Washi

👉 https://blog.washi.dev/posts/misconceptions-about-dotnet/

· 7mo ago

Over the past couple years, I have come to know the #dotnet platform pretty well, from a developer's and a #reversing standpoint.

I can’t always say the same the #infosec community.

Today, I decided to rant a little (or maybe a lot 🙃)

Addressing Common Misconceptions about .NET in the InfoSec World

Over the past couple years, I have come to know the .NET platform pretty well, from both a developer’s and a reverse engineer’s standpoint.

👉https://blog.washi.dev/posts/recovering-nativeaot-metadata/

· 18mo ago

After #flareon11 challenge 7, I got inspired to build tooling for #dotnet Native AOT reverse engineering.

As such, I built a #Ghidra Analyzer that can automatically recover most .NET types, methods and frozen objects (e.g., strings).

Recovering Metadata from .NET Native AOT Binaries

Ever seen a binary that looks like a .NET binary based on its strings, but .NET decompilers are not able to open them?

· 9mo ago

Better late than never, I finally managed to finalize my #flareon12 write-ups😄

Overall, it was a fun set of challenges and the latter ones a reminder of how much I still have to learn in the field of RE :).

👉 https://blog.washi.dev/posts/flareon12/
👉 https://washi1337.github.io/ctf-writeups/writeups/flare-on/2025/
Image

Flare-On 12 Write-Ups

At last, as promised in my previous post, with a huge delay I finally managed to finalize my Flare-On12 write-ups. Overall, it was a really good and fun set of challenges, and as always, the latter ones humbling me, reminding me how much I still have to learn in the field of RE.

👉https://blog.washi.dev/posts/awaitfuscator

· 33mo ago

Did you know you could write entire #csharp programs just by using the "await" keyword?

OK, well not really, but I spent some weekends developing AwaitFuscator: A (dumb) #obfuscator that turns your #dotnet program into nothing but "await" expressions!

Awaiting the Awaitables - Building the AwaitFuscator

Here is a scenario you probably have never encountered. Have you ever decompiled a .NET binary that only consists of a bunch of await keywords and nothing else?

👉 https://washi1337.github.io/ctf-writeups/writeups/flare-on/2024/

· 23mo ago

I just published my writeups for all challenges of #flareon11:

👉 https://blog.washi.dev/posts/flareon11/

Hope you like them as much as I liked writing them!

Flare-On 11 Write-Ups

Today a short post.

· 34mo ago

"Noo! Ghidra has such a bad UI! IDA is much better!"

Explain to me: In what world does a hex view need column selection that crosses multiple columns (and beyond) and disappears upon scrolling?

The decompiler may be good but I genuinely don't see how people put up with IDA's UI.

#reversing #obfuscation #asmresolver

· 39mo ago

I spent my Saturday on a dumb project answering the following question:

What is the smallest #dotnet Hello World binary?

Turns out, this rabbit hole is deeper than you may expect, so I wrote a blog post about it:
👉 https://blog.washi.dev/posts/tinysharp/

How small is the smallest .NET Hello World binary?

Here is a dumb question that you probably never asked yourself: What is the minimal amount of bytes we need to store in a .NET executable to have the CLR print the string"Hello, World!" to the standard output?

👉https://github.com/Washi1337/ghidra-nativeaot

· 35mo ago

Ever tried #reversing #dotnet binaries compiled with #nativeaot? I decided to publish some of my (hacky) #ghidra scripts that may help you out with mundane tasks like finding strings.

The scripts could probably use some work but at least it's a start😃

GitHub - Washi1337/ghidra-nativeaot: Ghidra .NET Native AOT Analyzer Plugin

Ghidra .NET Native AOT Analyzer Plugin. Contribute to Washi1337/ghidra-nativeaot development by creating an account on GitHub.

· 19mo ago

#AsmResolver 6.0.0-beta.3 just got pushed to NuGet!

More bugs were found and squashed. We are closing in on a full release with most of the public API being stable.

Get it on GitHub or NuGet 👉 https://github.com/Washi1337/AsmResolver/releases/tag/v6.0.0-beta.3

#dotnet #pe #reversing

Release 6.0.0-beta.3 · Washi1337/AsmResolver

This is a maintenance release. AsmResolver is closing in on a main release with most of the public API being stable. However, similar to 6.0.0-beta.2, this is still a pre-release and some of the pu...

· 13mo ago

#AsmResolver 6.0.0-beta.4 released!

This release addresses many shortcomings found during beta.3, including ARM32 and ARM64 support, auto references importing, and many other DX improvements.

👉 Get it on GitHub or NuGet: https://github.com/Washi1337/AsmResolver/releases/tag/v6.0.0-beta.4

#dotnet #pe #reversing

Release 6.0.0-beta.4 · Washi1337/AsmResolver

It's been a while since the last beta.3 release, and the main reason for this has been that beta.3 saw many more testers actively trying out v6.0.0 and pushing it to its limits. Beta.4 addresses ma...

👉 https://blog.washi.dev/posts/popping-calcs-in-dnspy/

· 37mo ago

Earlier this month I found a way to consistently pop calculators in #dnSpy by opening a file and clicking some nodes in its browser.

Today I release a write-up on how this can be done:

Update dnSpy if you haven't already!

#dotnet #reversing #bug

A problem with .NET Self-Contained Apps and how to pop calculators in dnSpy

Programming languages that operate on a virtual machine often promise safety guards against many unsafe operations. However, virtual machines can have pretty serious bugs. In this post, we explore one interesting limitation of self-contained applications in .NET, and see how we can exploit it to pop calculators from our trusty decompiler dnSpy:

· 21mo ago

#AsmResolver 6.0.0-beta.2 has been released

This is a maintenance release that addresses many regressions introduced by the refactors in 6.0.0-beta.1.

Get it on NuGet or GitHub
👉 https://github.com/Washi1337/AsmResolver/releases/tag/v6.0.0-beta.2

Release 6.0.0-beta.2 · Washi1337/AsmResolver

This is a maintenance release that fixes some shortcomings and addresses various regressions introduced by the refactors in 6.0.0-beta.1. Similar to 6.0.0-beta.1, this is an unstable release and th...

👉 https://github.com/Washi1337/AsmResolver/releases/tag/v5.4.0

· 39mo ago

Another day, another #AsmResolver version bump: 5.4.0 is out now.

This release includes support for #PE certificate tables, PE forwarder exports, more quality of life improvements and more bug fixes.

#reversing

Release 5.4.0 · Washi1337/AsmResolver

This release includes support for PE certificate tables, PE forwarder exports, as well as various quality of life improvements and bug fixes. Check out the documentation and the full change-log bel...

👉 https://blog.washi.dev/posts/on-the-vmp-leak-and-why-it-is-bad/

· 34mo ago

I wrote a quick post with my thoughts on the recent VMProtect leaks, and why I think it is a bad thing in general:

#reversing #ethics #leaks

On the recent VMProtect leaks and why it is a bad thing

You may have seen the recent word about the VMProtect source being leaked to various openly accessible places like GitHub. For obvious reasons I won’t link it here, but from the brief looks that I got, it indeed looks sophisticated enough that it could be the real deal. People embraced this news as a great thing, an early 2023 Christmas gift to the reversing community:

· 31mo ago

#AsmResolver 5.5.1 is out!

This is a maintenance release, adding #dotnet 8.0 targets and fixes issues related to type signatures, CIL optimizations, as well as some rare edge cases in .NET metadata directory parsing.

Get it on GitHub/NuGet:
👉 https://github.com/Washi1337/AsmResolver/releases/tag/v5.5.1