New answers tagged .net
-1
.NET assemblies (.exe and .dll) can be decompiled online at Decompiler.com
The author is affiliated with the mentioned website it appears (username: www.Decompiler.com).
0
You cannot do that with dnSpy, as the code that is stored in array is not managed code but native. So you have to extract that bytes, saved them in a file and analyze spearately with a native disassembler like r2, Ghidra, IDA etc.
As for stepping into, it's the same. You have to use a native debugger and not the one from dnSpy.
Since this is a mixed binary ...
4
the last byte of API/library call instructions is always 0x0A
It's because calls needs to have method (ref) as a parameter and methods are defined in the table that has an id of 0x0A.
Having bytes of the call like this 280600000A let's go one by one.
0x28 - is the value for opcode 'call' and it takes one operand.
the rest of the opcode is the metadata ...
Top 50 recent answers are included
