1.2 KiB
1.2 KiB
API Reference: Reverse Engineering .NET Malware
Overview
scripts/analyst.py parses a PE to detect the CLR runtime header (COM descriptor data directory
index 14) and the BSJB metadata-root signature, confirming whether a sample is managed. It
parses bytes only and never executes the sample.
Dependencies
| Package | Version | Purpose |
|---|---|---|
| (stdlib) | — | struct parsing, file IO |
External tools
| Tool | Purpose |
|---|---|
| ILSpy / dnSpyEx | Decompile MSIL to C#; managed debugging |
| de4dot | Static deobfuscation of known protectors |
Core functions
identify(path)
Returns whether the sample is managed, whether the BSJB metadata signature is present, and
diagnostic notes (mscoree/_CorExeMain references).
Usage
python scripts/analyst.py identify sample.exe
Sources
- ECMA-335 Common Language Infrastructure (CIL/MSIL metadata, BSJB root) — https://ecma-international.org/publications-and-standards/standards/ecma-335/
- PE COM descriptor data directory (index 14) — PE/COFF specification
- ILSpy decompiler — https://github.com/icsharpcode/ILSpy