Elektrine lite

← Feed

@still@infosec.exchange

Post #3949201

2026-07-20 03:33 UTC

Through StackTraceMetadata, we were able to rebuild the RVA to member mapping, so any .NET AoT compiled applications with StackTraceSupport on (the default) should be able to get its member names restored. Other things that can help with reverse engineering: - Hydratable metadata/MethodTable/EEType should be present in either hydrated section or the .rdata section when hydration is off (.NET 8 = on; .NET 10 = off due to performance/memory savings). This is parsed by default from nativeaot IDA plugins. - Reflection data should theoretically contain the type, method, field names; this is on by default. Things that will make our job annoying: - StackTraceSupport = off -> no RVA-member mapping -> biggest win against reverse engineers - reflectiondata = off -> no reflection-related data; this is not recommended because anything that relies on printing reflection information (e.g., exception names) will crash, and this option is gradually getting removed from .NET 10 and onwards. - MSVC linker is used during AoT compilation, so you can throw in additional linker args like bREPRO if you wanted to change the timestamp behavior, or NOCOFFGRPINFO if you don't want to keep POGO around. - DebuggerSupport = false -> minor but removes the DotNetRuntimeDebugHeader - NativeDebugSymbols = false -> removes PDB-related data

Replies (0)

No replies.