Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #5  
Old 01-25-2005, 01:15
Shub-Nigurrath's Avatar
Shub-Nigurrath Shub-Nigurrath is offline
VIP
 
Join Date: Mar 2004
Location: Obscure Kadath
Posts: 971
Rept. Given: 70
Rept. Rcvd 431 Times in 101 Posts
Thanks Given: 83
Thanks Rcvd at 405 Times in 127 Posts
Shub-Nigurrath Reputation: 400-499 Shub-Nigurrath Reputation: 400-499 Shub-Nigurrath Reputation: 400-499 Shub-Nigurrath Reputation: 400-499 Shub-Nigurrath Reputation: 400-499
try also to disassemble using IDA.

There are two basic types of MSIL (miscrosoft intermediate language) disassemblers.
ILDASM, Reflector and the like use the Reflection api to disassemble a dot net assembly.
IDA does not use the reflection api, instead it examines the bytes of the dot net assembly to disassemble.
The distinction between the two methods above is useful because many of the current crop of dot net protectors have the ability to stop disassembly via the reflection api. This is achieved by placing invalid meta data in the CLR (common language runtime) header of the file. This meta data is ignored during the execution of the program so it runs fine."

Of course the MSIL you get could be a nightmare..
__________________
Ŝħůb-Ňìĝùŕřaŧħ ₪)
There are only 10 types of people in the world: Those who understand binary, and those who don't
http://www.accessroot.com
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 00:02.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )