Exetools - dnSpy - .NET assembly editor, debugger, decompiler

Exetools (https://forum.exetools.com/index.php)

- Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)

- - dnSpy - .NET assembly editor, debugger, decompiler (https://forum.exetools.com/showthread.php?t=16912)

dnSpy v6.1.9, released 2021-06-14

As you know official repository is archived by the owner (read-only state):

Code:

https://github.com/dnSpy/dnSpy

There is new continue - dnSpyEx based on original source:

Changelog:

Several updates to NRefactory resulting in cleaner output code for the C# language
Improved the IL disassembler/decompiler. More information is now displayed.
Improved BAML decompiler with latest changes from ILSpy repository.
Updated ICSharpCode.TreeView to the latest version
Dragging tree view items near the top and bottom will scroll the tree view
Improved assembly resolution for .NET Core and .NET 5
Improved asynchronous method decompilation

Download and more info:

Code:

https://github.com/dnSpyEx/dnSpy/releases

anybody srill has the Unity Mono dlls ?

unity-debugging-2019.x.zip
unity-debugging-2018.x.zip

looks like they were all removed from the website.

The source repos are still available:

Original: https://github.com/dnSpy/dnSpy-Unity-mono
dnSpyEx : https://github.com/dnSpyEx/dnSpy-Unity-mono

Some custom builds others have posted:

- https://github.com/wh0am15533/Patched-Unity-Mono/tree/main/CustomBuilds
- https://github.com/liesauer/Unity-debugging-dlls/releases

Thanks man, really helpful.

Sweet to see it active again, no idea why original dnSpy was archived? Apparently author's twitter got blocked too.

Pay attention to the web address below

Code:

hxxps://www.dnspy.net

Don't run the releases from this page!

The file dnspy.dll is modified and it contains MSHTA.exe exploit. It creates many entries in Task Scheduler (see Microsoft/Windows/Directx)! It will stop Windows Defender and will try to download and run exe files from 4api(dot)net (possible crypto miners).

Kaspersky reports dnspy.net as safe website !

I supose he is the same person who modified IDA...

I just found the article below:

Code:

hxxps://www.bleepingcomputer.com/news/security/trojanized-dnspy-app-drops-malware-cocktail-on-researchers-devs/amp/

This is the best tool for .net reversing in my opnion, thank you guys!

Quote:

Originally Posted by CrackDJ (Post 124809)

This is the best tool for .net reversing in my opnion, thank you guys!

The same for me :cool:

It is really sad to see that dnSpy and De4Dot programs have been archived and unmaintained for years.

They are slowly starting to struggle with the newer protections and dnspy still works because of the core reflection methodology, but de4dot has not be updated for 10+ years.

Wish I had more time to update it to support most widely available .NET obfuscators.

I have a couple of questions.

If I can get some answers, it will be helpful to build something around that for updating de4dot application.

Please list the most commonly used .NET obfuscators. Recently I'm encountering some heavily obfuscated .NET assemblies and it is taking a lot of time to understand the flow.

I'm not looking at cracking or patching or keygenning, but I'm trying to understand certain implementation to uncover security issues in such packed applications.

Because of the protections and obfuscation, it is taking a lot of time to uncover the flow and identify the control branching and variables.

Please list the most commonly used .NET assembly obfuscators (which mostly work after the release / debug compilation and directly on .DLL and .EXE files).

Thank you so much.

dnSpy is still continued by community members here:

Code:

https://github.com/dnSpyEx

I'd recommend checking out ILSpy as well now, it has been heavily updated since dnSpy came into existence. ILSpy's decompiler is, in my opinion, much better than dnSpy's currently as well. (dnSpy still has other features ILSpy doesn't have like a debugger etc. though.)

Quote:

Please list the most commonly used .NET obfuscators. Recently I'm encountering some heavily obfuscated .NET assemblies and it is taking a lot of time to understand the flow.

There's a fairly large list of them here: https://github.com/NotPrab/.NET-Obfuscator

There's a ton of custom forks of Confuser/ConfuserEx that have different names too, but most of the newer tools are all based on ConfuserEx for the most part.
Some others can be found via Google easily too.

