Tips on reverse engineering mixed .NET/native binaries?

		Exetools > General > General Discussion
Tips on reverse engineering mixed .NET/native binaries?

Thread Tools

Display Modes

10-30-2019, 13:58

toro

VIP

Join Date: Aug 2004

Posts: 190

Rept. Given: 4

Rept. Rcvd 97 Times in 34 Posts

Thanks Given: 29

Thanks Rcvd at 161 Times in 52 Posts

in dnspy you can see RVA of native functions just above the function definition.
if program use calli- usually call a method of c++ class- you can find the constructor of class RVA first then continue in ida or your debugger.

The Following User Says Thank You to toro For This Useful Post:
niculaita (10-31-2019)

« Previous Thread | Next Thread »

Thread Tools
Show Printable Version Email this Page
Display Modes
Switch to Linear Mode Hybrid Mode Switch to Threaded Mode

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is Off HTML code is Off Forum Rules

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Help on Reverse engineering MFC binaries	dummys	General Discussion	3	12-13-2015 10:34
Reverse engineering mixed .NET/native code?	jonwil	General Discussion	6	04-06-2010 20:47

All times are GMT +8. The time now is 21:16.