dotscope 0.7.0

A high-performance, cross-platform framework for analyzing and reverse engineering .NET PE executables
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66

//! `System` namespace BCL method hooks.
//!
//! This module provides hook implementations for core .NET `System` namespace types
//! that are frequently encountered during emulation of obfuscated assemblies.
//!
//! # Organization
//!
//! | Module | .NET Type(s) | Description |
//! |--------|-------------|-------------|
//! | [`array`] | `System.Array`, `System.Buffer` | Array manipulation and block copy operations |
//! | [`bitconverter`] | `System.BitConverter` | Primitive-to-byte and byte-to-primitive conversions |
//! | [`convert`] | `System.Convert` | Type conversions and Base64 encoding/decoding |
//! | [`enums`] | `System.Enum` | Enum parsing, formatting, and value inspection |
//! | [`environment`] | `System.Environment` | Environment variable and runtime info queries |
//! | [`exception`] | `System.Exception` | Exception construction and property access |
//! | [`math`] | `System.Math`, `System.Numerics.BitOperations` | Mathematical operations and bit manipulation |
//! | [`nullable`] | `System.Nullable<T>` | Nullable value type handling |
//! | [`spans`] | `System.Span<T>`, `System.ReadOnlySpan<T>`, `System.Memory<T>` | Span and memory stubs |
//! | [`string`] | `System.String`, `System.Char` | String manipulation and character operations |
//!
//! # Deobfuscation Relevance
//!
//! Types in the `System` namespace form the backbone of most obfuscated code. String
//! manipulation is central to string encryption schemes, `Convert` handles Base64
//! encoding used in encrypted payloads, `Array` and `Buffer` are used extensively in
//! decryption routines, and `Math` operations drive control flow flattening state machines.

mod array;
mod bitconverter;
mod convert;
mod datetime;
mod diagnostics;
mod enums;
mod environment;
mod exception;
mod math;
mod nullable;
mod spans;
mod string;

use crate::{emulation::runtime::hook::HookManager, Result};

/// Registers all `System` namespace hooks with the given hook manager.
///
/// Delegates to each submodule's `register()` function to install hooks for
/// `Array`, `BitConverter`, `Buffer`, `Convert`, `Enum`, `Environment`, `Exception`,
/// `Math`, `Nullable<T>`, `String`, and `Char`.
///
/// # Arguments
///
/// * `manager` - The [`HookManager`] to register hooks with
pub fn register(manager: &HookManager) -> Result<()> {
    array::register(manager)?;
    bitconverter::register(manager)?;
    convert::register(manager)?;
    datetime::register(manager)?;
    diagnostics::register(manager)?;
    enums::register(manager)?;
    environment::register(manager)?;
    exception::register(manager)?;
    math::register(manager)?;
    nullable::register(manager)?;
    spans::register(manager)?;
    string::register(manager)?;
    Ok(())
}