Retour au classement

Washi1337/AsmResolver

C#docs.washi.dev/asmresolver/

A library for creating, reading and editing PE files and .NET modules.

disassemblerdotnetreaderwritercililmsilportable-executablepereverse-engineeringassemblermalware-analysis
Croissance des étoiles
Étoiles
1.1k
Forks
150
Croissance hebdomadaire
Issues
12
5001k
févr. 2013juil. 2017janv. 2022juil. 2026
README

AsmResolver

Test and Publish Nuget feed Nuget feed License: MIT Discord

AsmResolver is a library for reading, modifying and reconstructing Portable Executable (PE) files. It supports PE images running natively on Windows, as well as images containing managed (.NET) metadata.

AsmResolver is released under the MIT license.

Main Features

AsmResolver has a lot of features. Below is a non-exhaustive list of the highlights:

  • Create, read, modify, write and patch PE files.
    • Full access to sections, data directories and their interpretations.
    • Import Address Table (IAT) reconstruction and trampolining.
    • Full control over the layout of the final PE file output.
  • Rich support for various Win32 resource types (Icons, VersionInfo, etc.).
  • Rich support for .NET metadata with an intuitive API similar to System.Reflection.
    • Managed, native and dynamic method body support.
    • Easy metadata importing and cloning.
    • Managed resource file serializers and deserializers.
    • Support for AppHost / SingleFileHost bundles.
    • Support for ReadyToRun (R2R) binaries.
  • Build to be robust against malformed/obfuscated binaries.
  • Rich read support for PDB and PortablePdb symbols.
    • Fully managed cross-platform API (No DIA or similar dependencies required).
  • Cross-platform (Windows and *nix, .NET Framework 3.5+, .NET standard 2.0, .NET Core, Mono and NixOS package compatible).
  • Documented.
  • Unit tested.

Documentation

Support

Binaries

Stable Builds:

Nightly Builds:

Branch Build status
master Test and Publish
development Test and Publish

Compiling

The solution can be built using the .NET SDK or an IDE that works with it (e.g., Visual Studio and JetBrains Rider). The main packages target LTS versions of various .NET runtimes (.NET Framework 3.5, .NET Standard 2.0, .NET Standard 2.1, .NET Core 3.1, .NET 6.0, .NET 8.0, .NET 9.0, .NET 10.0).

To build the project from the command line, use:

$ dotnet build

To run all tests, use:

$ dotnet test

For running the tests successfully, you will need to have additional versions of the .NET runtime installed (including STS versions or versions declared EOL), as the unit tests verify reading binaries targeting various .NET runtimes. To run the tests successfully on MacOS and Linux, mono and wine are expected to be installed as well.

Contributing

Acknowledgments

AsmResolver started as a hobby project but has grown into a community project with various contributors. Without these people, AsmResolver would not have been where it is today!

  • Special thanks to all the people who contributed directly with code commits or monetarily via GitHub sponsors.

  • Special thanks to the people at @MonoMod for helping with .NET Framework 3.5 compatibility.

  • Another big thank you to all the people that suggested new features, provided feedback on the API design, have done extensive testing, and/or reported bugs on the issue board, by e-mail, or through DMs.

If you feel you have been under-represented in these acknowledgments, feel free to reach out.

Dépôts similaires
NationalSecurityAgency/ghidra

Ghidra is a software reverse engineering (SRE) framework

JavaMavenApache License 2.0software-analysisdisassembler
nsa.gov/ghidra
71.2k7.8k
WerWolv/ImHex

🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.

C++GNU General Public License v2.0hex-editorreverse-engineering
imhex.werwolv.net
54.2k2.4k
x64dbg/x64dbg

An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.

C++Otherdebuggerwindows
x64dbg.com
49k2.8k
radareorg/radare2

UNIX-like reverse engineering framework and command-line toolset

COtherradare2c
radare.org
24.4k3.3k
horsicq/Detect-It-Easy

Program for determining types of files for Windows, Linux and MacOS.

JavaScriptnpmMIT Licensedebuggerdetect
ntinfo.biz
11.2k930
pwndbg/pwndbg

Exploit Development and Reverse Engineering with GDB & LLDB Made Easy

PythonPyPIMIT Licensepythongdb
pwndbg.re
10.7k1.2k
capstone-engine/capstone

Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.

Creverse-engineeringdisassembler
capstone-engine.org
8.9k1.7k
zrax/pycdc

C++ python bytecode disassembler and decompiler

C++GNU General Public License v3.0pythondecompiler
4.6k868
zyantific/zydis

Fast and lightweight x86/x86-64 disassembler and code generation library

CMIT Licensedisassemblerintel
zydis.re
4.3k503
cea-sec/miasm

Reverse engineering framework in Python

PythonPyPIGNU General Public License v2.0reverse-engineeringdisassembler
miasm.re
3.9k488
icedland/iced

Blazing fast and correct x86/x64 disassembler, assembler, decoder, encoder for Rust, .NET, Java, Python, Lua

Rustcrates.ioMIT Licensedisassemblerassembler
3.5k271
horsicq/DIE-engine

DIE engine

C++MIT Licensesignaturereverse-engineering
3.2k388