Hiding .NET IL code from DnSpy with R2R Stomping

We create a .NET executable that hides code from decompilation and debugging with DnSpy by using a technique called R2R Stomping. Afterwards we explore how to analyse such samples and what effect it has on antivirus detection.

Malware course: https://www.udemy.com/course/windows-malware-analysis-for-hedgehogs-beginner-training/?couponCode=CE8D957072A4B79B5EB2

Checkpoint article: https://research.checkpoint.com/2023/r2r-stomping-are-you-ready-to-run/

Twitter: https://twitter.com/struppigel

00:00 Introduction
00:43 What is R2R Stomping
02:13 Compiling an R2R binary
04:17 Stomping the code
07:50 Verify that it works - debugging .NET Core
10:00 How to recognize R2R binaries
12:14 Determine if a …

antivirus binary called code debugging detection dnspy introduction r2r stomping what is