Quote:

Originally Posted by atom0s (Post 125066)

dnSpy is still continued by community members here:

Code:

https://github.com/dnSpyEx

dnSpy .net decompiler is based on VERY old ILSpy engine... it is worse by an order of magniute comparing to ILSpy v7/8.x

but dnSpy has the super unique feature - .net debugger...
which is also started to be bad showing "Internal debugger error" in local tabs...

v6.2.0, released 2022-06-14

As of today, one full year has passed since the v6.1.9 release and I'm proud to announce that the v6.2.0 update is finally ready for release.

New features:

dnSpy now runs under .NET 6 and .NET Framework 4.8.
Move to VS2022 icons for UI and exe files (by @InKahootz and @SychicBoy)
Support for tilt/horizontal scrolling in the UI.
Added support for editing custom attributes on module resources.
Added support for modifying the Log2Rid value when saving the module.
Add support for ARM64 target architecture in the assembly editor.
Add an enum for PE Magic field in the PE editor (by @riQQ)
Show debugged process's name in the title bar (by @InKahootz)
Add support for writing VS2022 compatible .sln files.
Added back the Save Code, Save BAML, and Save XAML options in the File context menu which save the contents of the currently open document tab.
Debugger:
- Display a warning message before starting to debug a target file with a different bitness than the current dnSpy version running.
- Add a new option that allows to automatically break on <Module>::.cctor when starting to debug.
- Display the exception's HResult property when an unhandled exception is hit.
ILSpy decompiler:
- Added jump to reference support for jmp() expressions created when the jmp CIL opcode is present.
- CIL disassembler now includes information about generic parameter attributes and constraints.
- Add more information to the output when disassembling the module node when using the CIL disassembler.
- The decompiler now splits up long method call chains using a new line.
- Generate debug info for yield break; statements.

Improvements and bug fixes:

Fix the .NET 6 console executable having the incorrect subsystem set in the PE options resulting in a crash.
Fixed escaping of namespaces in tooltips.
Fixed syntax highlighting for structs in tooltips.
Improved RVA <-> FileOffset conversions in PE editor to fix a crash with invalid values being passed in.
Improved assembly resolution for .NET Standard, .NET Core, .NET 5, .NET 6.
dnSpy now reads assembly resolution probe paths from .config files.
Read probe paths from .config files when searching for satellite assemblies during project export.
Fixed incorrect label in the Save Module dialog.
Add support for searching by full name (by @mobile46).
Optimized search module by reducing memory allocations.
Improvements to GitHub Actions workflow (by @Gorialis).
Use .NET Standard instead of .NET Framework for Roslyn projects fixing #84 (by @mobile46).
ILSpy Decompiler
- Optimized the variable naming step in the decompiler by reducing memory allocations.
- Improved insertion of checked() blocks.
- Improved decompilation of query expressions.
- Prevent delegate construction decompilation from crashing the entire decompiler if it failed.
- Improved analysis for unsafe modifier.
- Ignore invalid prefixes when constructing the ILAst. This prevents a common method used to crash the decompiler from working.
- Many improvements and fixes to the async method decompilation logic.
- Optimized the removal of dead nop instructions when building the ILAst. This deficiency was a known method to crash dnSpy's decompiler by filling a method body with huge amounts of useless code.
- Fixed a rare case where field initializers would not be detected properly.
- Fixed a rarely occurring bug that resulted in incorrect ILAst being built.
- Optimized construction of ILAst by calculating the stack behavior of instruction only once and by caching the result of MethodDef.HasReturnType.
- Improved required parenthesis analysis.
- Fixed decompiler creating incorrect checked regions for some post increments.
Debugger:
- Fixed a bug that caused the infamous ??? exception to occur when debugging.
- Improved debugging support for newer mono runtimes.
- Fixed a crash that occurred in the .NET Framework version of dnSpy when a module loaded into memory during debugging would contain an invalid file path resulting in a crash.
BAML decompiler
- Resolve namespaces of properties.
- Fix Name attribute for properties incorrect in rare circumstances.
- Fix missing x:Static and x:Type (by @wwh1004)

Dependency updates:

Updated dnlib to 3.5.0
Updated Iced to 1.17.0
Roslyn compiler to 4.1.0
Ookii.Dialogs.Wpf to 5.0.1
VS MEF to 16.9.20
ILSpy to 2.4
Mono.Debugger.Soft was updated to the latest commit.

