Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A problem with .NET Self-Contained Apps and how to pop calculators in dnSpy

blog.washi.dev | blog | #reverse-engineering | #vulnerability | #tools | #dotnet | #dnspy | #dll-hijack

Summary

Reveals a critical bug in dnSpy 6.1.8–6.4.0 that allowed arbitrary code execution via DLL hijacking when opening .NET self-contained apps; details the investigation and the dnSpyEx 6.4.1 fix.
Published
Collected

original ↗

Related coverage

blog · blog.washi.dev
Recovering Metadata from .NET Native AOT Binaries
Explains how to reverse engineer .NET Native AOT binaries: what Native AOT is, how to recover metadata such as method tables and frozen objects, and a Ghidra plugin that automates it.
blog · blog.washi.dev
Confusing .NET Debuggers: Proxy Objects
Explores proxy objects as an anti-analysis technique: using implicit operators, obfuscated names and custom display formatters to hide sensitive data from .NET debuggers like dnSpy.
blog · netspi.com
Introduction to Hacking Thick Clients: Part 4 – The Assemblies
Covers assembly protections like ASLR, DEP, SafeSEH, and Authenticode signing, shows how PESecurity flags unsigned binaries, and explains decompiling .NET assemblies to review code.
blog · netspi.com
Binrev- Automate Reversing Windows Binaries for Pentesters
Binrev chains common tools to automate reversing of Windows .NET, native, and Java binaries using de4dot, JustDecompile, procyon and more, aiding static code review and hardcoded secret hunting.
blog · blog.washi.dev
CILFI: Automatic Function Identification in .NET Binaries
Washi presents CILFI, a pattern-matching engine and custom language for identifying functions like string decryptors and C2 initializers in .NET binaries, replacing fragile hand-written matching code.
blog · blog.washi.dev
Addressing Common Misconceptions about .NET in the InfoSec World
Debunks widespread misconceptions about .NET in the infosec world — from '.NET is Windows-only' and 'bytecode is interpreted' to easy-decompilation myths — with practical reverse-engineering notes.
back