Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CILFI: Automatic Function Identification in .NET Binaries

blog.washi.dev | blog | #reverse-engineering | #tools | #pattern-matching | #dotnet | #deobfuscation | #cil

Summary

Washi presents CILFI, a pattern-matching engine and custom language for identifying functions like string decryptors and C2 initializers in .NET binaries, replacing fragile hand-written matching code.
Published
Collected

original ↗

Related coverage

blog · blog.washi.dev
Recovering Metadata from .NET Native AOT Binaries
Explains how to reverse engineer .NET Native AOT binaries: what Native AOT is, how to recover metadata such as method tables and frozen objects, and a Ghidra plugin that automates it.
blog · blog.washi.dev
A problem with .NET Self-Contained Apps and how to pop calculators in dnSpy
Reveals a critical bug in dnSpy 6.1.8–6.4.0 that allowed arbitrary code execution via DLL hijacking when opening .NET self-contained apps; details the investigation and the dnSpyEx 6.4.1 fix.
blog · blog.washi.dev
Confusing .NET Decompilers: The CallVirt OpCode
Part two of a series abusing CIL invocation opcodes: explains callvirt's virtual dispatch internals and uses CLR implementation quirks to call supposedly inaccessible methods, confusing decompilers.
blog · blog.washi.dev
Confusing .NET Decompilers: The Call OpCode
Shows how clever use of the ordinary CIL call opcode, bypassing normal callvirt conventions, can produce confusing code that fools decompilers, reflection and reverse engineers.
blog · netspi.com
Introduction to Hacking Thick Clients: Part 4 – The Assemblies
Covers assembly protections like ASLR, DEP, SafeSEH, and Authenticode signing, shows how PESecurity flags unsigned binaries, and explains decompiling .NET assemblies to review code.
blog · netspi.com
Binrev- Automate Reversing Windows Binaries for Pentesters
Binrev chains common tools to automate reversing of Windows .NET, native, and Java binaries using de4dot, JustDecompile, procyon and more, aiding static code review and hardcoded secret hunting.
back