Convert .EXE to Source Code!

• Educational Purposes Only •

[ebolaman_]

0:00 intro
0:13 storytime
1:18 important to learn this
1:47 setting up
2:26 decompiling
3:14 breaking down code
5:23 used on me
6:07 how it works
7:35 outro

[neos_hackerspace]

Most malware is written in C/C++ reverse engineering the assembly back is much harder than a simple .NET MSIL executable…
That’s why writing malware in interpreted languages makes them weak
So this is not that useful to be honest

[luuu_na]

I totally have zero experiences about this, but it's cool to know!
Thanks for the amazing video!

[occultsupport]

you never fail to spread our cheeks and fill us with your goodness 😊

[arflopped]

Notes:
3:07 for Forms/WPF apps, yes it does start in the Program class, but I rather suggest looking in the MainForm class as most of the code is located in there
5:00 don't recommend obfuscating! There's a much easier way to ensure that people attempting to reverse engineer your code go through a lot of pain: compiling it into native code. Nick Chapsas has an excellent video on that topic

[justind]

also if the program is written not in C# but in C for example its much much harder to reverse engineer also there are tools that obfuscate those C# assemblies

[johnd.]

this literary need 0 RE skills. Default c# compiled files are too easy to decompiled perfectly. You not have to do anything. RE skills need when the executable is compiled with c/c++ for example, where you cannot see function and variable names, compiler optimaze (eg: convert 2 or more functions to 1) and so many times decompilers fail to analyze specific parts or they decompile them wrong and ofc a big challenge is when excutable is protected/packed/obfuscated or virtualized

[Emorejets]

It's really impressive the things you teach. I was wondering, how did you go about learning all of this?

[UnrealSecurity]

dnSpy can only decompile .NET executables. It's also wrong to say it gets the original source code because it doesn't necessarily. Addtionally, the managed entrypoint method doesn't have to be named Main inside a class named Program.

A lot of unmanaged and managed code can execute before reaching the managed entrypoint.

1. Unmanaged entrypoint (for .NET executables you usually have a single call to _CorExeMain here that kicks off the execution of a .NET program)
2. Managed (.NET) module constructor
3. Static constructor of the class containing the managed entrypoint method
4. Managed entrypoint

[krajeq]

Thank you for your videos, they are very interesting, keep them like that ❤

[GorillaTaggingKid_YT]

One weird thing I've seen with C# is if you make a private async void in visual studio, compile it, then open the source code using DnSpy. The stuff inside the void/function looks odd, it almost looks like it obf itself. If you dont know what I'm talking about try the steps I said above, and if you could please tell me why it does that. Thanks (:

[kamoliddintrade]

Your content is very informative. Better than all other youtubers I have seen so far

[ZlobnyjKaban]

thanks, that was a useful one. absolutely need more videos about reverse engineering, maybe different methods and tools

[isaacsong-soum]

wow your vids are really interesting are informative keep it up

[boogaplays]

Can you make a video on "how games get hacked"

[grnm]

It's important to note that this is for .NET only. Pretty cool to start, but not very useful for reverse engineering, most malware and secured applications are written in C++ or C. For these languages you need to learn assembly and work with IDA or x64dbg. :)

[mr.atomictitan]

There is also a tool called ghidra that was developed by the NSA. Not as clean cut as what home boy has for dnspy but it can decompile almost any source code.

[camerongamer]

THANK YOU, VERY MUCH! edit: i literally inspect malware with notepad by searching for "crypto", "discord", or "token"

[trexioasx]

Remember guys, this is ONLY for c#. this isnt considered as reverse engineering just deompiling. You cant decompile to easy readable code for C++ .exe/.dll files. To "decompile" c++ applications/libraries you will need to do reverse engineering.

[OWLyS]

Compiling this using AOT Native will probably make it much harder to reverse it