Note to extension developers: Please recompile your extensions for this version of dnSpyEx! Many dependencies have been updated and some of them have gone through API changes, for example, Iced.

Download and more info:

Code:

https://github.com/dnSpyEx/dnSpy/releases/tag/v6.2.0

dnSpy v6.3.0
2023-01-20

Changelog

Quote:

dnSpyEx 6.3.0 brings many improvements to the already existing components in dnSpy as well as features an improved search component. Many bugs and issues caused by obfuscated or malformed binaries have been fixed. The debugger received quite a lot of improvements for both the CorDebug and Mono APIs to improve the debugging experience. The decompiler has also received quite a few changes to help fix crashes and incorrect decompiled code. This update is recommended for all users of dnSpy and dnSpyEx!

New features:
• Improved Search tool window
  ○ Display member types in search results (return types, parameter types, etc.) to make it easier to locate the right member.
  ○ Tooltips on search results now contain more information, including full member signatures. If the result is located in a method body, the appropriate instruction is also included in the tooltip.
  ○ Literal and enum fields are now included in search results when searching for a constant.
  ○ Improved analysis of custom attributes. Previously arrays in custom attributes or boxed custom attributes were not searched, now they are.
  ○ Added an option to disable searching compiler-generated members.
  ○ Added support for searching DateTime resources when searching for constants.
  ○ Reduced heap allocations that occurred during the search process.
  ○ Include properties with literal constants in search results when searching for constants.
  ○ Refresh search results when a member was modified or deleted.
• Added a command under the File menu to close all framework and system assemblies (by @mitchcapper).
• Added a new context menu command for methods to replace their body with one which returns a default value and initializes all out parameters.
• Added support for exporting projects in the new SDK format in the form of a toggle in the project export dialog.
• Added additional toggles to the metadata writer options screen.
• Added support for .NET 7 assembly resolution.
• Added Vietnamese translations.
• Added an update checker to the About screen.
• Added support for displaying structure information for V1 multifile resources in the hex viewer.
• ILSpy decompiler:
  ○ Add an option to the decompiler settings to decompile calli instructions to invocation expressions. (co-authored by @cnsheds)
  ○ Add MethodCodeType field to [MethodImplOptions] attribute if necessary
• Debugger:
  ○ Add a new Static Fields tool window which displays and allows editing of values of all static fields available in the current context.
  ○ Add support for GetObjectValueAtAddress Roslyn expression compiler intrinsic. It is now possible to enter expressions like @0x12345678 to retrieve an object at a specific memory address. Due to debugger API limitations, this is only available when utilizing the CorDebug API (.NET Framework, .NET Core, .NET 5/6/7/etc.)
  ○ CorDebug:
    ■ Add support for Just My Code debugging including an option to disable stepping into system modules and an option to avoid stepping into code outside the primary module.
  ○ Mono/Unity:
    ■ Mono debugger API version of the debuggee is now written to the Output window when debugging is initiated.
    ■ Add support for dereferencing pointers in the Locals, Watch, etc. tool windows when using newer Mono debugger API versions.

