Reversing - .NET main is not the first thing executed
Channel: MalwareAnalysisForHedgehogs
Date: 2023-10-07

The main() method in .NET applications is considered as the entry point. But it is not the first thing being executed, which is purposefully used to deter reverse engineers. We write Intermediate Language assembly code to find out what is actually executed before main() in a .NET assembly.

Malware Analysis Course: https://www.udemy.com/course/windows-malware-analysis-for-hedgehogs-beginner-training/?couponCode=02F3FAD5E2153D4D789E

Washis article: https://blog.washi.dev/posts/entry-points/

Follow me on Twitter: https://twitter.com/struppigel

00:00 Intro
00:19 Writing a Hello World in IL
02:43 Adding a static constructor
04:28 Adding a module constructor
05:24 ConfuserEx sample abusing module constructor
08:12 Washi - What really is the Entry Point of a .NET Module

#malware #malwareanalysis #reverseengineering #dotnet #main #cctor