Reverse engineering mixed .NET/native code?

[jonwil]

Anyone got any tips for reverse engineering binaries with mixed .NET and native code in them?

I can reverse engineer the .NET part with .NET reflector but how can I reverse engineer the native part?

[DARKER]

> how can I reverse engineer the native part?

with Olly/IDA of course :-)

[jonwil]

How can I take a call in the .NET part to a native function (as viewed in .NET reflector) and then find the code for that native function with IDA?

[toro]

use this:
http://www.smidgeonsoft.prohosting.com/pebrowse-pro-interactive-debugger.html

i always use this debugger for obfuscated .net targets or mixed ones

[rcer]

Originally Posted by jonwil

How can I take a call in the .NET part to a native function (as viewed in .NET reflector) and then find the code for that native function with IDA?

I have a similar problem with a .NET executable which uses a .NET wrapper.dll to direct calls to a dll written in native code.

[dedificator]

You can parse .Net metadata segment in IDA. There is 'function' table with names, types and RVAs. That's all, what we need. Just create needed struct definitions in IDA. If you need only a few functions, use CFF explorer and look for interesting names (and their RVA). This worked for me very nice with BarTender software.

[GPcH]

how can I reverse engineer the native part?

My VB Decompiler supports mixed .NET assemblies. You can disassemble IL or Native Code in one program with addresses