Cheat Engine

AntumDeluge · Cheater Reputation: 0 Joined: 20 Dec 2018 Posts: 48

Is it possible to identify whether or not a Win32 executable was written in C#? Perhaps with a hex editor? I'm told that using Cheat Engine with C# programs can be problematic. And I am coming across quite a few games that are problematic. :-\

Dark Byte · Posted: Fri Apr 19, 2019 3:18 am Post subject:

why would it be problematic? in C# games you even have symbols making things a lot easier. You have structure information and other goodies. Just don't bother with pointers

AntumDeluge · Cheater Reputation: 0 Joined: 20 Dec 2018 Posts: 48

Okay. Then I just haven't learned how to use Cheat Engine well enough... because I don't know how to access/use any of that stuff. The tutorial went over addresses & pointers. I don't remember anything about symbols, structure information, & other goodies. Smile

panraven · Posted: Fri Apr 19, 2019 3:36 pm Post subject:

I use JustDecompile C# decompiler,
it can open .net *.exe and view its assembly.

May check celua.txt https://raw.githubusercontent.com/cheat-engine/cheat-engine/master/Cheat%20Engine/bin/celua.txt and search dotnet for more info on using ce dotnet feature.

atom0s · Posted: Fri Apr 19, 2019 4:41 pm Post subject:

Would recommend dnSpy over any other .NET decompiler. Has a much better set of features/tools and is made by the RE community itself vs. a company.

As for detecting if a program is .NET, you can check the files PE header for the various .NET related information. You can use a tool like CFF Explorer for that to do it easily. Keep in mind some obfuscation tools and packers can alter the PE header to try and hide this information or report false info. (A common trick for this would be altering the 'NumberOfRvaAndSizes' field of the PE OptionalHeader struct.

Generally, if a file is .NET, you'll see information like this in CFF Explorer:
https://i.imgur.com/bzgrfWd.png

Link to dnSpy: https://github.com/0xd4d/dnSpy
Link to CFF Explorer: https://ntcore.com/?page_id=388

AntumDeluge · Cheater Reputation: 0 Joined: 20 Dec 2018 Posts: 48

Okay, I have opened the binary with CFF Explorer. Is it safe to say this is not a .net/C# executable? I do not see a section labelled ".NET Directory". But you said this information might be hidden?

Edit: Oh, I did just come across this though:

Edit: It appears that CFF Explorer shows those two ".NET MetaData Directory" entries for any executable.

OldCheatEngineUser · Jul 26, 2020

just look at import section, you should find mscoree.dll if its C#.

AntumDeluge · Cheater Reputation: 0 Joined: 20 Dec 2018 Posts: 48

Did not find any import of mscoree.dll.

atom0s · Posted: Mon Apr 22, 2019 2:52 pm Post subject:

Then either the game is not written in .NET or it is just a loader to launch/create a .NET environment.