13
votes
How to decompile a C# .exe on macOS?
Visual Studio for Mac can do the job. Just hit File / Open and then choose the executable or library you want. It'll open the Assembly Browser window.
If you need more detailed code change the ...
- 231
11
votes
Accepted
Why can C# applications be reverse-compiled with variable names while C++ ones can't?
Debug Symbol information is often "stripped off" from C++ binaries. Symbol information stores all user-created names, symbols, and types, bounds, fouction boundary and other function related ...
- 1,807
10
votes
Modify code with ILSpy
For reference to those still looking for an answer to this question, I would recommend trying dnSpy - it allows you to do exactly what the requester asked - modify the high level code and recompile.
...
- 201
10
votes
Accepted
How to tell if a particular .NET assembly was written in C# or F#?
Why does decompiling an F# assembly produce C# code?
It doesn't. It produces IL code which then can be interpreted as C#, F# or VB.NET. dotPeek doesn't allow you to use any other language for ...
- 4,942
6
votes
Accepted
C# Changing method body in runtime
In the past I've had issues editing the IL code during run time, especially if the method had already been compiled by the JIT Compiler, and the most full proof way I found was to patch it during run ...
6
votes
Accepted
Compile C# like C++?
There are a number of options:
C# code can be compiled to native code (like C++ compilation) using Ngen.exe or .NET Native. Although the IL code and metadata might still be required by the runtime.
...
- 176
5
votes
How to edit and modify a class with ILSpy + Reflexil
Try using dnSpy. It includes an ability to inject the recompiled code, and has the same interface as ILSpy. Use "Edit Method" option on the method you're editing, then "Build" and save the assembly. ...
- 151
5
votes
How to decompile a C# .exe on macOS?
Best free tool for the job is ILSpy, but it runs on Windows. This gives you a limited list of options:
create a windows virtual machine (with virtualbox or vmware player) and run it in there
install ...
- 256
5
votes
Accepted
Having keys and binary, how do I reverse/decrypt a stream encryption?
Good news, You're lucky!
What you're facing in front of you is a stream cipher. Why is that good? because the way stream ciphers are built makes them extremely easy to reverse - the decryption and ...
- 11.8k
5
votes
Trace Method Calls in .NET/C# Binary
that instrumentation is not easily possible because of JIT compilation of IL instructions.
Well it's actually the opposite. Tracing methods is quite easy - it would be difficult if we would like to ...
- 4,942
4
votes
Recover source code for C# .exe
Consider also JetBrains dotPeek that is free, decompiles .NET 1.0-4.5 assemblies to C#.
Has support for .dll, .exe, .zip, .vsix, .nupkg, and .winmd files.
- 141
4
votes
Accepted
Reverse code check
Well the algo is quite simple, let's try to break it down:
if (code.Substring(0, 2) != "DC")
It has to start with DC
if (code.Length != 0x1a)
and be of length 26 chars
string s = code....
- 4,942
4
votes
Accepted
Debug and crack .NET executable PE
reading your question several times and the discussion in the comments i did not understand what you're trying to get/obtain, so i will be answering to parts that i think that are relevant according ...
- 86
4
votes
Accepted
Is there a way to decompress a Fody-Costura generated exe in c#?
Embedded assemblies needs to be decompressed before they can be used so you can inspect all the code that does that in the assembly. Just go to Costura.AssemblyLoader to check how it is done. below is ...
- 4,942
3
votes
How to debug a DLL written in .NET/C#?
I've used dnSpy in production for debugging as it can be put on a USB. It's perfectly capable of decompiling and debugging dll's.
It has a pretty rich set of features. It's able to attach to ...
- 131
3
votes
Can we decompile an .exe or .dll as %100?
Since the compilation output of .NET languages is MSIL, which is quite readable itself, it can be transformed back to (almost) original source code.
There are many applications which can do that.
My ...
- 176
3
votes
How to deobfuscation the public class names .NET
Converting multiple comments of mine to an answer for future readers:
You can't always deobfuscate .NET binaries. If, when the binaries are compiled, the obfuscation implementation modifies the name ...
- 2,254
3
votes
Trace Method Calls in .NET/C# Binary
You can use de4dot (https://github.com/0xd4d/de4dot) to deobfuscate the binary. Static analysis of dotnet binaries can be done easily by using de4dot and then using ILSpy to create a visual studio ...
- 31
3
votes
IDA Pro sp-analysis failed
If this is C# (or any other .NET file) you need to use a tools such as .NET reflector to "decompile" it into .NET intermediate language.
Anyhow...
The error you are seeing means that at the end of a ...
- 1,317
3
votes
Accepted
How to start out in reversing?
I'm starting in RE too (since beggining of 2020), and I thought I could put here what I've learned so far. Maybe it might be of help.
So first of all, you need Assembly knowledges. You asked if it's ...
- 186
3
votes
Accepted
Mono.Cecil throws SymbolsNotMatchingException, how to find out Method line number?
So all the steps above are correct the way they were described. The only thing I have done wrong was, that my target DLL was modified by Mono.Cecil before (I already had read and wrote my target DLL ...
2
votes
How to decompile a C# .exe on macOS?
You can use Jetbrains' Rider. It has a 30 day free trial period.
Open Rider and open or create a C# project
Add a dependency to the .exe file (naturally, this also works for .dll).
In a class in ...
- 121
2
votes
Accepted
Reversing C# exe,Questions.Help
Those numbers are metadata and is called Token IDs. You can click on those in the dnSpy and you will be taken to the editor of the selected item.
As for your first question, remember that .net apps ...
- 4,942
2
votes
Accepted
Encrypted String?
It looks like obfuscated .net code. It also looks like that some names of properties/classes are obfuscated into some kind of unicode/other-non-readable representation, and your ".(724942833)" is ...
- 8,528
2
votes
Accepted
See how classes are used in a Unity 3D game
it's not immediately apparent how the classes are put together, i.e.
how and when methods on the classes are called
I'm afraid there is no free lunch here.
What you can tackle this with two ...
- 2,906
2
votes
Extracting embedded dlls from .NET executable
They are not inside the application, there should be somewhere on your machine and will be loaded at runtime. You can use Process Monitor to check from where they are loaded.
ILSpy should be able to ...
- 4,942
2
votes
Help Needed reversing a function inside a DLL
Open the Cryptography.dll file in dnSpy. The PARAM value can be decoded with this Decode6bit() function found in EncodeUtilscs:
public static string Decode6bit(string input) {
string value = ...
- 1,579
2
votes
Accepted
What methods exist for adding new windows form controls into compiled assembly using dnSpy?
Yes, it is possible!
You'll have to do some trial and error for positioning though.
Adding in a new control is fairly easy. We essentially need to do what the designer usually automatically does for ...
- 36
2
votes
Accepted
Calculating offset from push instruction in exe to string in data section
push 402010 is broken down like
402010 - base_address - virtual_address_of_section + file_ptr_to_rawdata
your data has some inconsistencies it must be a counted string or pascal string etc there is ...
- 16.5k
2
votes
Accepted
Where are the .NET IL bytes stored in an .NET executable?
For .NET assemblies there's a .NET MetaData Directory that can be found in the Data Directories. From that you can get access to MetaData Header and MetaData Streams that holds all the info for you to ...
- 4,942
Only top scored, non community-wiki answers of a minimum length are eligible