---
id: 6427
title: "CILFI: Automatic Function Identification in .NET Binaries"
source_domain: blog.washi.dev
source_url: "https://blog.washi.dev/posts/cilfi/"
published_at: "2026-08-04T00:00:00Z"
tags: ["reverse-engineering", "tools", "pattern-matching", "dotnet", "deobfuscation", "cil"]
phying_url: "https://phying.com/item/6427"
lang: en
---

# CILFI: Automatic Function Identification in .NET Binaries

## Summary

Washi presents CILFI, a pattern-matching engine and custom language for identifying functions like string decryptors and C2 initializers in .NET binaries, replacing fragile hand-written matching code.

## Intelligence Metadata

- **Sources:** blog.washi.dev
- **Published:** 2026-08-04T00:00:00Z
- **Original:** https://blog.washi.dev/posts/cilfi/
- **Phying News:** https://phying.com/item/6427