[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-92531":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":16,"subscribersCount":16,"size":16,"stars1d":16,"stars7d":16,"stars30d":15,"stars90d":16,"forks30d":16,"starsTrendScore":16,"compositeScore":17,"rankGlobal":10,"rankLanguage":10,"license":18,"archived":19,"fork":19,"defaultBranch":20,"hasWiki":19,"hasPages":19,"topics":21,"createdAt":10,"pushedAt":10,"updatedAt":36,"readmeContent":37,"aiSummary":38,"trendingCount":16,"starSnapshotCount":16,"syncStatus":13,"lastSyncTime":39,"discoverSource":40},92531,"ida-nativeaot","Dump-GUY\u002Fida-nativeaot","Dump-GUY","Recover .NET Native AOT metadata in IDA Pro — MethodTable\u002Ftype hierarchy, virtual methods, and string literals from symbol-stripped binaries. IDAPython port of washi1337\u002Fghidra-nativeaot.","",null,"Python",54,2,51,1,0,41.53,"Other",false,"main",[22,23,24,25,26,27,28,29,30,31,32,33,34,35],"decompiler","dotnet","eetype","ghidra-port","ida-plugin","ida-pro","idapython","malware-analysis","metadata-recovery","methodtable","nativeaot","pyside6","readytorun","reverse-engineering","2026-07-22 04:02:06","# IDA NativeAOT 🧩\n\n> **Recover .NET Native AOT metadata in IDA Pro — type hierarchy, virtual methods, and string literals from symbol-stripped binaries.**\n\n[![Python 3](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FPython-3.x-blue?logo=python&logoColor=white)](https:\u002F\u002Fwww.python.org\u002F)\n[![IDA Pro](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FIDA%20Pro-9.2%2B-orange)](https:\u002F\u002Fhex-rays.com\u002Fida-pro\u002F)\n[![License](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FLicense-MIT-green)](LICENSE)\n\n\u003Cp align=\"center\">\n  \u003Cimg src=\"Media\u002Fida-nativeaot_Overview.png\" alt=\"NativeAOT Metadata Browser - Overview tab\" width=\"900\">\n\u003C\u002Fp>\n\nA two-file IDA Pro plugin that reverse-engineers **.NET Native AOT** binaries (.NET 7\u002F8\u002F9\u002F10).\nThese ship with stripped symbols, so IDA shows thousands of unnamed `sub_*` functions. The plugin\nparses the runtime's **ReadyToRun** metadata to rebuild the .NET type system, name the code, and\npresent everything in a navigable browser.\n\nThis is an IDAPython port of Washi's excellent Ghidra plugin\n**[washi1337\u002Fghidra-nativeaot](https:\u002F\u002Fgithub.com\u002Fwashi1337\u002Fghidra-nativeaot)**\n(see his write-up: [Recovering NativeAOT Metadata](https:\u002F\u002Fblog.washi.dev\u002Fposts\u002Frecovering-nativeaot-metadata\u002F)).\n\n---\n\n## Compatibility\n\n| IDA Version | Qt | Python Qt Bindings | Plugin Support |\n|---|---|---|---|\n| **8.x — 9.1** | Qt5 | PyQt5 | **❌ Not supported** |\n| **9.2+** | Qt6 | PySide6 | **✅ Supported** (developed & tested on **9.3**) |\n\nThe plugin's UI is **PySide6-only**, the Qt binding IDA adopted in **9.2**. x86-64 little-endian\ntargets only (as upstream). The Hex-Rays decompiler is optional but recommended.\n\n---\n\n## What it does\n\n1. Locates the **ReadyToRun (RTR)** metadata directory (by symbol or signature scan).\n2. **Rehydrates** the compressed metadata into the `hydrated` segment (.NET 8+), or falls back to a pointer scan (.NET 7\u002F10).\n3. Reconstructs the full **MethodTable \u002F EEType** type hierarchy — base types, interfaces, vtables.\n4. Identifies `System.Object` \u002F `System.String` and names virtual methods.\n5. Annotates **frozen objects** — string literals, arrays, boxed values.\n\n## What it produces in the IDB\n\n- The previously-empty **`hydrated` segment is populated** with the decompressed metadata.\n- **Struct types** (Local Types) for every type: `\u003CClass>_MT`, `\u003CClass>_vtbl`, and the `\u003CClass>` instance layout, with base-class vtable embedding and interface arrays.\n- **Method-table labels** `\u003CClass>_MT` at each MethodTable, typed with its struct.\n- **Named virtual methods**: `\u003CClass>::Method_N` (slots 0–2 → `ToString`\u002F`Equals`\u002F`GetHashCode`), tagged `__thiscall` with `this` typed — Hex-Rays shows e.g. `void __thiscall Foo::Method_4(Foo *this)`.\n- **Frozen string literals**: UTF-16 strings, labelled `dn_\u003Ctext>_\u003Caddr>`, with the exact text as a repeatable comment.\n- **Frozen arrays \u002F boxed objects** typed with their instance\u002Felement types.\n- A text report next to the database (`\u003Cinput>.naot_report.txt`) and a compressed metadata cache in the IDB (instant browser reopen).\n\nTypical result on a real .NET 8 sample: ~4900 method tables, ~3000 methods named, ~2500 string literals recovered.\n\n---\n\n## The browser\n\nTabs: **Overview** (RTR info, sections, stats) · **Type Hierarchy** (inheritance tree + per-type\nmethods\u002Finterfaces) · **Methods** · **Strings** · **Frozen Data**. Double-click any row to jump in\nIDA; right-click to copy or rename; type kinds have colour icons.\n\n**Live sync** — the browser tracks IDA renames (manual, **FLIRT**, **Lumina**) and updates itself\nautomatically; **↻ Refresh names** forces a re-read. Right-click **Rename type (propagate)** renames\na class *and* its methods (`Old::M` → `New::M`) without clobbering FLIRT\u002Fuser-given names. Type and\nmethod names are shown in full and demangled, mirroring any symbols already applied to the database\n(e.g. from a PDB).\n\n### Screenshots\n\n*Sample: a NativeAOT build of `FlirtCoverage.dll` (.NET 8) with its PDB applied. The Overview tab is shown at the top of this page.*\n\n**Type Hierarchy** - the `System.IO.FileStream` inheritance chain with the per-type detail pane (base type, interfaces, vtable slots). Names are full and demangled, straight from the applied PDB.\n\n![Type Hierarchy tab](Media\u002Fida-nativeaot_TypeHierarchy.png)\n\n**Methods** - filtering on `canWrite` lands on `FileStream::get_CanWrite`, slot 4 of `System.IO.Stream`.\n\n![Methods tab](Media\u002Fida-nativeaot_Methods.png)\n\n**Strings** - a recovered frozen literal (`ws:\u002F\u002F127.0.0.1:0\u002F`) and how it reads inline in the Hex-Rays pseudocode as a `dn_…` label.\n\n![Strings tab](Media\u002Fida-nativeaot_Strings.png)\n\n---\n\n## Installation\n\nCopy **both** files into your IDA plugins directory (they must sit together — the plugin loads the\nengine from the same folder):\n\n**Per-user (recommended — survives IDA reinstalls):**\n```\n%APPDATA%\\Hex-Rays\\IDA Pro\\plugins\\ida-nativeaot_browser.py\n%APPDATA%\\Hex-Rays\\IDA Pro\\plugins\\ida-nativeaot.py\n```\n\n**System-wide:**\n```\n\u003CIDA_DIR>\\plugins\\ida-nativeaot_browser.py\n\u003CIDA_DIR>\\plugins\\ida-nativeaot.py\n```\n\nRestart IDA, then open via **`Edit → Plugins → NativeAOT Metadata Browser`** or **`Ctrl-Shift-N`**.\nThe first run analyzes and caches the metadata into the IDB; subsequent opens are instant.\n\n> `ida-nativeaot.py` is the analysis engine and can also be run standalone, without the GUI, via\n> **`File → Script file…`** or headless: `idat64 -A -S\"ida-nativeaot.py\" target.i64`.\n\n### IDA Plugin Manager (HCLI)\n\nThe plugin ships an `ida-plugin.json`. This is a two-file plugin - `ida-nativeaot_browser.py` is the\n`entryPoint` and `ida-nativeaot.py` is a helper module it imports - and the Plugin Manager installs\n**both** files together (it extracts the whole plugin directory, not just the entry point). Once\npublished to plugins.hex-rays.com, install with:\n\n```\nhcli plugin install ida-nativeaot\n```\n\n---\n\n## License\n\nLicensed under the **MIT License** — see [LICENSE](LICENSE). This is a derivative work ported from\nthe MIT-licensed [washi1337\u002Fghidra-nativeaot](https:\u002F\u002Fgithub.com\u002Fwashi1337\u002Fghidra-nativeaot).\n\n---\n\n## Credits\n\n**Original research & Ghidra plugin:** [Washi](https:\u002F\u002Fgithub.com\u002Fwashi1337)\n([@washi1337](https:\u002F\u002Fgithub.com\u002Fwashi1337)) — [ghidra-nativeaot](https:\u002F\u002Fgithub.com\u002Fwashi1337\u002Fghidra-nativeaot)\nand the blog post [Recovering NativeAOT Metadata](https:\u002F\u002Fblog.washi.dev\u002Fposts\u002Frecovering-nativeaot-metadata\u002F).\nThis IDA plugin is a faithful port of his work.\n\n**IDA port & browser UI:** Jiří Vinopal\n  X \u002F Twitter: [@vinopaljiri](https:\u002F\u002Fx.com\u002Fvinopaljiri)\n  GitHub: [Dump-GUY](https:\u002F\u002Fgithub.com\u002FDump-GUY)\n","这是一个为 IDA Pro 开发的插件，用于从符号剥离的 .NET Native AOT（ReadyToRun）二进制文件中恢复关键运行时元数据。它通过解析压缩的 ReadyToRun 元数据，重建类型层次结构（MethodTable \u002F EEType）、虚拟方法表（vtable）、字符串字面量及冻结对象，并在 IDA 中自动命名函数、生成结构体定义和类型注解。项目基于 PySide6 构建 UI，专为 IDA Pro 9.2+ 设计，依赖 IDAPython，支持 .NET 7\u002F8\u002F9\u002F10 的 x86-64 little-endian 二进制。适用于逆向分析无调试信息的 .NET 原生编译程序，尤其在恶意软件分析、固件逆向和闭源 .NET 应用研究等需深度理解类型语义的场景。","2026-07-09 02:30:16","CREATED_QUERY"]