Exetools

Exetools (https://forum.exetools.com/index.php)
-   General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)
-   -   Tips on reverse engineering mixed .NET/native binaries? (https://forum.exetools.com/showthread.php?t=19364)

jonwil 10-27-2019 18:44

Tips on reverse engineering mixed .NET/native binaries?
 
I have some dlls that contain both .NET code and native code. Any tools, tips or other things that will help with reverse engineering such dlls?
Something that can decompile the .NET code and spit it all out (in C++/CLI syntax ideally but C# will do) and can then identify the native side of things (addresses etc) so I can then go in and reverse engineer those (including any calls from the native code back to the .NET code)

atom0s 10-28-2019 03:02

dnSpy, ILSpy, and similar all support VC++.NET generally so you should be able to view the code of them in that. For actual native code IDA or Ghidra.

barmaley 10-28-2019 18:09

de4dot - super .NET deobfuscator

sendersu 10-29-2019 04:19

Quote:

Originally Posted by jonwil (Post 118558)
I have some dlls that contain both .NET code and native code. Any tools, tips or other things that will help with reverse engineering such dlls?
Something that can decompile the .NET code and spit it all out (in C++/CLI syntax ideally but C# will do) and can then identify the native side of things (addresses etc) so I can then go in and reverse engineer those (including any calls from the native code back to the .NET code)

from my practice most of the time .net code is calling some native stuff..
so you have to study how to figure out where the hell for example IL opcode calli will jump to.. etc

most of the times dnSpy is your best friend in this journey + some hex tool like hiew or IDA

calling .net code from native sounds like a "nontraditional sex", pardon me :)

zeffy 10-29-2019 10:00

I generally use CFF Explorer, dnSpy, and IDA (open as native PE) for reversing mixed mode assemblies.

The RVAs of native functions called from managed code can be located by name in the .NET metadata table, so you can navigate to them quickly in IDA (in CFF Explorer, .NET Directory -> MetaData Streams -> #~ -> Tables -> Method). At least for me, this made the reversing process quite a bit easier.

toro 10-30-2019 13:58

in dnspy you can see RVA of native functions just above the function definition.
if program use calli- usually call a method of c++ class- you can find the constructor of class RVA first then continue in ida or your debugger.

nimaarek 11-07-2019 01:31

How is this possible?
Can you explain a bit how .NET code and native code can be used in the program?


All times are GMT +8. The time now is 19:40.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX