Hey i have done a few of decompiling in .net as i am learning c# so it helps me to see codes as it helps a lot. But lately i have come acrossed few program that i know are .net but in reflector show up as non .net assemblies. Here is the example of program named: Proxy Multiply.
I am not trying to do any illegal stuff or something. Just trying to learn. I have tried to google this but i was not able to achieve any good result. Thanks here is the link to image.
I have same problem with dot net reflector before, try JetBrains dotPeek version 1.0 Decompling(this application will show code that obfuscated)
- Decompiling .NET 1.0-4.5 assemblies to C#
- Support for .dll, .exe, .zip, .vsix, .nupkg, and .winmd files
- Quick jump to a type, assembly, symbol, or type member
- Effortless navigation to symbol declarations,
- implementations, derived and base symbols, and more
- Accurate search for symbol usages
- with advanced presentation of search results
- Overview of inheritance chains
- Support for downloading code from source servers
- Syntax highlighting
- Complete keyboard support
- dotPeek is free!
There are many .Net code protection alternative, that obfuscate the IL codes so that they are not that much exposed to IL disassembler application.
many of the protector modify the Exe (PE Header info), .Net exe contains some extra MetaData that helps disassembler to identify it.
Download this little application it may tell you a little more about the exe.
Download PEiD 0.95
PEiD is an intuitive application that relies on its user-friendly interface to detect packers, cryptors and compilers found in PE executable files – its detection rate is higher than that of other similar tools since the app packs more than 600 different signatures in PE files.
PEiD comes with three different scanning methods, each suitable for a distinct purpose. The Normal one scans the user-specified PE file at its Entry Point for all its included signatures. The so-called Deep Mode comes with increased detection ratio since it scans the file's Entry Point containing section, whereas the Hardcore mode scans the entire file for all the documented signatures.
.Net Reactor or Themida
Just because it is .NET doesn't mean that you can just decompile it like that. They probably used ILMerge. That's not to say it's impossible but it will require more work.
See Is it possible to “decompile” a Windows .exe? Or at least view the Assembly?
