zedseven

PostsComments

CC#

•Created by zedseven on 5/10/2025 in #help

Reasons why a DLL might decompile to have every function return `null`?

Yeah I've been wondering if the reason for the actual error is caused somehow by the obfuscation - since the entry point is an unmanaged executable, maybe something in the CLR is different and one of the obfuscation techniques fails

53 replies

CC#

•Created by zedseven on 5/10/2025 in #help

Reasons why a DLL might decompile to have every function return `null`?

A different tool (not sure if I should name it here) was successful though

53 replies

CC#

•Created by zedseven on 5/10/2025 in #help

Reasons why a DLL might decompile to have every function return `null`?

Yep, de4dot identified it but failed to deobfuscate

53 replies

CC#

•Created by zedseven on 5/10/2025 in #help

Reasons why a DLL might decompile to have every function return `null`?

So I guess mystery solved

53 replies

CC#

•Created by zedseven on 5/10/2025 in #help

Reasons why a DLL might decompile to have every function return `null`?

I was able to find a deobfuscator and it identified the DLL as obfuscated by that tool

53 replies

CC#

•Created by zedseven on 5/10/2025 in #help

Reasons why a DLL might decompile to have every function return `null`?

Was it by chance .NET Reactor?

53 replies

CC#

•Created by zedseven on 5/10/2025 in #help

Reasons why a DLL might decompile to have every function return `null`?

Since I'm not having much luck seeing inside the binary, has anyone seen a similar situation to what I described here, before?

53 replies

CC#

•Created by zedseven on 5/10/2025 in #help

Reasons why a DLL might decompile to have every function return `null`?

Thank you for your suggestions though

53 replies

CC#

•Created by zedseven on 5/10/2025 in #help

Reasons why a DLL might decompile to have every function return `null`?

I agree lol

53 replies

CC#

•Created by zedseven on 5/10/2025 in #help

Reasons why a DLL might decompile to have every function return `null`?

It's named the same as what I expect, and in the modules window I can see there's only one DLL loaded with that name, and the path matches where the file is

53 replies

CC#

•Created by zedseven on 5/10/2025 in #help

Reasons why a DLL might decompile to have every function return `null`?

I just checked, and it shows the current function in the call stack as being inside the same DLL as I've been trying to decompile

53 replies

CC#

•Created by zedseven on 5/10/2025 in #help

Reasons why a DLL might decompile to have every function return `null`?

Thank you all for your help, though - I appreciate it

53 replies

CC#

•Created by zedseven on 5/10/2025 in #help

Reasons why a DLL might decompile to have every function return `null`?

I don't see references to any of them :/

53 replies

CC#

•Created by zedseven on 5/10/2025 in #help

Reasons why a DLL might decompile to have every function return `null`?

If it was patching at runtime, I would see references to System.Reflection or a library that references it, correct?

53 replies

CC#

•Created by zedseven on 5/10/2025 in #help

Reasons why a DLL might decompile to have every function return `null`?

I don't think so - I checked and there is no other DLL packaged with the one I'm working with. VS' disassembly shows function and class names that only exist within the one I'm looking at, too

53 replies

CC#

•Created by zedseven on 5/10/2025 in #help

Reasons why a DLL might decompile to have every function return `null`?

but for sure there is real code inside it - not just a bunch of return null;

53 replies

CC#

•Created by zedseven on 5/10/2025 in #help

Reasons why a DLL might decompile to have every function return `null`?

Something within the DLL doesn't like when it's called from an unmanaged entrypoint

53 replies

CC#

•Created by zedseven on 5/10/2025 in #help

Reasons why a DLL might decompile to have every function return `null`?

The actual issue I'm trying to figure out through decompilation is as follows: When a function in this DLL is called using a managed Visual C++ executable, it works. When I call that function from an unmanaged C++ executable, using a C++/CLI bridge, it returns an error (a string error message created by the DLL, not a crash or exception)

53 replies

CC#

•Created by zedseven on 5/10/2025 in #help

Reasons why a DLL might decompile to have every function return `null`?

I'm certain that it isn't - when I debug it, VS' disassembly window shows real IL code

53 replies

CC#

•Created by zedseven on 5/10/2025 in #help

Reasons why a DLL might decompile to have every function return `null`?

and I can see some functions have real code

53 replies