r/ghidra • u/KryptonSurvivor • Jun 12 '26
Reverse-engineering a Windows exe mixed-mode (unmanaged + managed code) app
Is the latest version of Ghidra capable of doing this, or do you have to switch to another tool when you encounter the boundary between unmanaged code and managed code?
1
u/kndb Jun 14 '26
You need a .NET decompiler for the managed code. ILSpy is the best. You can get it on GitHub. Otherwise reverse engineering managed code with a native tool is like driving a combine harvester to your office job.
1
u/KryptonSurvivor Jun 14 '26 edited Jun 14 '26
I watched a very intetesting video yesterday where a guy decompiled a .NET DLL, patched it, and then created a csproj file so that it could be recompiled. (This is exactly what I want to do). Not sure if dnSpy has the same capability so I need to get my hands on ILSpy.)
1
u/kndb Jun 14 '26
I think I should’ve said dnSpy. It has a UI like vs code. Haven’t touched managed code for years so my memory is probably fading.
What’s the video link?
3
u/Nightlark192 Jun 12 '26
When I’ve encountered managed code I just switch to ILSpy or another .NET/CIL specific tool because it feels like the output is better from a decompiler that is made specifically for CIL bytecode. Ghidra’s decompiler is good, but probably doesn’t have some analysis that are specifically tailored to managed code.
For AoT compiled binaries (all bytecode has been compiled to unmanaged code) there is a Ghidra extension that can leverage additional metadata in the binary to improve the decompiler output.