Cilfi: Automatic Function Identification in .NET Binaries

There is a specific stage of grief every .NET reverse-engineer goes through when writing the next .NET deobfuscator or config extractor. It is the realization you have to write yet another ugly pattern-matching algorithm to find the exact same string decryptor, VM opcode handler, or C2 connection initializer functions to extract obfuscator configurations or IoCs. I got sick of it. I wanted ...