Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Awaiting the Awaitables - Building the AwaitFuscator

blog.washi.dev | blog | #reverse-engineering | #obfuscation | #compilers | #dotnet | #async-await | #csharp

Summary

Explores the internals of C# async/await to build AwaitFuscator, an obfuscator that encodes entire programs as long chains of await expressions by abusing custom awaiters and state machines.
Published
Collected

original ↗

Related coverage

blog · blog.washi.dev
Confusing .NET Debuggers: Proxy Objects
Explores proxy objects as an anti-analysis technique: using implicit operators, obfuscated names and custom display formatters to hide sensitive data from .NET debuggers like dnSpy.
blog · blog.washi.dev
int main();
Washi's first blog post: a short introduction to the author, a hobbyist programmer and reverse engineer focused on compilers, decompilers and obfuscation, and what the blog will cover.
blog · bishopfox.com
Unified Code, Unified Risks: Uncovering Vulnerabilities in .NET MAUI Applications
Bishop Fox shows how to bypass .NET MAUI's platform packaging to extract readable C# assemblies from Android and iOS apps, then use that shared-assembly insight to uncover critical vulnerability patterns in common business logic.
blog · hackerone.com
Leveraging Async/Await in ASP.NET for Enhanced Performance
Covers effective async/await usage in ASP.NET: reserve it for I/O-bound work, avoid .Result and .Wait() deadlocks with ConfigureAwait(false), and skip async for CPU-bound paths.
blog · netspi.com
Introduction to Hacking Thick Clients: Part 4 – The Assemblies
Covers assembly protections like ASLR, DEP, SafeSEH, and Authenticode signing, shows how PESecurity flags unsigned binaries, and explains decompiling .NET assemblies to review code.
blog · netspi.com
Limiting The Exposure of Plain Text Passwords in C#
NetSPI shows why .NET SecureString still leaks passwords in memory via NetworkCredential, and demonstrates safer login handling using pinned mutable byte arrays instead of immutable strings.
back