Hacking Mono.Cecil - allowing invalid opcodes : Paul Mason

added by tivit
1/27/2010 1:51:46 AM

0 Kicks, 188 Views

In the last post we took a look at how to manually remove invalid opcodes from an obfuscated assembly. We did this by decompiling the assembly, replacing with the nop opcode and then recompiling. We used this manual method of removing these as Mono.Cecil crashed at the sight of some of the invalid opcodes. In this post we take a look at a tiny "hack" to Mono.Cecil which allows us to do the same thing in an automated manner.


0 comments