> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/windows-vulnerabilities/binary-analysis/userinfo-exe-binary-analysis.md).

# UserInfo.exe 二进制分析

这篇笔记展示了一个简单的 Windows `.NET` 二进制分析工作流：受控执行、行为观察，以及使用 dnSpy 检查以恢复敏感信息。

## 准备

准备实验环境，传输压缩包，并在需要时配置名称解析。

<figure><img src="/files/b7989e542837816c2a48d3d22b68cd4412358b9d" alt="UserInfo.exe lab preparation"><figcaption></figcaption></figure>

<figure><img src="/files/376d7b46aed8ff5e4118534fd513cee268828fd5" alt="UserInfo.exe archive transferred"><figcaption></figcaption></figure>

## 受控执行

```powershell
./UserInfo.exe find -first * -last *
```

<figure><img src="/files/8cfa9de8acc857c8699f9f207c2a7e4f00b69c7c" alt="UserInfo.exe controlled execution"><figcaption></figcaption></figure>

## 使用 dnSpy 分析

{% embed url="<https://github.com/dnSpy/dnSpy>" %}

<figure><img src="/files/f01251061efe7cd2ef401416d8f5d10c8293be68" alt="UserInfo.exe opened in dnSpy"><figcaption></figcaption></figure>

搜索字符串、认证函数、端点和硬编码密钥。

<figure><img src="/files/aafad0d01c3775d334266b8b34ba8d0819844ba4" alt="Searching UserInfo.exe code in dnSpy"><figcaption></figcaption></figure>

在密钥变为可读的代码路径附近设置断点。

<figure><img src="/files/47a0b394cf39cd1e884324b4952f630b12840848" alt="Breakpoint set in dnSpy"><figcaption></figcaption></figure>

<figure><img src="/files/a98a746431d135676d2974d15874f6fb5134690b" alt="Recovered runtime secret in dnSpy"><figcaption></figcaption></figure>

## 关键要点

* `.NET` 二进制文件通常很容易反编译。
* 硬编码密钥应视为已泄露。
* 静态分析应与实验室中的受控执行结合进行。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/windows-vulnerabilities/binary-analysis/userinfo-exe-binary-analysis.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.