Hiding .NET IL code from DnSpy with R2R Stomping

We create a .NET executable that hides code from decompilation and debugging with DnSpy by using a technique called R2R Stomping. Afterwards we explore how to analyse such samples and what effect it has on antivirus detection. Malware course: Checkpoint article: Twitter: 00:00 Introduction 00:43 What is R2R Stomping 02:13 Compiling an R2R binary 04:17 Stomping the code 07:50 Verify that it works - debugging .NET Core 10:00 How to recognize R2R binaries 12:14 Determine if a file is stomped 13:49 Compiling singlefile executables 14:35 Analysing singlefile executables 17:09 Implications on antivirus detections and analysis verdicts