What really is the Entry Point of a .NET Module?

Debunks widespread misconceptions about .NET in the infosec world — from '.NET is Windows-only' and 'bytecode is interpreted' to easy-decompilation myths — with practical reverse-engineering notes.

Shows how clever use of the ordinary CIL call opcode, bypassing normal callvirt conventions, can produce confusing code that fools decompilers, reflection and reverse engineers.

Covers assembly protections like ASLR, DEP, SafeSEH, and Authenticode signing, shows how PESecurity flags unsigned binaries, and explains decompiling .NET assemblies to review code.

Binrev chains common tools to automate reversing of Windows .NET, native, and Java binaries using de4dot, JustDecompile, procyon and more, aiding static code review and hardcoded secret hunting.

Explains how to reverse engineer .NET Native AOT binaries: what Native AOT is, how to recover metadata such as method tables and frozen objects, and a Ghidra plugin that automates it.

Explores the internals of C# async/await to build AwaitFuscator, an obfuscator that encodes entire programs as long chains of await expressions by abusing custom awaiters and state machines.