CILFI: Function Identification in .NET Binaries

CILFI (Common Intermediate Language Function Identification) is a tool to match methods compiled to the Common Intermediate Language (CIL) to a set of known signatures. Its primary goal is to help reverse engineers in cross-referencing similar methods across binaries, such as identifying common decryption function, Virtual Machine (VM) opcode handlers, or C2 connection initializer routines. It is distributed as a reusable library or a standalone tool whose output can be ingested by e.g., .NET deobfuscators or config extractors.

Original blog post here.

Main Features

• Match method declarations and code in a .NET binary using familiar CIL syntax.
• Disassembler copy+paste friendly: A valid CIL disassembly is a valid CILFI signature.
• Make precise but generalized signatures using wildcards, regular expressions, and special pattern-matching syntax.
• Support for batch-analysis with multiple input binaries and detailed JSON output.

Binaries

CILFI is distributed as a standalone binary (NativeAOT, no dependencies) or as a reusable library.

• Releases
• Nightly Builds

Documentation and Support

• Guides
• API Reference
• Issue Tracker

Quick Starters Guide

Create your signatures and store them in a file called signatures.cilfi (See Signature Syntax for more information):

.signature KoiVM_OpCodes_ADD_DWORD_Run
{
    .author         "washi"
    .description    "KoiVM ADD_DWORD opcode handler"

    .method final hidebysig newslot virtual instance void ??(
            class ??,
            valuetype ??&
        ) cil managed
    {
        .block $block1 ignorenops
        {
            ldloca    ??
            ldloca    ??
            call      instance uint32 ??::??()
            ldloca    ??
            call      instance uint32 ??::??()
            add
            call      instance void ??::??(uint32)
        }
    }
}

Run your .NET binary through the matcher with the signatures file loaded.

$ cilfi match Binary.dll --signatures signatures.cilfi

Read the standard output line-by-line (file:metadata-token: signature):

Binary.dll:06000001: KoiVM_OpCodes_ADD_DWORD_Run
...

See Output Formats for more information on customizing CILFI's output.

Compiling

Ensure you have the .NET 10 SDK installed. Use any compatible IDE (e.g., Visual Studio, JetBrains Rider) or run form the command-line:

dotnet build

Build artifacts will appear in ./artifacts

Used Technologies

CILFI depends on the following technologies:

• AsmResolver
• ANTLR (via Antlr4BuildTasks)

Sponsor

CILFI is a free and open-source tool published under a permissible license.

If you use CILFI in your workflows, consider sponsoring me on GitHub!