Confusing .NET Decompilers: The Call OpCode

Part two of a series abusing CIL invocation opcodes: explains callvirt's virtual dispatch internals and uses CLR implementation quirks to call supposedly inaccessible methods, confusing decompilers.

Binrev chains common tools to automate reversing of Windows .NET, native, and Java binaries using de4dot, JustDecompile, procyon and more, aiding static code review and hardcoded secret hunting.

A tour of the many entry points in a .NET module — from Main and static constructors to CLR and PE native entry points, TLS callbacks and DLL pre-injection — showing where user code really begins.

Covers assembly protections like ASLR, DEP, SafeSEH, and Authenticode signing, shows how PESecurity flags unsigned binaries, and explains decompiling .NET assemblies to review code.

Washi presents CILFI, a pattern-matching engine and custom language for identifying functions like string decryptors and C2 initializers in .NET binaries, replacing fragile hand-written matching code.

Debunks widespread misconceptions about .NET in the infosec world — from '.NET is Windows-only' and 'bytecode is interpreted' to easy-decompilation myths — with practical reverse-engineering notes.