binaryinject/unifree/dotnet-reverse-engineering

# Check if it's a .NET assembly
[System.Reflection.Assembly]::LoadFile("<path_to_exe>").GetTypes() | Select-Object -First 20 Name, Namespace
 
# List embedded resources
$asm = [System.Reflection.Assembly]::LoadFile("<path>")
$asm.GetManifestResourceNames()
 
# Check for obfuscation indicators
$types = $asm.GetTypes()
$types | Where-Object { $_.Name -match '^[A-Z]{1,2}$' -or $_.Name -match '^\d+$' }

# Use de4dot to clean obfuscated assemblies
de4dot.exe <input.exe> -o <output_cleaned.exe>
 
# Verify the cleaned output loads correctly
[System.Reflection.Assembly]::LoadFile("<output_cleaned.exe>").GetTypes()

ilspycmd <exe_path> -o <output_dir>
 
# If ilspycmd fails on obfuscated code, try de4dot output first
ilspycmd <de4dot_output.exe> -o <decompiled_dir>

# Search for RSA-related strings in decompiled code
Get-ChildItem "<decompiled_dir>" -Recurse -Filter "*.cs" | Select-String -Pattern "RSA|FromXml|SigningKey|PrivateKey|Modulus|Exponent"
 
# Extract embedded RSA keys from resources
$asm = [System.Reflection.Assembly]::LoadFile("<exe_path>")
$resourceStream = $asm.GetManifestResourceStream("<resource_name>")
$bytes = New-Object byte[] $resourceStream.Length
$resourceStream.Read($bytes, 0, $bytes.Length)
[System.IO.File]::WriteAllBytes("<output.bin>", $bytes)

# Use .NET Framework csc.exe for maximum compatibility
$env:PATH = "C:\Windows\Microsoft.NET\Framework64\v4.0.30319;$env:PATH"
csc.exe /out:<output.exe> <source.cs>
 
# Or use dotnet SDK for modern .NET targets
dotnet build