Log in

View Full Version : .NET Internals and Native Compiling


Daniel Pistelli
May 25th, 2008, 11:20
http://ntcore.com/Files/netint_native.htm

Strictly speaking it means converting the MSIL code of a .NET assembly to native machine code and then removing the MSIL code from that assembly, making it impossible to decompile it in a straightforward way. The only existing tool to native compile .NET assemblies is the Salamander.NET linker which relies on native images to do its job. The "native images" (which in this article I called "Native Framework Deployment" technique is quite distant from .NET internals: one doesn't need a good knowledge of .NET internals to implement it. But, as the topic is, I might say, quite popular, I'm going to show to the reader how to write his Native Framework Deployment tool if he wishes to. However, the article will go further than that by introducing Native Injection, which means nothing else than taking the JIT's place. Even though this is not useful for commercial protections (or whatever), it's a good way to play with JIT internals. I'm also going to introduce Native Decompiling, which is the result of an understanding of .NET internals. I'm also trying to address another topic: .NET Virtual Machine Protections.

I hope you'll enjoy this.

P.S. As always, if you notice typos, please report them.

evilcry
May 25th, 2008, 11:53
Another work conducted with Surgical Precision, great work Daniel

The way of .NET taming has started, hope to see new great ideas that could come out from the paper!

Regards,
Evilcry

rendari
May 25th, 2008, 12:01
Finally. Now only to find some time to read it GJ!

Daniel Pistelli
May 25th, 2008, 12:43
Thanks evil! Yes, well I'm curious if the framework's next version will address the problem.

rendari: take your time. The article seems longer than it is.

GEEK
May 26th, 2008, 07:23
Excellent work again Daniel
Keep up the good work

Daniel Pistelli
May 26th, 2008, 08:01
Thanks GEEK. Well maybe this article is less interesting since it handles less common cases than the first article. But who knows, maybe it'll turn more useful in a year or so. I don't really know. I prefer this article to the first one, but it could be that in a practical sense it is less interesting.

I'm just glad that I'm through with all this .NET stuff.

soft123123
May 26th, 2008, 08:53
the best article about .NET internals i'v ever read. thanks very much Daniel.

hope this series can go on, topic is endless.

and hope the new verion CFF, which support .rebel file, can come out soon.

Daniel Pistelli
May 26th, 2008, 09:09
Thanks soft123123. Well, actually the protections talk is ended as there are no other protections. There was one thing which I was still interested writing: an article about the garbage collector.

But I don't think that is urgent.

The new CFF will support 100% the rebel.net format and its manipulation. Problem is that the new CFF is going to be rewritten from scratch. So, maybe I'll release a first version of the new CFF Explorer just for the rebel.net format.

The rewriting of the CFF is necessary as I am stuck with the MFC classes and can't write a better gui with them.

Today, for instance, I'm trying to find images for the new toolbars. Very boring, but necessary..

dELTA
May 26th, 2008, 09:28
Ground-breaking high quality stuff as usual Daniel, you da man. And we're of course all looking forward to the upcoming CFF Explorer releases too.

Daniel Pistelli
May 28th, 2008, 05:42
Thanks dELTA! Well, if there are no other corrections, I'll send the article to codeproject...

deroko
June 28th, 2008, 16:01
very good!!! tnx to you Daniel I'll start playing with .NET

Daniel Pistelli
June 28th, 2008, 18:07
It's very good that talented reversers such as deroko start playing with .NET. And it's also good that others start to build on top of my work, because I am frankly tired of .NET stuff. The IT field is going through a period of transformations right now in my opinion and it's interesting to follow the stream and not just explore only one topic.

deroko: I'm glad you appreciated the article.

Daniel Pistelli
July 25th, 2008, 11:34
Quote:
Hi Daniel,
i'm really pleased to announce the release of a NetAsm on CodePlex (http://www.codeplex.com/netasm). This library enables to JIT inject native code into a .NET application.

I would like to thank you for your article on NET Internals and Native Compiling. NetAsm was inspired from your work and it wouldn’t have been possible without this brilliant article!

Alexandre


Seems a very nice project. Wanted to signal it here. I'm glad someone manages to build tools around this concept.

dELTA
July 25th, 2008, 20:55
Nice tool, thanks for the heads-up Daniel.

CRCETL:
http://www.woodmann.com/collaborative/tools/NetAsm