This is seriously one question I couldn't find the answer to anywhere on Google.comWhen I mean mixed mode I mean .NET application which has unmanaged and managed code together.I used tools.NET Reflector 6 that crashes on native methods or shows only signature to them.Also used dnEditor v0.76 beta which doesn't ever crash but also doesn't show any native x86 assembly for the areas it couldn't decompile.I get code like this[SuppressUnmanagedCodeSecurity][MethodImpl(MethodImplOptions.Unmanaged | MethodImplOptions.PreserveSig)]public unsafe static extern byte WritePointer(uint uint_1, void* pVoid_1, int int_4, int int_5, __arglist);Yet no way to see the x86 assembly for this method.I thought about injecting this dll file to a application then attaching ollydbg to it so I could dump the dll file and check it out in IDA PRO but this also doesn't work.IDA PRO 6.8 by default doesn't even load mixed .NET programs as both .NET IL Code and decompilable native asm..I ran out of options here, I'll try getting a real dll file and nopping it out somewhere in the middle and pasting the binary there maybe this way IDA PRO would detect it as a unmanaged dll file.But ya I ask you any tools to achieve this?
How to retrieve native asm code from .NET mixed mode dll file?
assembly;decompile;.net
The Linked Dll's native method is here you can load the dll directly in ollydbg too to find a resolved disassembly of the native method E:\1dll>ls -l 1.dll-rwxr-xr-x    1 Admin    Administ   268288 Dec 24 15:27 1.dllE:\1dll>rahash2 -a md5 1.dll1.dll: 0x00000000-0x000417ff md5: 82eab591d8bc6d293a2a07f10a5f6a46E:\1dll>c:\Program Files\Microsoft SDKs\Windows\v7.0A\bin\ildasm.exe /text 1.dll | grep -i global.*writepointer -B 3  // Embedded native code  // Disassembly of native methods is not supported.  //  Managed TargetRVA = 0x00005B20} // end of global method WritePointerE:\1dll>radare2 -qc s 0x5b20-0x1000+0x400;af;pdf; 1.dll/ (fcn) fcn.00004f20 135|          0x00004f20    51             push ecx|          0x00004f21    53             push ebx|          0x00004f22    55             push ebp|          0x00004f23    56             push esi|          0x00004f24    8b742414       mov esi, dword [esp + 0x14]     ; [0x14:4]=0|          0x00004f28    57             push edi|          0x00004f29    8d442424       lea eax, [esp + 0x24]           ; 0x24  ; '$'|          0x00004f2d    6a04           push 4|          0x00004f2f    83c004         add eax, 4|          0x00004f32    56             push esi|          0x00004f33    33db           xor ebx, ebx|          0x00004f35    89442418       mov dword [esp + 0x18], eax     ; [0x18:4]=64|          0x00004f39    e83c5a0000     call 0xa97a ;0x0000a97a(unk, unk, unk, unk, unk, unk, unk) ; fcn.0000550c+21614radare2 doesn't seem to load the dll properly as an image but seems to load it as a raw file (as in hexeditor view)ollydbg will load the dll and will disassemble properly radare2 disassembly above and ollydbg disassembly below for the embedded native method WritePointer CPU DisasmAddress   Hex dump         Command                                  Comments10005B20  /.  51           PUSH    ECX10005B21  |.  53           PUSH    EBX                              ; Jump to mscoree._CorDllMain10005B22  |.  55           PUSH    EBP10005B23  |.  56           PUSH    ESI10005B24  |.  8B7424 14    MOV     ESI, DWORD PTR SS:[ESP+14]10005B28  |.  57           PUSH    EDI10005B29  |.  8D4424 24    LEA     EAX, [ESP+24]10005B2D  |.  6A 04        PUSH    4                                ; /Size = 410005B2F  |.  83C0 04      ADD     EAX, 4                           ; |10005B32  |.  56           PUSH    ESI                              ; |Addr = 13F8B810005B33  |.  33DB         XOR     EBX, EBX                         ; |10005B35  |.  894424 18    MOV     DWORD PTR SS:[ESP+18], EAX       ; |10005B39  |.  E8 3C5A0000  CALL    <JMP.&KERNEL32.IsBadReadPtr>     ; \KERNEL32.IsBadReadPtrregarding your pastebin here is the pseudo code for the function without inside loopradare2 -c s 0x5cb0-0x1000+0x400;af;pdc; 1.dllfunction fcn.000050b0 () {    loc_0x50b0:        push ecx    push ebx    push ebp    push esi    esi = dword [esp + 0x14]    push edi    eax = [esp + 0x1c]    push 4    eax += 4    push esi    ebx = 0    dword [esp + 0x18] = eax    0xa97a ()    if (eax == eax    notZero 0x5106) {        loc_0x5106:            eax = dword [ebx]        pop edi        pop esi        pop ebp        dword [esp + 4] = 0        pop ebx        pop ecx        loc_0x50d2:            ebp = dword [esp + 0x1c]        esi = dword [esi]        edi = 0        if (ebp == ebp        isLessOrEqual 0x5106)      }      return;}