NET PACKER TRICKS AND COUNTERMEASURES
Marcin Hartung · 2015
Nowadays, .NET samples are increasingly common, necessitating specialized techniques for processing and analysis, especially when obfuscation is used: .NET packers have many tricks up their sleeves, but fortunately we do too. A skilled researcher can often glance inside ‘good old-fashioned’ native executables and see what they do despite protection with strong packers. .NET fi les, however, are different. Analysing clean .NET fi les with dedicated tools shows us almost everything, but if the fi le is obfuscated we sometimes see nothing at all. In .NET analysis we face one main obstacle – complex runtime technology, which introduces some level of