#AsmResolver 6.0.0-beta.3 just got pushed to NuGet!

More bugs were found and squashed. We are closing in on a full release with most of the public API being stable.

Get it on GitHub or NuGet 👉 https://github.com/Washi1337/AsmResolver/releases/tag/v6.0.0-beta.3

#dotnet #pe #reversing

Release 6.0.0-beta.3 · Washi1337/AsmResolver

This is a maintenance release. AsmResolver is closing in on a main release with most of the public API being stable. However, similar to 6.0.0-beta.2, this is still a pre-release and some of the pu...

GitHub

#AsmResolver 6.0.0-beta.2 has been released

This is a maintenance release that addresses many regressions introduced by the refactors in 6.0.0-beta.1.

Get it on NuGet or GitHub
👉 https://github.com/Washi1337/AsmResolver/releases/tag/v6.0.0-beta.2

Release 6.0.0-beta.2 · Washi1337/AsmResolver

This is a maintenance release that fixes some shortcomings and addresses various regressions introduced by the refactors in 6.0.0-beta.1. Similar to 6.0.0-beta.1, this is an unstable release and th...

GitHub

#AsmResolver 5.5.1 is out!

This is a maintenance release, adding #dotnet 8.0 targets and fixes issues related to type signatures, CIL optimizations, as well as some rare edge cases in .NET metadata directory parsing.

Get it on GitHub/NuGet:
👉 https://github.com/Washi1337/AsmResolver/releases/tag/v5.5.1

Release 5.5.1 · Washi1337/AsmResolver

This is an incremental maintenance release that adds .NET 8.0 as an official target and fixes issues related to type signatures, CIL optimizations, as well as some rare edge cases in .NET metadata ...

GitHub

Another day, another #AsmResolver version bump: 5.4.0 is out now.

This release includes support for #PE certificate tables, PE forwarder exports, more quality of life improvements and more bug fixes.

👉 https://github.com/Washi1337/AsmResolver/releases/tag/v5.4.0

#reversing

Release 5.4.0 · Washi1337/AsmResolver

This release includes support for PE certificate tables, PE forwarder exports, as well as various quality of life improvements and bug fixes. Check out the documentation and the full change-log bel...

GitHub

I spent my Saturday on a dumb project answering the following question:

What is the smallest #dotnet Hello World binary?

Turns out, this rabbit hole is deeper than you may expect, so I wrote a blog post about it:
👉 https://blog.washi.dev/posts/tinysharp/

#reversing #obfuscation #asmresolver

How small is the smallest .NET Hello World binary?

Here is a dumb question that you probably never asked yourself: What is the minimal amount of bytes we need to store in a .NET executable to have the CLR print the string"Hello, World!" to the standard output?

Washi

#AsmResolver 5.3.0 is out!

More performance and #pe reader bugfixes, new docs, and we also made it easier to ignore errors when writing #dotnet modules.

Changelog and download links:
👉 https://github.com/Washi1337/AsmResolver/releases/tag/v5.3.0

#malware #reversing

Release 5.3.0 · Washi1337/AsmResolver

This version is mostly a maintenance version with performance improvements and bug fixes. Developers of .NET obfsucators and deobfuscators will also be happy to know that ManagedPEImageBuilder now ...

GitHub

#AsmResolver 5.2.0 is out now.

This version includes read support for many more #PDB symbols, #dotnet AppHost patching, .NET TypeSignature::IsAssignableTo(type), QoL improvements and bug fixes.

👉 Full changelog and download links:
https://github.com/Washi1337/AsmResolver/releases/tag/v5.2.0

#reversing #malware

Release 5.2.0 · Washi1337/AsmResolver

New Features Add TypeSignature::IsCompatibleWith and TypeSignature::IsAssignableTo methods (#421) Add support for patching AppHost / SingleFileHost files without requiring the original SDK templat...

GitHub

I thought it was time to show off some of #AsmResolver's new #native #PE #patching API. In this blog, we discuss how to programmatically inject code into an arbitrary PE, and learn how to construct new import directories as we go.

Full post: https://washi.dev/blog/posts/import-patching/

#reversing

Injecting Code using Imported Functions into Native PE Files

Patching PE files is easy. Injecting new code that uses functions from external modules, however, is more complicated. In this post, we are implementing a method for rebuilding import directories, such that we can inject any type of code in an arbitrary PE file.

Washi

#AsmResolver 5.1.0 just got released!

This version brings support for C#11 generic custom attributes as well as a fluent binary #patching API for both #dotnet and native #PE files. We are slowly making native PE reconstruction a lot easier!

https://github.com/Washi1337/AsmResolver/releases/tag/v5.1.0

#reversing

Release 5.1.0 · Washi1337/AsmResolver

New Features Add fluent patching API, allowing for easy and quick binary patches on PE files as well as individual segments (#403, #405). Check out the documentation. Add option to preserve spurio...

GitHub

Time for another blog post!

This time we are tackling .NET debuggers and make them display garbage data with the help of proxy objects and debugger display attributes.

Full post: https://washi.dev/blog/posts/debugger-proxy-objects/
PoC Implementation: https://github.com/Washi1337/ProxyObjects

#dotnet #obfuscation #reversing #asmresolver #cil #dnspy #decompiler #debugger #poc

Confusing .NET Debuggers: Proxy Objects

.NET decompilers and debuggers have become very good at helping reverse engineers figure out the inner workings of a program. However, they also make a lot of assumptions that can be used against them. In this post, we will explore a method that can be used to trick the debugger into hiding a lot of important information during a debugging session.

Washi