OpenSec Atlas

AsmResolver: An Open Source Library/SDK for Application Security | OpenSec Atlas

Application Security

Library/SDK

AsmResolver

AsmResolver is a comprehensive library for creating, reading, modifying, and reconstructing Portable Executable (PE) files and .NET modules.

Visit Website View on GitHub

About This Tool

A library for creating, reading and editing PE files and .NET modules.

Primary Use Case

AsmResolver is primarily used by developers and security researchers who need to analyze, manipulate, or patch PE files and .NET assemblies programmatically. It is ideal for tasks such as PE file editing, metadata manipulation, and binary patching in both native and managed Windows applications.

Key Features

Create, read, modify, write, and patch PE files with full control over sections and data directories
Import Address Table (IAT) reconstruction and trampolining support
Rich support for various Win32 resource types
Extensive .NET metadata handling with an API similar to System.Reflection
Support for managed, native, and dynamic method bodies
Cross-platform compatibility (.NET Standard 2.0, Mono, Windows and *nix)
Support for AppHost/SingleFileHost bundles and ReadyToRun (R2R) binaries
Fully managed PDB and PortablePdb symbol reading without external dependencies

Insights & Recommendations

Running tests on non-Windows platforms requires installation of mono and wine. The library supports a wide range of .NET runtimes including legacy and current LTS versions, making it versatile for cross-platform PE and .NET module manipulation. Users should ensure compatibility with their target .NET versions when integrating AsmResolver.

Installation

Ensure .NET SDK is installed (compatible with .NET 3.5, .NET Standard 2.0/2.1, .NET Core 3.1, .NET 6.0, .NET 8.0)
Clone the repository or add AsmResolver via NuGet package manager
To build from source, run: dotnet build
To run unit tests, run: dotnet test (requires additional .NET versions, mono, and wine on MacOS/Linux)

Usage

dotnet build

Builds the AsmResolver solution using the .NET SDK

dotnet test

Runs all unit tests to verify functionality across multiple .NET runtimes

Smart Usage Notes

Can be integrated into red team toolkits for custom exploit development and binary patching.Supports automation of PE and .NET module manipulation for vulnerability research and exploit proof-of-concept creation.Useful for blue teams to analyze suspicious binaries and understand malware modifications at a low level.Can be incorporated into CI/CD pipelines to detect unauthorized binary changes or tampering.Enables purple teams to develop exercises that simulate advanced binary manipulation and evasion techniques.