CILFI: Function Identification in .NET Binaries

CILFI (Common Intermediate Language Function Identification) is a tool to match methods compiled to the Common Intermediate Language (CIL) to a set of known signatures. Its primary goal is to help reverse engineers in cross-referencing similar methods across binaries, such as identifying common decryption routines or Virtual Machine (VM) opcode handler routines.

Main Features

• [x] Match method declarations and code in a .NET binary using CIL syntax.
• [x] Make precise but generalized signatures using wildcards, regular expressions, and special pattern-matching syntax.
• [x] Support for batching with output in plain text or JSON.

Quick Starters Guide

Create your signatures and store them in a file called signatures.cilfi (See Signature Syntax for more information):

.signature KoiVM_OpCodes_ADD_DWORD_Run
{
    .author         "washi"
    .description    "KoiVM ADD_DWORD opcode handler"

    .method final hidebysig newslot virtual instance void ??(
            class ??,
            valuetype ??&
        ) cil managed
    {
        $block1 ignorenops
        {
            ldloca    ??
            ldloca    ??
            call      instance uint32 ??::??()
            ldloca    ??
            call      instance uint32 ??::??()
            add
            call      instance void ??::??(uint32)
        }
    }
}

Run your .NET binary through the matcher with the signatures file loaded.

$ cilfi match Binary.dll --signatures signatures.cilfi

Read the standard output:

Binary.dll@06000001: KoiVM_OpCodes_ADD_DWORD_Run

See Output Formats for more information on customizing CILFI's output.