.NET malware analysis

As you may know, .NET applications are easy to disassemble and decompile so that they are as close to the original source code as possible. This leaves malware more exposed to reverse engineering. There are multiple obfuscation techniques that we will describe in this section, as well as the deobfuscation process. First, let's explore the available tools for .NET reverse engineering.

.NET analysis tools

Here are the most well-known tools for decompiling and analysis:

• ILSpy: This is a good decompiler for static analysis, but it doesn't have the ability to debug the malware.
• Dnspy: Based on ILSpy and dnlib, it's a decompiler that allows you to debug and patch the code.
• .NET reflector:&...