If I'm looking at a binary compiled with VC++ in a hex editor and I want to identify the start of functions - I can look for the hex 55 8B - which is a common function prolog.Is there something equivalent with .net CIL? I.e. is there a hex pattern I can look for to identify the start of functions raw?The application here is to look for shared code between malware samples.
Do .NET functions have function prologs?
assembly;hex;.net
There is no real prolog in IL code because it does not need to manage the stack, save clobbered registers, or do any other standard bookkeeping necessary in the native code. However, the bytecode itself is preceded by the method header, and those have a limited number of possibilities. From the book .NET IL Assembler:Method Header AttributesThe RVA value (if it is nonzero) of a Method record points to the  method body. Two types of method headersfat and tinyare defined in  CorHdr.h. The first two bits of the header indicate its type: bit 10  stands for the tiny format, and bit 11 stands for the fat format. [...] A tiny method header is only 1 byte in size, with the first two  (least significant) bits holding the type10and the six remaining  bits holding the method IL code size in bytes. A method is given a  tiny header if it has neither local variables nor managed exception  handling, if it works fine with the default evaluation stack depth of  8 slots, and if its code size is less than 64 bytes.  A fat header is  12 bytes in size and has the structure described in Table 10-1. The  fat headers must begin at 4-byte boundaries. Figure 10-4 shows the  structures of both tiny and fat method headers.So if you take some .NET binaries, look up method RVAs in the metadata and go to that RVA in the binary, you can collect some patterns of headers and use them to find bytecode in the binary. (although I would suggest just using metadata in the first place - it lists locations of all legitimate methods in the binary).