Hot answers tagged

11 votes
Accepted

Why can C# applications be reverse-compiled with variable names while C++ ones can't?

Debug Symbol information is often "stripped off" from C++ binaries. Symbol information stores all user-created names, symbols, and types, bounds, fouction boundary and other function related ...
user avatar
  • 1,427
10 votes
Accepted

How to tell if a particular .NET assembly was written in C# or F#?

Why does decompiling an F# assembly produce C# code? It doesn't. It produces IL code which then can be interpreted as C#, F# or VB.NET. dotPeek doesn't allow you to use any other language for ...
user avatar
9 votes

How to decompile a C# .exe on macOS?

Visual Studio for Mac can do the job. Just hit File / Open and then choose the executable or library you want. It'll open the Assembly Browser window. If you need more detailed code change the ...
user avatar
  • 191
6 votes
Accepted

Compile C# like C++?

There are a number of options: C# code can be compiled to native code (like C++ compilation) using Ngen.exe or .NET Native. Although the IL code and metadata might still be required by the runtime. ...
user avatar
5 votes

Modify code with ILSpy

For reference to those still looking for an answer to this question, I would recommend trying dnSpy - it allows you to do exactly what the requester asked - modify the high level code and recompile. ...
user avatar
  • 151
5 votes

Modify code with ILSpy

You may work according to the following pattern: Save code in ILSpy (or in Reflector) as .cs files (as you already described) Try to create a Visual Studio project from that code Make all ...
user avatar
  • 1,804
5 votes
Accepted

Identifying cryptography algorithm

You can always feed the original binary to IDA and use the plugin Findcrypt2 to identify the algorithms used. Other than this the Kanal plugin for PeiD can also detect cryptography used. Another tool ...
user avatar
  • 5,850
5 votes
Accepted

IDApro subroutine analysis

It's not very reliable. IDA can't determine types beyond analyzing the size and type of loads and stores. For instance IDA doesn't tell the difference between a pointer to a type and an integer, given ...
user avatar
5 votes

Recover source code for C# .exe

As far as free and open source tools go, I'd recommend dnSpy. It is the best tool I've used for .NET reverse engineering. You might also want to try out ILSpy, which is free and open source as well.
user avatar
  • 1,469
5 votes

How to decompile a C# .exe on macOS?

Best free tool for the job is ILSpy, but it runs on Windows. This gives you a limited list of options: create a windows virtual machine (with virtualbox or vmware player) and run it in there install ...
user avatar
5 votes

How to edit and modify a class with ILSpy + Reflexil

Try using dnSpy. It includes an ability to inject the recompiled code, and has the same interface as ILSpy. Use "Edit Method" option on the method you're editing, then "Build" and save the assembly. ...
user avatar
  • 151
5 votes
Accepted

C# Changing method body in runtime

In the past I've had issues editing the IL code during run time, especially if the method had already been compiled by the JIT Compiler, and the most full proof way I found was to patch it during run ...
user avatar
5 votes

Trace Method Calls in .NET/C# Binary

that instrumentation is not easily possible because of JIT compilation of IL instructions. Well it's actually the opposite. Tracing methods is quite easy - it would be difficult if we would like to ...
user avatar
4 votes
Accepted

Reverse code check

Well the algo is quite simple, let's try to break it down: if (code.Substring(0, 2) != "DC") It has to start with DC if (code.Length != 0x1a) and be of length 26 chars string s = code....
user avatar
4 votes
Accepted

Having keys and binary, how do I reverse/decrypt a stream encryption?

Good news, You're lucky! What you're facing in front of you is a stream cipher. Why is that good? because the way stream ciphers are built makes them extremely easy to reverse - the decryption and ...
user avatar
  • 11.3k
4 votes

Recover source code for C# .exe

Consider also JetBrains dotPeek that is free, decompiles .NET 1.0-4.5 assemblies to C#. Has support for .dll, .exe, .zip, .vsix, .nupkg, and .winmd files.
user avatar
  • 141
3 votes

Recover source code for C# .exe

To answer your question "Can I end up with the original source code in a way I can finish the coding of the missing items and recompile again?": if it runs on your system, it means you have all the ...
user avatar
3 votes

Can we decompile an .exe or .dll as %100?

Since the compilation output of .NET languages is MSIL, which is quite readable itself, it can be transformed back to (almost) original source code. There are many applications which can do that. My ...
user avatar
3 votes

Malware checks for hwid

It's base64. One entry per line. Entries look like they're padded to 0x10. So after base64 decoding the data is probably encrypted by a block cipher with 128-bit block size. Maybe AES. At this stage ...
user avatar
3 votes

Extracting data from Filemaker application

Not quite sure what you are looking for, so here goes: If you just want to open the database of a FM runtime solution, thats easy: Just rename the .USR file to .fp7 and open it with Filemaker (you ...
user avatar
  • 133
3 votes

How to deobfuscation the public class names .NET

Converting multiple comments of mine to an answer for future readers: You can't always deobfuscate .NET binaries. If, when the binaries are compiled, the obfuscation implementation modifies the name ...
user avatar
  • 2,144
3 votes

How to debug a DLL written in .NET/C#?

I've used dnSpy in production for debugging as it can be put on a USB. It's perfectly capable of decompiling and debugging dll's. It has a pretty rich set of features. It's able to attach to ...
user avatar
3 votes

Trace Method Calls in .NET/C# Binary

You can use de4dot (https://github.com/0xd4d/de4dot) to deobfuscate the binary. Static analysis of dotnet binaries can be done easily by using de4dot and then using ILSpy to create a visual studio ...
user avatar
3 votes
Accepted

Debug and crack .NET executable PE

reading your question several times and the discussion in the comments i did not understand what you're trying to get/obtain, so i will be answering to parts that i think that are relevant according ...
user avatar
3 votes
Accepted

How to start out in reversing?

I'm starting in RE too (since beggining of 2020), and I thought I could put here what I've learned so far. Maybe it might be of help. So first of all, you need Assembly knowledges. You asked if it's ...
user avatar
  • 156
3 votes
Accepted

Mono.Cecil throws SymbolsNotMatchingException, how to find out Method line number?

So all the steps above are correct the way they were described. The only thing I have done wrong was, that my target DLL was modified by Mono.Cecil before (I already had read and wrote my target DLL ...
user avatar
2 votes
Accepted

Cannot compile native/unmanaged method

Depending how extensive your modifications are, the way I've always done it was to only compile the snippet you want to inject (or manually convert the OpCodes) and patch the existing binary rather ...
user avatar
2 votes

Modify code with ILSpy

Currently, there's no way to modify the binary directly with ILSpy. The only solution is the one you described, export the source and recompile it. However, the feature you are looking for is ...
user avatar
  • 578
2 votes
Accepted

Convert assembly ADC to C#

This is 64-bit math. The compiler has to do the addition in two steps because the processor can only work 32 bits at a time. And carry has to be propagated from the low addition to the high one - same ...
user avatar
  • 34.6k
2 votes

Can I extract .txt files from .exe if I know their addresses?

It appears to me as if these are just file names, which may or may not refer to files embedded in the executable. Looking at the cross references and the surrounding API calls might tell you how they ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible