Exetools  

Go Back   Exetools > General > Community Tools

Notices

Reply
 
Thread Tools Display Modes
  #91  
Old 06-18-2021, 18:22
DARKER DARKER is offline
VIP
 
Join Date: Jul 2004
Location: Côte d'Ivoire
Posts: 374
Rept. Given: 14
Rept. Rcvd 110 Times in 45 Posts
Thanks Given: 8
Thanks Rcvd at 461 Times in 127 Posts
DARKER Reputation: 100-199 DARKER Reputation: 100-199
dnSpy v6.1.9, released 2021-06-14

As you know official repository is archived by the owner (read-only state):
Code:
https://github.com/dnSpy/dnSpy
There is new continue - dnSpyEx based on original source:

Changelog:
  • Several updates to NRefactory resulting in cleaner output code for the C# language
  • Improved the IL disassembler/decompiler. More information is now displayed.
  • Improved BAML decompiler with latest changes from ILSpy repository.
  • Updated ICSharpCode.TreeView to the latest version
  • Dragging tree view items near the top and bottom will scroll the tree view
  • Improved assembly resolution for .NET Core and .NET 5
  • Improved asynchronous method decompilation

Download and more info:
Code:
https://github.com/dnSpyEx/dnSpy/releases
Reply With Quote
The Following 13 Users Say Thank You to DARKER For This Useful Post:
Doit (02-18-2022), Mahmoudnia (06-25-2021), niculaita (08-09-2021), schrodyn (10-04-2021), sh3dow (06-22-2021), Stingered (06-18-2021), Teerayoot (07-16-2021), TheDutchJewel (09-12-2021), tonyweb (06-18-2021), uranus64 (06-19-2021), user1 (11-04-2021), WRP (06-19-2021), YuqseLx (10-03-2021)
  #92  
Old 11-03-2021, 15:36
Kurapica's Avatar
Kurapica Kurapica is offline
VIP
 
Join Date: Jun 2009
Location: Archives
Posts: 177
Rept. Given: 20
Rept. Rcvd 140 Times in 39 Posts
Thanks Given: 47
Thanks Rcvd at 338 Times in 70 Posts
Kurapica Reputation: 100-199 Kurapica Reputation: 100-199
anybody srill has the Unity Mono dlls ?

unity-debugging-2019.x.zip
unity-debugging-2018.x.zip

looks like they were all removed from the website.
Reply With Quote
  #93  
Old 11-03-2021, 16:30
atom0s's Avatar
atom0s atom0s is offline
Family
 
Join Date: Jan 2015
Location: 127.0.0.1
Posts: 367
Rept. Given: 26
Rept. Rcvd 114 Times in 58 Posts
Thanks Given: 54
Thanks Rcvd at 648 Times in 253 Posts
atom0s Reputation: 100-199 atom0s Reputation: 100-199
The source repos are still available:

Original: https://github.com/dnSpy/dnSpy-Unity-mono
dnSpyEx : https://github.com/dnSpyEx/dnSpy-Unity-mono

Some custom builds others have posted:

- https://github.com/wh0am15533/Patched-Unity-Mono/tree/main/CustomBuilds
- https://github.com/liesauer/Unity-debugging-dlls/releases
__________________
Personal Projects Site: https://atom0s.com
Reply With Quote
The Following User Gave Reputation+1 to atom0s For This Useful Post:
Kurapica (11-03-2021)
The Following 2 Users Say Thank You to atom0s For This Useful Post:
b30wulf (11-03-2021), user1 (11-04-2021)
  #94  
Old 11-03-2021, 17:41
Kurapica's Avatar
Kurapica Kurapica is offline
VIP
 
Join Date: Jun 2009
Location: Archives
Posts: 177
Rept. Given: 20
Rept. Rcvd 140 Times in 39 Posts
Thanks Given: 47
Thanks Rcvd at 338 Times in 70 Posts
Kurapica Reputation: 100-199 Kurapica Reputation: 100-199
Thanks man, really helpful.
Reply With Quote
The Following 2 Users Say Thank You to Kurapica For This Useful Post:
ahmadmansoor (01-30-2022), user1 (11-04-2021)
  #95  
Old 11-04-2021, 00:16
klvgen klvgen is offline
Friend
 
Join Date: Feb 2017
Posts: 21
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 5
Thanks Rcvd at 3 Times in 3 Posts
klvgen Reputation: 0
Sweet to see it active again, no idea why original dnSpy was archived? Apparently author's twitter got blocked too.
Reply With Quote
  #96  
Old 01-07-2022, 05:44
val2032 val2032 is offline
Friend
 
Join Date: Apr 2010
Posts: 44
Rept. Given: 26
Rept. Rcvd 2 Times in 2 Posts
Thanks Given: 90
Thanks Rcvd at 29 Times in 16 Posts
val2032 Reputation: 2
Exclamation

Pay attention to the web address below

Code:
hxxps://www.dnspy.net
Don't run the releases from this page!

The file dnspy.dll is modified and it contains MSHTA.exe exploit. It creates many entries in Task Scheduler (see Microsoft/Windows/Directx)! It will stop Windows Defender and will try to download and run exe files from 4api(dot)net (possible crypto miners).

Kaspersky reports dnspy.net as safe website !
Reply With Quote
The Following User Gave Reputation+1 to val2032 For This Useful Post:
user1 (01-07-2022)
The Following 7 Users Say Thank You to val2032 For This Useful Post:
CrackDJ (02-16-2022), darkBLACK (01-14-2022), Fyyre (02-18-2022), Stingered (01-07-2022), tonyweb (01-09-2022), user1 (01-07-2022), wilson bibe (01-07-2022)
  #97  
Old 01-09-2022, 07:53
val2032 val2032 is offline
Friend
 
Join Date: Apr 2010
Posts: 44
Rept. Given: 26
Rept. Rcvd 2 Times in 2 Posts
Thanks Given: 90
Thanks Rcvd at 29 Times in 16 Posts
val2032 Reputation: 2
I supose he is the same person who modified IDA...

I just found the article below:
Code:
hxxps://www.bleepingcomputer.com/news/security/trojanized-dnspy-app-drops-malware-cocktail-on-researchers-devs/amp/
Reply With Quote
The Following User Says Thank You to val2032 For This Useful Post:
CRC32 (01-09-2022)
  #98  
Old 02-16-2022, 06:03
CrackDJ CrackDJ is offline
Friend
 
Join Date: May 2010
Posts: 75
Rept. Given: 42
Rept. Rcvd 28 Times in 16 Posts
Thanks Given: 20
Thanks Rcvd at 13 Times in 10 Posts
CrackDJ Reputation: 28
This is the best tool for .net reversing in my opnion, thank you guys!
Reply With Quote
The Following User Says Thank You to CrackDJ For This Useful Post:
zionoobie (02-18-2022)
  #99  
Old 02-18-2022, 19:09
zionoobie zionoobie is offline
Friend
 
Join Date: Jan 2019
Posts: 3
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 35
Thanks Rcvd at 3 Times in 1 Post
zionoobie Reputation: 0
Quote:
Originally Posted by CrackDJ View Post
This is the best tool for .net reversing in my opnion, thank you guys!
The same for me
Reply With Quote
  #100  
Old 03-27-2022, 14:20
foosaa foosaa is offline
Friend
 
Join Date: Dec 2005
Posts: 91
Rept. Given: 34
Rept. Rcvd 11 Times in 9 Posts
Thanks Given: 141
Thanks Rcvd at 73 Times in 28 Posts
foosaa Reputation: 11
It is really sad to see that dnSpy and De4Dot programs have been archived and unmaintained for years.

They are slowly starting to struggle with the newer protections and dnspy still works because of the core reflection methodology, but de4dot has not be updated for 10+ years.

Wish I had more time to update it to support most widely available .NET obfuscators.

I have a couple of questions.

If I can get some answers, it will be helpful to build something around that for updating de4dot application.

Please list the most commonly used .NET obfuscators. Recently I'm encountering some heavily obfuscated .NET assemblies and it is taking a lot of time to understand the flow.

I'm not looking at cracking or patching or keygenning, but I'm trying to understand certain implementation to uncover security issues in such packed applications.

Because of the protections and obfuscation, it is taking a lot of time to uncover the flow and identify the control branching and variables.

Please list the most commonly used .NET assembly obfuscators (which mostly work after the release / debug compilation and directly on .DLL and .EXE files).

Thank you so much.
Reply With Quote
  #101  
Old 03-28-2022, 08:46
atom0s's Avatar
atom0s atom0s is offline
Family
 
Join Date: Jan 2015
Location: 127.0.0.1
Posts: 367
Rept. Given: 26
Rept. Rcvd 114 Times in 58 Posts
Thanks Given: 54
Thanks Rcvd at 648 Times in 253 Posts
atom0s Reputation: 100-199 atom0s Reputation: 100-199
dnSpy is still continued by community members here:
Code:
https://github.com/dnSpyEx
I'd recommend checking out ILSpy as well now, it has been heavily updated since dnSpy came into existence. ILSpy's decompiler is, in my opinion, much better than dnSpy's currently as well. (dnSpy still has other features ILSpy doesn't have like a debugger etc. though.)
__________________
Personal Projects Site: https://atom0s.com
Reply With Quote
The Following 2 Users Say Thank You to atom0s For This Useful Post:
foosaa (03-28-2022), niculaita (06-16-2022)
  #102  
Old 03-28-2022, 09:43
atom0s's Avatar
atom0s atom0s is offline
Family
 
Join Date: Jan 2015
Location: 127.0.0.1
Posts: 367
Rept. Given: 26
Rept. Rcvd 114 Times in 58 Posts
Thanks Given: 54
Thanks Rcvd at 648 Times in 253 Posts
atom0s Reputation: 100-199 atom0s Reputation: 100-199
Quote:
Please list the most commonly used .NET obfuscators. Recently I'm encountering some heavily obfuscated .NET assemblies and it is taking a lot of time to understand the flow.
There's a fairly large list of them here: https://github.com/NotPrab/.NET-Obfuscator

There's a ton of custom forks of Confuser/ConfuserEx that have different names too, but most of the newer tools are all based on ConfuserEx for the most part.
Some others can be found via Google easily too.
__________________
Personal Projects Site: https://atom0s.com
Reply With Quote
The Following 2 Users Say Thank You to atom0s For This Useful Post:
foosaa (03-28-2022), niculaita (03-28-2022)
  #103  
Old 04-02-2022, 02:03
sendersu sendersu is offline
VIP
 
Join Date: Oct 2010
Posts: 868
Rept. Given: 325
Rept. Rcvd 217 Times in 111 Posts
Thanks Given: 170
Thanks Rcvd at 377 Times in 212 Posts
sendersu Reputation: 200-299 sendersu Reputation: 200-299 sendersu Reputation: 200-299
Quote:
Originally Posted by atom0s View Post
dnSpy is still continued by community members here:
Code:
https://github.com/dnSpyEx
I'd recommend checking out ILSpy as well now, it has been heavily updated since dnSpy came into existence. ILSpy's decompiler is, in my opinion, much better than dnSpy's currently as well. (dnSpy still has other features ILSpy doesn't have like a debugger etc. though.)
dnSpy .net decompiler is based on VERY old ILSpy engine... it is worse by an order of magniute comparing to ILSpy v7/8.x

but dnSpy has the super unique feature - .net debugger...
which is also started to be bad showing "Internal debugger error" in local tabs...
Reply With Quote
The Following User Says Thank You to sendersu For This Useful Post:
niculaita (04-03-2022)
  #104  
Old 06-15-2022, 14:59
DARKER DARKER is offline
VIP
 
Join Date: Jul 2004
Location: Côte d'Ivoire
Posts: 374
Rept. Given: 14
Rept. Rcvd 110 Times in 45 Posts
Thanks Given: 8
Thanks Rcvd at 461 Times in 127 Posts
DARKER Reputation: 100-199 DARKER Reputation: 100-199
v6.2.0, released 2022-06-14

As of today, one full year has passed since the v6.1.9 release and I'm proud to announce that the v6.2.0 update is finally ready for release.

New features:
  • dnSpy now runs under .NET 6 and .NET Framework 4.8.
  • Move to VS2022 icons for UI and exe files (by @InKahootz and @SychicBoy)
  • Support for tilt/horizontal scrolling in the UI.
  • Added support for editing custom attributes on module resources.
  • Added support for modifying the Log2Rid value when saving the module.
  • Add support for ARM64 target architecture in the assembly editor.
  • Add an enum for PE Magic field in the PE editor (by @riQQ)
  • Show debugged process's name in the title bar (by @InKahootz)
  • Add support for writing VS2022 compatible .sln files.
  • Added back the Save Code, Save BAML, and Save XAML options in the File context menu which save the contents of the currently open document tab.
  • Debugger:
    • Display a warning message before starting to debug a target file with a different bitness than the current dnSpy version running.
    • Add a new option that allows to automatically break on <Module>::.cctor when starting to debug.
    • Display the exception's HResult property when an unhandled exception is hit.
  • ILSpy decompiler:
    • Added jump to reference support for jmp() expressions created when the jmp CIL opcode is present.
    • CIL disassembler now includes information about generic parameter attributes and constraints.
    • Add more information to the output when disassembling the module node when using the CIL disassembler.
    • The decompiler now splits up long method call chains using a new line.
    • Generate debug info for yield break; statements.

Improvements and bug fixes:

  • Fix the .NET 6 console executable having the incorrect subsystem set in the PE options resulting in a crash.
  • Fixed escaping of namespaces in tooltips.
  • Fixed syntax highlighting for structs in tooltips.
  • Improved RVA <-> FileOffset conversions in PE editor to fix a crash with invalid values being passed in.
  • Improved assembly resolution for .NET Standard, .NET Core, .NET 5, .NET 6.
  • dnSpy now reads assembly resolution probe paths from .config files.
  • Read probe paths from .config files when searching for satellite assemblies during project export.
  • Fixed incorrect label in the Save Module dialog.
  • Add support for searching by full name (by @mobile46).
  • Optimized search module by reducing memory allocations.
  • Improvements to GitHub Actions workflow (by @Gorialis).
  • Use .NET Standard instead of .NET Framework for Roslyn projects fixing #84 (by @mobile46).
  • ILSpy Decompiler
    • Optimized the variable naming step in the decompiler by reducing memory allocations.
    • Improved insertion of checked() blocks.
    • Improved decompilation of query expressions.
    • Prevent delegate construction decompilation from crashing the entire decompiler if it failed.
    • Improved analysis for unsafe modifier.
    • Ignore invalid prefixes when constructing the ILAst. This prevents a common method used to crash the decompiler from working.
    • Many improvements and fixes to the async method decompilation logic.
    • Optimized the removal of dead nop instructions when building the ILAst. This deficiency was a known method to crash dnSpy's decompiler by filling a method body with huge amounts of useless code.
    • Fixed a rare case where field initializers would not be detected properly.
    • Fixed a rarely occurring bug that resulted in incorrect ILAst being built.
    • Optimized construction of ILAst by calculating the stack behavior of instruction only once and by caching the result of MethodDef.HasReturnType.
    • Improved required parenthesis analysis.
    • Fixed decompiler creating incorrect checked regions for some post increments.
  • Debugger:
    • Fixed a bug that caused the infamous ??? exception to occur when debugging.
    • Improved debugging support for newer mono runtimes.
    • Fixed a crash that occurred in the .NET Framework version of dnSpy when a module loaded into memory during debugging would contain an invalid file path resulting in a crash.
  • BAML decompiler
    • Resolve namespaces of properties.
    • Fix Name attribute for properties incorrect in rare circumstances.
    • Fix missing x:Static and x:Type (by @wwh1004)
Dependency updates:
  • Updated dnlib to 3.5.0
  • Updated Iced to 1.17.0
  • Roslyn compiler to 4.1.0
  • Ookii.Dialogs.Wpf to 5.0.1
  • VS MEF to 16.9.20
  • ILSpy to 2.4
  • Mono.Debugger.Soft was updated to the latest commit.

Note to extension developers: Please recompile your extensions for this version of dnSpyEx! Many dependencies have been updated and some of them have gone through API changes, for example, Iced.

Download and more info:
Code:
https://github.com/dnSpyEx/dnSpy/releases/tag/v6.2.0

Last edited by DARKER; 06-15-2022 at 15:05.
Reply With Quote
The Following 14 Users Say Thank You to DARKER For This Useful Post:
ahmadmansoor (06-19-2022), darkBLACK (06-21-2022), Doit (06-25-2022), ionioni (06-16-2022), niculaita (06-16-2022), pps44 (06-27-2022), tonyweb (06-21-2022), TQN (06-16-2022), uranus64 (06-15-2022), user_hidden (06-16-2022), val2032 (07-01-2022), wilson bibe (06-15-2022), WRP (06-15-2022), Zeokat (06-18-2022)
Reply

Tags
0xd4d, dnspy

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 04:10.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX
( 1998 - 2022 )