如何在C＃中反编译本机

Question

I was doing research on a program (executable). I decompiled the program using ILSpy. While I reviewed the source code, I discovered a function that looked like this:

/ <Module>
[SuppressUnmanagedCodeSecurity]
[MethodImpl(MethodImplOptions.Unmanaged | MethodImplOptions.PreserveSig)]    
internal unsafe static extern PointerObject* Function(sbyte*);

There was no implementation. How can I disassemble this?

Answer 1

A method with the extern keyword means that the implementation of that method is specified in some external file. You can read more about extern in the MSDN Docs . Normally you would see a DLLImportAttribute which would specify the name of the assembly that the method is implemented in.

MethodImpOptions.Unmanaged implies that the call is being made to unmanaged code (C, C++, etc) and MethodImpOptions.PreserveSig means that the method being called has the exact same method signature.

Beyond that, I can't tell you much.

Answer 2

Since this is a native call, you need a native disassembler. There's plenty to choose from with wildly different level of output, but you'll most likely need a good understanding of x86 assembly and Windows programming to get anythig useful from the disassembly - it's nothing like disassembled C# code, for example.

The native code might be in a separate DLL, or in a native module in the same assembly - you'll need to check where that extern definition is pointing.

Disclaimer: disassembly and/or using any knowledge obtained in this way may be illegal where you are; make sure you're aware of the applicable laws.