You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: readme.md
+8-12Lines changed: 8 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,22 +10,18 @@ to DnSpy_Bookmarks.xml
10
10
This PS module could be useful and helpful during reversing .NET assemblies for
11
11
fast revealing calls to unmanaged API functions used in assembly. Sometimes
12
12
malware assemblies are full of junk code where the main functionality is
13
-
implemented by direct WIN API or NTAPI calls.
14
-
13
+
implemented by direct WIN API or NTAPI calls.<br/>
15
14
Get-PDInvokeImports enables you to get fast overview what P/Invoke, Dynamic
16
15
P/Invoke and D/Invoke are used in assembly - It will show you what functions are
17
-
used + MDTokens, where are declared, and all location where are used from code.
18
-
16
+
used + MDTokens, where are declared, and all location where are used from code.<br/>
19
17
It enables to export all locations where are detected P/Invoke, Dynamic P/Invoke
20
18
and D/Invoke referenced from code to DnSpy Bookmarks.xml
21
19
22
20
Example: Imagine 1MB assembly full of junk code + CF obfuscation where main
23
21
functionality is reached via unmanaged WinAPI\\NTAPI calls.
24
22
25
23
This PS module is written in PowerShell and is fully compatible with Windows
26
-
PowerShell (.NET Framework) and PowerShell Core (based on .NET, .NET Core).
27
-
28
-
It uses dnlib to parse assembly and .NET reflection to load dnlib. Dnlib is
24
+
PowerShell (.NET Framework) and PowerShell Core (based on .NET, .NET Core). It uses dnlib to parse assembly and .NET reflection to load dnlib. Dnlib is
29
25
available for .NET framework and .NET standard - simply means that one can use
30
26
this PS module depending on dnlib on Windows and also Linux OS.
0 commit comments