Hot answers tagged

4

the last byte of API/library call instructions is always 0x0A It's because calls needs to have method (ref) as a parameter and methods are defined in the table that has an id of 0x0A. Having bytes of the call like this 280600000A let's go one by one. 0x28 - is the value for opcode 'call' and it takes one operand. the rest of the opcode is the metadata ...


3

For reference to those still looking for an answer to this question, I would recommend trying dnSpy - it allows you to do exactly what the requester asked - modify the high level code and recompile. It isn't perfect, but I've been able to make small changes to the in-house exe's we have where we didn't have the latest source code (disgruntled employees, don'...


2

Nexide, wild guess but your game is complied with il2cpp. You could use Scylla to dump GameAssembly.DLL and you'll get a dumb folder and with that you use Il2cppDumper, drag both the Globalmeta.dat file and the GameAssembly.dll-Dumped file inside where all the il2cppdumper dlls are stored, then run Il2cppdumper then press GameAssembly.dll then Globalmeta ...


2

By default choco doesn't want to install 32bit if you are on 64bit system. But, with a little bit of effort, I found that to install 32bit you will need to add either add: --x86 or --forcex86 to force x86 (32bit) installation on 64 bit systems. To download dnspy 32 bit you would run: choco install dnspy --x86 Alternatively, you can go to dnSpy github and ...


1

For .NET assemblies there's a .NET MetaData Directory that can be found in the Data Directories. From that you can get access to MetaData Header and MetaData Streams that holds all the info for you to extract and located the code. A good start (or maybe even a complete guide) into this topic would be the "Anatomy of a .NET Assembly" by Simon Cooper....


1

So I though it would be a nice pet-project so I've started building a PoC tool that can generate a CFG for a given method in the .NET assembly. The PoC uses Mono.Cecil to inspect the binary and produces a graph in a DOT language than later can be transformed into a picture with dot tool and works on IL level. A bit of technical info. First it determines ...


1

I figured it out: Right click and go to hex editor, then search the bytes you are looking for, then after finding it right click and select go to code reference.


Only top voted, non community-wiki answers of a minimum length are eligible