40 lines
1.2 KiB
Markdown
40 lines
1.2 KiB
Markdown
# API Reference: Reverse Engineering .NET Malware
|
|
|
|
## Overview
|
|
|
|
`scripts/analyst.py` parses a PE to detect the CLR runtime header (COM descriptor data directory
|
|
index 14) and the `BSJB` metadata-root signature, confirming whether a sample is managed. It
|
|
parses bytes only and never executes the sample.
|
|
|
|
## Dependencies
|
|
|
|
| Package | Version | Purpose |
|
|
|---------|---------|---------|
|
|
| (stdlib) | — | struct parsing, file IO |
|
|
|
|
## External tools
|
|
|
|
| Tool | Purpose |
|
|
|------|---------|
|
|
| ILSpy / dnSpyEx | Decompile MSIL to C#; managed debugging |
|
|
| de4dot | Static deobfuscation of known protectors |
|
|
|
|
## Core functions
|
|
|
|
### `identify(path)`
|
|
Returns whether the sample is managed, whether the `BSJB` metadata signature is present, and
|
|
diagnostic notes (mscoree/_CorExeMain references).
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
python scripts/analyst.py identify sample.exe
|
|
```
|
|
|
|
## Sources
|
|
|
|
- ECMA-335 Common Language Infrastructure (CIL/MSIL metadata, BSJB root) —
|
|
https://ecma-international.org/publications-and-standards/standards/ecma-335/
|
|
- PE COM descriptor data directory (index 14) — PE/COFF specification
|
|
- ILSpy decompiler — https://github.com/icsharpcode/ILSpy
|