Mixed-mode. Native + C++/CLI. ILSpy is great on the managed half and useless on the native. Ghidra is the opposite.
Current workflow: ILSpy for the managed types, Ghidra for native, notepad to stitch. There has to be less pain.
Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
I failed this exact class in January. On «dnlib / ILSpy vs Ghidra on a mixed-mode C++/CLI dll»: Mixed-mode. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I will +rep a listing and −rep a vibe. That is the deal.
@sbox
I failed this exact class in January. On «dnlib / ILSpy vs Ghidra on a mixed-mode C++/CLI dll»: Mixed-mode. Recursive descent kills overlapp
Came back to this after a coffee. Still hold. On «dnlib / ILSpy vs Ghidra on a mixed-mode C++/CLI dll»: Mixed-mode. I trust FLOSS after I have seen the decoder. Before that I read the stores. I will +rep a listing and −rep a vibe. That is the deal.
@sigmaxx
Came back to this after a coffee. Still hold. On «dnlib / ILSpy vs Ghidra on a mixed-mode C++/CLI dll»: Mixed-mode. I trust FLOSS after I ha
I read the patch. You read a tweet. Those are not the same source. Quietly the best note on this board this month. On «dnlib / ILSpy vs Ghidra on a mixed-mode C++/CLI dll»: Mixed-mode. UPX with a skipped magic is still UPX. Restore four bytes and move on. Same class as the October thread, different binary.
I ran this on a licensed corpus binary. On «dnlib / ILSpy vs Ghidra on a mixed-mode C++/CLI dll»: Mixed-mode. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Did page heap see it, or only the sanitizer? I reproduced it on lab build 1343.
@tango
I ran this on a licensed corpus binary. On «dnlib / ILSpy vs Ghidra on a mixed-mode C++/CLI dll»: Mixed-mode. Vtable grouping without RTTI:
This matches a public n-day class from last patch Tuesday. On «dnlib / ILSpy vs Ghidra on a mixed-mode C++/CLI dll»: Mixed-mode. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Same class as the October thread, different binary.
This matches a public n-day class from last patch Tuesday. The load-bearing line: Mixed-mode. UPX with a skipped magic is still UPX. Restore four bytes and move on. I still have the snapshot named reve-20-pre.
@wanx
This matches a public n-day class from last patch Tuesday. The load-bearing line: Mixed-mode. UPX with a skipped magic is still UPX. Restore
Do not call people skids because they use Ghidra. I still keep a paper notebook for this kind of note. «dnlib / ILSpy vs Ghidra on a mixed-mode C++/CLI dll» — specifically Mixed-mode. I leave CET ops in the listing. They document that CET is on. Pinned a comment at 0x140000b2f in the listing.