Home

Awesome

<img align="left" width="100" height="115" src="./img/vladimir.png" alt="vladimir"> &nbsp; &nbsp;

.NIET

Alt text

.NIET is an IDA Pro plugin. Its purpose is to import missing symbols (usually few thousands) which are resolved at runtime by .NET Native compiled binaries. These symbols lie in SharedLibrary.dll and are not exported by this one.

.NIET has been tested on IDA Pro 7.5 using python 3.8 on the following platforms:

This plugin currently supports the following .NET Native framework versions:

Please create an issue if you encounter another version.

Installation

Copy these elements to your IDA Pro plugin directory:

dotNIET_plugin.py
dotNIET\

Dependencies

.NIET relies on pefile in order to parse resources directories.

pefile can be installed as follows:

pip install pefile

Requirements

Because symbols are imported from SharedLibrary.dll, this one must be provided to .NIET along with its pdb (its location is searched by the plugin within _NT_SYMBOL_PATH).

Helpers are implemented to identify .NET Native framework versions and verifying that SharedLibrary.dll pdb exists within the configured symbols path.

Usage

Alt text

.NIET can be launched using shortcut Alt-Shift-N or through the Edit/Plugins menu.

Upon launch, the plugin tries to identify current binary .NET Native framework version. All you have to do is to select SharedLibrary.dll in the right version then click Run.

.NIET will identify target dll .NET Native framework version and prompt a message if versions are not the same. Major and Minor version numbers are usually the only ones that matter.

Functioning

.NIET looks for .NET Native custom import descriptors table within the .rdata section. To proceed so, it reads at specific offsets of a Custom Header structure then parses an ordinals array.

This ordinals array points to various locations within a SharedLibrary.dll's custom table entries.

Symbol resolution is achieved by launching an IDA Pro headless instance through its binary idat in order to parse SharedLibrary.dll pdb

Imported symbols naming convention

Symbols are imported as is if possible but some corner cases may be encountered:

Known limitations

Troubleshooting

idat logfile is defined to %tmpdir%/dotNIETlogs.txt

Why such a name

Because reversing .NET Native is a nightmare