Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Confusing .NET Decompilers: The CallVirt OpCode

blog.washi.dev | blog | #reverse-engineering | #decompiler | #dotnet | #cil | #callvirt | #virtual-dispatch

Summary

Part two of a series abusing CIL invocation opcodes: explains callvirt's virtual dispatch internals and uses CLR implementation quirks to call supposedly inaccessible methods, confusing decompilers.
Published
Collected

original ↗

Related coverage

blog · blog.washi.dev
Confusing .NET Decompilers: The Call OpCode
Shows how clever use of the ordinary CIL call opcode, bypassing normal callvirt conventions, can produce confusing code that fools decompilers, reflection and reverse engineers.
blog · netspi.com
Binrev- Automate Reversing Windows Binaries for Pentesters
Binrev chains common tools to automate reversing of Windows .NET, native, and Java binaries using de4dot, JustDecompile, procyon and more, aiding static code review and hardcoded secret hunting.
blog · netspi.com
Introduction to Hacking Thick Clients: Part 4 – The Assemblies
Covers assembly protections like ASLR, DEP, SafeSEH, and Authenticode signing, shows how PESecurity flags unsigned binaries, and explains decompiling .NET assemblies to review code.
blog · blog.washi.dev
CILFI: Automatic Function Identification in .NET Binaries
Washi presents CILFI, a pattern-matching engine and custom language for identifying functions like string decryptors and C2 initializers in .NET binaries, replacing fragile hand-written matching code.
blog · blog.washi.dev
Addressing Common Misconceptions about .NET in the InfoSec World
Debunks widespread misconceptions about .NET in the infosec world — from '.NET is Windows-only' and 'bytecode is interpreted' to easy-decompilation myths — with practical reverse-engineering notes.
blog · blog.washi.dev
Recovering Metadata from .NET Native AOT Binaries
Explains how to reverse engineer .NET Native AOT binaries: what Native AOT is, how to recover metadata such as method tables and frozen objects, and a Ghidra plugin that automates it.
back