepted

Structure of operand bytes in .NET call and data access IL instructions?

the last byte of API/library call instructions is always 0x0A It's because calls needs to have method (ref) as a parameter and methods are defined in the table that has an id of 0x0A. Having bytes of ...
Paweł Łukasik's user avatar
3 votes

How to deobfuscation the public class names .NET

Converting multiple comments of mine to an answer for future readers: You can't always deobfuscate .NET binaries. If, when the binaries are compiled, the obfuscation implementation modifies the name ...
dsasmblr's user avatar
  • 2,234
3 votes
Accepted

What to do with ILSpy error "This file does not contain a managed assembly"?

This looks like a Win32 executable, .NET executables typically imports _CorExeMain from mscoree.dll. You can use an identification tool like PEiD or Detect It Easy to confirm it.
ekse's user avatar
  • 2,208
3 votes

Edit codes in .Net Reflector with Reflexil (Compile Window)

This blog that I wrote a a few years ago describes all the steps to modify a .net binary with Reflector and Reflexil. Not sure which steps you're missing but I recommended to read&compare. ...
Remko's user avatar
  • 3,273
3 votes

Edit codes in .Net Reflector with Reflexil (Compile Window)

Decompile a function with .NET Reflector, and in the Instructions tab of the Reflexil window, right click on an instruction and choose Replace all with code...: https://www.youtube.com/watch?v=...
Jason Geffner's user avatar
3 votes

Is it possible to debug a .Net executable with IDA?

No. https://www.hex-rays.com/products/ida/debugger/index.shtml Ask on their support forum if you want.
Vitaly Osipov's user avatar
3 votes

How to debug a DLL written in .NET/C#?

I've used dnSpy in production for debugging as it can be put on a USB. It's perfectly capable of decompiling and debugging dll's. It has a pretty rich set of features. It's able to attach to ...
Jonathan Van Dam's user avatar
3 votes

Trace Method Calls in .NET/C# Binary

You can use de4dot (https://github.com/0xd4d/de4dot) to deobfuscate the binary. Static analysis of dotnet binaries can be done easily by using de4dot and then using ILSpy to create a visual studio ...
oridamari's user avatar
3 votes
Accepted

ildasm on Linux: "original" ildasm.exe same as dotnet-ildasm?

The original one was a native executable and this one is build in .NET by utilizing a Mono.Cecil library to get the assembly information so if I would have to answer your first question I would answer ...
Paweł Łukasik's user avatar
3 votes
Accepted

dnSpy: how to start 32 bit version

By default choco doesn't want to install 32bit if you are on 64bit system. But, with a little bit of effort, I found that to install 32bit you will need to add either add: --x86 or --forcex86 to force ...
BadSugar's user avatar
  • 110
3 votes

.NET: How to debug or decompile a DanamicMethod with dnSpy?

You can debug DynamicMethod's using the EventPipe API. I've written a library that uses it to allow for code injection via DynamicMethod that can be debugged: https://github.com/damieng/DamienG....
user42194's user avatar
3 votes

How to use dnSpyEx or some other .NET debugger to attach to a .NET process started with a process-hollowing technique?

You can insert an infinite loop in the code that you can find once you attach to the process. Right click the method you want to put a breakpoint on and select Edit Method. Add an infinite loop ...
Ana María Martínez Gómez's user avatar
3 votes

Is it possible to use GHIDRA to decode .NET ? (1 lvl crackmes with solution, but not in GHIDRA)

You mentioned that you are a beginner so I'll give you a more generic answer with a concrete recommendation in the end. Compared to other industries, like software development, or generally white-...
born's user avatar
  • 252
2 votes
Accepted

Modifying a string in a .net binary

C# encodes its string literals as UTF-16. (http://csharpindepth.com/Articles/General/Strings.aspx) To search the hex in HxD you need to check the Unicode string checkbox in HxD and after that you are ...
user20610's user avatar
2 votes

Extracting embedded dlls from .NET executable

They are not inside the application, there should be somewhere on your machine and will be loaded at runtime. You can use Process Monitor to check from where they are loaded. ILSpy should be able to ...
Paweł Łukasik's user avatar
2 votes

Unable to unpack heavly obfuscated malware

ConfuserEx unpacks your executable at runtime and then gives control to it. After the ConfuserEx loader finishes its job you can dump the memory and the assembly. In order to avoid detection, you can ...
Yennefer's user avatar
  • 297
2 votes

Unity game: Assembly dll embedded inside the exe

Nexide, wild guess but your game is complied with il2cpp. You could use Scylla to dump GameAssembly.DLL and you'll get a dumb folder and with that you use Il2cppDumper, drag both the Globalmeta.dat ...
Micro's user avatar
  • 21
2 votes
Accepted

Attach one debugger to a DotNet application, and a second one to a loaded DLL

The best way to debug this in my opinion is to use WinDbg from Windows SDK or WinDbg Preview from Windows Store. In Windows it is not possible to attach two debuggers to the same process. WinDbg ...
chentiangemalc's user avatar
2 votes
Accepted

Where are the .NET IL bytes stored in an .NET executable?

For .NET assemblies there's a .NET MetaData Directory that can be found in the Data Directories. From that you can get access to MetaData Header and MetaData Streams that holds all the info for you to ...
Paweł Łukasik's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible