Recover .NET Native AOT metadata in Binary Ninja — type hierarchy, virtual methods, and string literals from symbol-stripped binaries.
A Binary Ninja plugin that reverse-engineers .NET Native AOT binaries (.NET 7/8/9/10+).
These ship with stripped symbols, so Binary Ninja shows thousands of unnamed sub_* functions. The plugin
parses the runtime's ReadyToRun metadata to rebuild the .NET type system, name the code, and
present everything in a navigable browser.
This is a Binary Ninja port of Dump-GUY's Dump-GUY/ida-nativeaot, which is itself an IDAPython port of Washi's excellent Ghidra plugin washi1337/ghidra-nativeaot (see his write-up: Recovering NativeAOT Metadata).
- Locates the ReadyToRun (RTR) metadata directory (by symbol or signature scan).
- Rehydrates compressed metadata (dehydrated data section), or falls back to a pointer scan when absent.
- Reconstructs the full MethodTable / EEType type hierarchy — base types, interfaces, vtables.
- Identifies
System.Object/System.Stringand names virtual methods. - Annotates frozen objects — string literals, arrays, boxed values.
- Struct types for every type:
<Class>,<Class>_vtbl, and the<Class>instance layout, with base-class vtable embedding and interface arrays. - Method-table labels
<Class>at each MethodTable, typed with its struct. - Named virtual methods:
<Class>::Method_N(slots 0–2 →ToString/Equals/GetHashCode). - Frozen string literals: UTF-16 strings, labelled
dn_<text>_<addr>, with the exact text as a comment.
- Frozen arrays / boxed objects typed with their instance/element types.
- A text report next to the binary (
<input>.naot_report.txt).
An interactive PySide6 dialog with tabs: Overview (RTR info, sections, stats) · Type Hierarchy (expandable inheritance tree with search) · Types · Methods · Strings · Frozen Data. Double-click any address to navigate in Binary Ninja.
The Type Hierarchy tab uses a lazy-expanding tree — click any type to reveal its derived types. Use the search bar to filter by type name.
Install via the Binary Ninja Plugin Manager or manually through the steps described below.
Git clone this repo and copy the repo folder to your Binary Ninja plugins directory:
| Platform | Path |
|---|---|
| Linux | ~/.binaryninja/plugins/binja-nativeaot |
| macOS | ~/Library/Application Support/Binary Ninja/plugins/binja-nativeaot |
| Windows | %APPDATA%\Binary Ninja\plugins\binja-nativeaot |
Run via Plugins > NativeAOT Metadata Browser.
Licensed under the MIT License — see LICENSE. This is a derivative work ported from the MIT-licensed Dump-GUY/ida-nativeaot, which is itself ported from the MIT-licensed washi1337/ghidra-nativeaot.
Original research & Ghidra plugin: Washi — ghidra-nativeaot and the blog post Recovering NativeAOT Metadata.
IDA port & browser UI: Dump-GUY — ida-nativeaot
Binary Ninja port: YungBinary