Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Recovering Metadata from .NET Native AOT Binaries

blog.washi.dev | blog | #reverse-engineering | #ghidra | #tools | #metadata | #dotnet | #native-aot

Summary

Explains how to reverse engineer .NET Native AOT binaries: what Native AOT is, how to recover metadata such as method tables and frozen objects, and a Ghidra plugin that automates it.
Published
Collected

original ↗

Related coverage

blog · blog.washi.dev
A problem with .NET Self-Contained Apps and how to pop calculators in dnSpy
Reveals a critical bug in dnSpy 6.1.8–6.4.0 that allowed arbitrary code execution via DLL hijacking when opening .NET self-contained apps; details the investigation and the dnSpyEx 6.4.1 fix.
blog · netspi.com
Introduction to Hacking Thick Clients: Part 4 – The Assemblies
Covers assembly protections like ASLR, DEP, SafeSEH, and Authenticode signing, shows how PESecurity flags unsigned binaries, and explains decompiling .NET assemblies to review code.
blog · netspi.com
Binrev- Automate Reversing Windows Binaries for Pentesters
Binrev chains common tools to automate reversing of Windows .NET, native, and Java binaries using de4dot, JustDecompile, procyon and more, aiding static code review and hardcoded secret hunting.
blog · blog.washi.dev
CILFI: Automatic Function Identification in .NET Binaries
Washi presents CILFI, a pattern-matching engine and custom language for identifying functions like string decryptors and C2 initializers in .NET binaries, replacing fragile hand-written matching code.
blog · blog.washi.dev
Addressing Common Misconceptions about .NET in the InfoSec World
Debunks widespread misconceptions about .NET in the infosec world — from '.NET is Windows-only' and 'bytecode is interpreted' to easy-decompilation myths — with practical reverse-engineering notes.
blog · blog.washi.dev
Awaiting the Awaitables - Building the AwaitFuscator
Explores the internals of C# async/await to build AwaitFuscator, an obfuscator that encodes entire programs as long chains of await expressions by abusing custom awaiters and state machines.
back