Improvements and bug fixes:
• Added more links to the Help menu.
• Added support for displaying special C# types like nint, nuint, and dynamic in tooltips. Tuple element names are now also included.
• Added support for loading XMLDoc for .NET Core framework assemblies.
• Extended XMLDoc parser and analyzer to support documentation files generated by the MSVC compiler.
• Properly display the __arglist method parameter across the dnSpy UI.
• Properly update MethodSemanticsAttributes in the AsmEditor component.
• Fixed various bugs in the EventFiredBy analyzer.
• Fixed some bugs relating to parsing custom attributes.
• Improved detection of member obsolescence when displaying tooltips.
• Added support for displaying init property accessors in tooltips.
• Fixed an analyzer crash caused by invalid type attributes generated by obfuscators.
• Fixed a jump to reference issue in the entry point comment added when decompiling a module node
• ILSpy decompiler:
  ○ Fixed array initializer detection for enum arrays where the enum was located in a different module.
  ○ Fixed syntax highlighting color for preprocessor directives.
  ○ Fixed and improved delegate construction detection (co-authored by @mobile46).
  ○ Fixed decompiler not removing unnecessary parameter names in anonymous functions leading to compiler errors.
  ○ Improve debug info generation for inlined finally methods in yield return state machines.
  ○ Improve performance and reduced heap allocations in the decompiler and IL disassembler.
  ○ Extended type analysis for switch, throw, and ckfinite OpCodes.
  ○ Fixed a crash that occurred when the HandlerStart property of an exception handler was null (by @mobile46).
  ○ Fixed setting incorrect brace annotations for switch case blocks.
  ○ Extended support for methods utilizing the __arglist parameter.
  ○ Improved jump-to-reference navigation in the IL disassembler.
  ○ Improved ambiguous type name analysis.
  ○ Fixed a missing space not being added before the new() generic parameter constraint.
  ○ Fixed a rare bug that occurred when decompiling obfuscated exception handler filter blocks.
  ○ Fixed incorrect placement of the [Optional] attribute on a parameter with a decimal constant.
  ○ Fixed a nasty indentation bug in the C# decompiler leading to broken indentation of long property/method call chains
  ○ Improved decompilation of nested generic types for obfuscated assemblies where the type name does not contain generic argument count
• Debugger:
  ○ Fix a potential exception when searching a dynamic module (by @mitchcapper).
  ○ Improved debugger evaluation correctness and accuracy.
  ○ Fix timing issues in debugger thread dispatchers.
  ○ Display a warning message when detaching the debugger will lead to process termination.
  ○ Fix Locals windows failing to display locals when debugging a module with an invalid MVID.
  ○ Child nodes should not be displayed for values of types IntPtr and UIntPtr.
  ○ Fix the architecture incompatibility warning for files targeting .NET Framework 1.x but being executed on CLR version 2.
  ○ CorDebug:
    ■ Improve suppression of NGEN image loading leading to a better debugging experience for modules present in the GAC.
    ■ Introduce a workaround for a .NET 6.0 bug that occurred when a debugger was attached to a process that utilized dynamic modules. (by @josegomez)
    ■ Use the CorDebug API directly to read thread and exception information to avoid issues with certain anti-dumping techniques.
    ■ Improve debugging support for legacy .NET Framework versions.
  ○ Mono/Unity:
    ■ Improved dynamic module detection and metadata fetching for newer Mono debugger API versions.
    ■ Fix computation of OffsetToStringData value resulting in improved evaluation accuracy and fixed Show in Memory command result.
    ■ Improved and optimized computation of OffsetToArrayData, it should now work smoother on newer Mono debugger API versions.
    ■ Use MDToken-based resolution for types and methods when possible on newer Mono debugger API versions.
    ■ Improve the result of the Show in Memory command for objects on newer Mono debugger API versions.
• BAML decompiler:
  ○ Improved analysis of BAML connection IDs.
  ○ Fixed incorrect decompilation of readonly properties in XAML code.
  ○ Fixed a crash resulting from unescaped member identifiers.

Dependency updates:
• Updated dnlib to 3.6.0
• Updated Iced to 1.18.0
• Roslyn compiler to 4.4.0
• VS MEF to 17.2.4

Download

Code:

https://github.com/dnSpyEx/dnSpy/releases/tag/v6.3.0

- Standalone x86:

Code:

https://github.com/dnSpyEx/dnSpy/releases/download/v6.3.0/dnSpy-net-win32.zip

- Standalone x64:

Code:

https://github.com/dnSpyEx/dnSpy/releases/download/v6.3.0/dnSpy-net-win64.zip

- Standalone with .NET Core x86:

Code:

https://github.com/dnSpyEx/dnSpy/releases/download/v6.3.0/dnSpy-netframework.zip