Reversing Tools & Basic Methods
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!

Find vulnerabilities that matter most so you can fix them faster. Intruder tracks your attack surface, runs proactive threat scans, finds issues across your whole tech stack, from APIs to web apps and cloud systems. Try it for free today.
Software:
Online:
- Use https://webassembly.github.io/wabt/demo/wasm2wat/index.html to decompile from wasm (binary) to wat (clear text)
Software:
dotPeek is a decompiler that decompiles and examines multiple formats, including libraries (.dll), Windows metadata files (.winmd), and executables (.exe). Once decompiled, an assembly can be saved as a Visual Studio project (.csproj).
The merit here is that if a lost source code requires restoration from a legacy assembly, this action can save time. Further, dotPeek provides handy navigation throughout the decompiled code, making it one of the perfect tools for Xamarin algorithm analysis.
With a comprehensive add-in model and an API that extends the tool to suit your exact needs, .NET reflector saves time and simplifies development. Let's take a look at the plethora of reverse engineering services this tool provides:
- Provides an insight into how the data flows through a library or component
- Provides insight into the implementation and usage of .NET languages and frameworks
- Finds undocumented and unexposed functionality to get more out of the APIs and technologies used.
- Finds dependencies and different assemblies
- Tracks down the exact location of errors in your code, third-party components, and libraries.
- Debugs into the source of all the .NET code you work with.
​ILSpy plugin for Visual Studio Code: You can have it in any OS (you can install it directly from VSCode, no need to download the git. Click on Extensions and search ILSpy).
If you need to decompile, modify and recompile again you can use: https://github.com/0xd4d/dnSpy/releases (Right Click -> Modify Method to change something inside a function).
You cloud also try https://www.jetbrains.com/es-es/decompiler/​
In order to make DNSpy log some information in a file, you could use this .Net lines:
using System.IO;
path = "C:\\inetpub\\temp\\MyTest2.txt";
File.AppendAllText(path, "Password: " + password + "\n");
In order to debug code using DNSpy you need to:
First, change the Assembly attributes related to debugging:

From:
[assembly: Debuggable(DebuggableAttribute.DebuggingModes.IgnoreSymbolStoreSequencePoints)]
To:
[assembly: Debuggable(DebuggableAttribute.DebuggingModes.Default |
DebuggableAttribute.DebuggingModes.DisableOptimizations |
DebuggableAttribute.DebuggingModes.IgnoreSymbolStoreSequencePoints |
DebuggableAttribute.DebuggingModes.EnableEditAndContinue)]
And click on compile:

Then save the new file on File >> Save module...:

This is necessary because if you don't do this, at runtime several optimisations will be applied to the code and it could be possible that while debugging a break-point is never hit or some variables don't exist.
Then, if your .Net application is being run by IIS you can restart it with:
iisreset /noforce
Then, in order to start debugging you should close all the opened files and inside the Debug Tab select Attach to Process...:

Then select w3wp.exe to attach to the IIS server and click attach:

Now that we are debugging the process, it's time to stop it and load all the modules. First click on Debug >> Break All and then click on Debug >> Windows >> Modules:


Click any module on Modules and select Open All Modules:

Right click any module in Assembly Explorer and click Sort Assemblies:

- Load rundll32 (64bits in C:\Windows\System32\rundll32.exe and 32 bits in C:\Windows\SysWOW64\rundll32.exe)
- Select Windbg debugger
- Select "Suspend on library load/unload"

- Configure the parameters of the execution putting the path to the DLL and the function that you want to call:

Then, when you start debugging the execution will be stopped when each DLL is loaded, then, when rundll32 load your DLL the execution will be stopped.
But, how can you get to the code of the DLL that was lodaded? Using this method, I don't know how.
- Load rundll32 (64bits in C:\Windows\System32\rundll32.exe and 32 bits in C:\Windows\SysWOW64\rundll32.exe)
- Change the Command Line ( File --> Change Command Line ) and set the path of the dll and the function that you want to call, for example: "C:\Windows\SysWOW64\rundll32.exe" "Z:\shared\Cybercamp\rev2\\14.ridii_2.dll",DLLMain
- Change Options --> Settings and select "DLL Entry".
- Then start the execution, the debugger will stop at each dll main, at some point you will stop in the dll Entry of your dll. From there, just search for the points where you want to put a breakpoint.
Notice that when the execution is stopped by any reason in win64dbg you can see in which code you are looking in the top of the win64dbg window:

Then, looking to this ca see when the execution was stopped in the dll you want to debug.
​Cheat Engine is a useful program to find where important values are saved inside the memory of a running game and change them. More info in:
​Blobrunner will allocate the shellcode inside a space of memory, will indicate you the memory address were the shellcode was allocated and will stop the execution.
Then, you need to attach a debugger (Ida or x64dbg) to the process and put a breakpoint the indicated memory address and resume the execution. This way you will be debugging the shellcode.
The releases github page contains zips containing the compiled releases: https://github.com/OALabs/BlobRunner/releases/tag/v0.0.5
You can find a slightly modified version of Blobrunner in the following link. In order to compile it just create a C/C++ project in Visual Studio Code, copy and paste the code and build it.
​jmp2it is very similar to blobrunner. It will allocate the shellcode inside a space of memory, and start an eternal loop. You then need to attach the debugger to the process, play start wait 2-5 secs and press stop and you will find yourself inside the eternal loop. Jump to the next instruction of the eternal loop as it will be a call to the shellcode, and finally you will find yourself executing the shellcode.

​Cutter is the GUI of radare. Using cutter you can emulate the shellcode and inspect it dynamically.
Note that Cutter allows you to "Open File" and "Open Shellcode". In my case when I opened the shellcode as a file it decompiled it correctly, but when I opened it as a shellcode it didn't:

In order to start the emulation in the place you want to, set a bp there and apparently cutter will automatically start the emulation from there:


You can see the stack for example inside a hex dump:

You should try scdbg.
It will tell you things like which functions is the shellcode using and if the shellcode is decoding itself in memory.
scdbg.exe -f shellcode # Get info
scdbg.exe -f shellcode -r #show analysis report at end of run
scdbg.exe -f shellcode -i -r #enable interactive hooks (file and network) and show analysis report at end of run
scdbg.exe -f shellcode -d #Dump decoded shellcode
scdbg.exe -f shellcode /findsc #Find offset where starts
scdbg.exe -f shellcode /foff 0x0000004D #Start the executing in that offset
scDbg also counts with a graphical launcher where you can select the options you want and execute the shellcode

The Create Dump option will dump the final shellcode if any change is done to the shellcode dynamically in memory (useful to download the decoded shellcode). The start offset can be useful to start the shellcode at a specific offset. The Debug Shell option is useful to debug the shellcode using the scDbg terminal (however I find any of the options explained before better for this matter as you will be able to use Ida or x64dbg).
Upload you shellcode file as input and use the following receipt to decompile it: https://gchq.github.io/CyberChef/#recipe=To_Hex('Space',0)Disassemble_x86('32','Full%20x86%20architecture',16,0,true,true)​
This obfuscator modify all the instructions for
mov
(yeah, really cool). It also uses interruptions to change executions flows. For more information about how does it works: