Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Addressing Common Misconceptions about .NET in the InfoSec World

blog.washi.dev | blog | #reverse-engineering | #malware-analysis | #infosec | #dotnet | #runtime | #misconceptions

Summary

Debunks widespread misconceptions about .NET in the infosec world — from '.NET is Windows-only' and 'bytecode is interpreted' to easy-decompilation myths — with practical reverse-engineering notes.
Published
Collected

original ↗

Related coverage

blog · blog.washi.dev
What really is the Entry Point of a .NET Module?
A tour of the many entry points in a .NET module — from Main and static constructors to CLR and PE native entry points, TLS callbacks and DLL pre-injection — showing where user code really begins.
blog · netspi.com
Introduction to Hacking Thick Clients: Part 4 – The Assemblies
Covers assembly protections like ASLR, DEP, SafeSEH, and Authenticode signing, shows how PESecurity flags unsigned binaries, and explains decompiling .NET assemblies to review code.
blog · netspi.com
Binrev- Automate Reversing Windows Binaries for Pentesters
Binrev chains common tools to automate reversing of Windows .NET, native, and Java binaries using de4dot, JustDecompile, procyon and more, aiding static code review and hardcoded secret hunting.
blog · blog.washi.dev
Recovering Metadata from .NET Native AOT Binaries
Explains how to reverse engineer .NET Native AOT binaries: what Native AOT is, how to recover metadata such as method tables and frozen objects, and a Ghidra plugin that automates it.
blog · blog.washi.dev
Awaiting the Awaitables - Building the AwaitFuscator
Explores the internals of C# async/await to build AwaitFuscator, an obfuscator that encodes entire programs as long chains of await expressions by abusing custom awaiters and state machines.
blog · blog.washi.dev
A problem with .NET Self-Contained Apps and how to pop calculators in dnSpy
Reveals a critical bug in dnSpy 6.1.8–6.4.0 that allowed arbitrary code execution via DLL hijacking when opening .NET self-contained apps; details the investigation and the dnSpyEx 6.4.1 fix.
back