dnSpy.Extension.HoLLy icon indicating copy to clipboard operation
dnSpy.Extension.HoLLy copied to clipboard

Detect non-standard native stubs

Open holly-hacker opened this issue 3 years ago • 0 comments

Inspired by washi's blog post: https://washi.dev/blog/posts/entry-points/

When loading a managed executable, detect non-standard native stubs to warn the user of accidental native code execution when debugging. I am not sure what the best way to warn the user is yet, but I think warning before starting a debugging session and showing a warning in the treeview (new node?) are a good start.

Technical note: The end of the stub jumps into _CorDllMain. It needs to be verified that this is the correct _CorDllMain.

holly-hacker avatar Mar 05 '23 11:03 holly-hacker