Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Confusing .NET Debuggers: Proxy Objects

blog.washi.dev | blog | #obfuscation | #debugger | #dotnet | #anti-analysis | #dnspy | #proxy-objects

Summary

Explores proxy objects as an anti-analysis technique: using implicit operators, obfuscated names and custom display formatters to hide sensitive data from .NET debuggers like dnSpy.
Published
Collected

original ↗

Related coverage

blog · blog.washi.dev
Awaiting the Awaitables - Building the AwaitFuscator
Explores the internals of C# async/await to build AwaitFuscator, an obfuscator that encodes entire programs as long chains of await expressions by abusing custom awaiters and state machines.
blog · blog.washi.dev
A problem with .NET Self-Contained Apps and how to pop calculators in dnSpy
Reveals a critical bug in dnSpy 6.1.8–6.4.0 that allowed arbitrary code execution via DLL hijacking when opening .NET self-contained apps; details the investigation and the dnSpyEx 6.4.1 fix.
blog · 0xpat.github.io
Malware development part 6 - advanced obfuscation with LLVM and template metaprogramming
Malware development part 6: anti-disassembly obfuscation with Obfuscator-LLVM—how IR-level transforms and template metaprogramming hide control flow, plus the VS2017 build setup.
blog · blog.washi.dev
Addressing Common Misconceptions about .NET in the InfoSec World
Debunks widespread misconceptions about .NET in the infosec world — from '.NET is Windows-only' and 'bytecode is interpreted' to easy-decompilation myths — with practical reverse-engineering notes.
blog · blog.washi.dev
Recovering Metadata from .NET Native AOT Binaries
Explains how to reverse engineer .NET Native AOT binaries: what Native AOT is, how to recover metadata such as method tables and frozen objects, and a Ghidra plugin that automates it.
blog · blog.washi.dev
Solving BinaryShield VM Crackme by ra1n
A walkthrough of solving ra1n's BinaryShield crackme, featuring a custom virtual-machine obfuscation: building a disassembler, reversing opcode handlers, devirtualizing the code and solving it.
back