New answers tagged


.NET assemblies (.exe and .dll) can be decompiled online at The author is affiliated with the mentioned website it appears (username:


You cannot do that with dnSpy, as the code that is stored in array is not managed code but native. So you have to extract that bytes, saved them in a file and analyze spearately with a native disassembler like r2, Ghidra, IDA etc. As for stepping into, it's the same. You have to use a native debugger and not the one from dnSpy. Since this is a mixed binary ...


the last byte of API/library call instructions is always 0x0A It's because calls needs to have method (ref) as a parameter and methods are defined in the table that has an id of 0x0A. Having bytes of the call like this 280600000A let's go one by one. 0x28 - is the value for opcode 'call' and it takes one operand. the rest of the opcode is the metadata ...

Top 50 recent answers are included