Exetools

Exetools (https://forum.exetools.com/index.php)
-   Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)
-   -   dnSpy - .NET assembly editor, debugger, decompiler (https://forum.exetools.com/showthread.php?t=16912)

DARKER 06-18-2021 18:22

dnSpy v6.1.9, released 2021-06-14

As you know official repository is archived by the owner (read-only state):
Code:

https://github.com/dnSpy/dnSpy
There is new continue - dnSpyEx based on original source:

Changelog:
  • Several updates to NRefactory resulting in cleaner output code for the C# language
  • Improved the IL disassembler/decompiler. More information is now displayed.
  • Improved BAML decompiler with latest changes from ILSpy repository.
  • Updated ICSharpCode.TreeView to the latest version
  • Dragging tree view items near the top and bottom will scroll the tree view
  • Improved assembly resolution for .NET Core and .NET 5
  • Improved asynchronous method decompilation

Download and more info:
Code:

https://github.com/dnSpyEx/dnSpy/releases

Kurapica 11-03-2021 15:36

anybody srill has the Unity Mono dlls ?

unity-debugging-2019.x.zip
unity-debugging-2018.x.zip

looks like they were all removed from the website.

atom0s 11-03-2021 16:30

The source repos are still available:

Original: https://github.com/dnSpy/dnSpy-Unity-mono
dnSpyEx : https://github.com/dnSpyEx/dnSpy-Unity-mono

Some custom builds others have posted:

- https://github.com/wh0am15533/Patched-Unity-Mono/tree/main/CustomBuilds
- https://github.com/liesauer/Unity-debugging-dlls/releases

Kurapica 11-03-2021 17:41

Thanks man, really helpful.

klvgen 11-04-2021 00:16

Sweet to see it active again, no idea why original dnSpy was archived? Apparently author's twitter got blocked too.

val2032 01-07-2022 05:44

Pay attention to the web address below

Code:

hxxps://www.dnspy.net
Don't run the releases from this page!

The file dnspy.dll is modified and it contains MSHTA.exe exploit. It creates many entries in Task Scheduler (see Microsoft/Windows/Directx)! It will stop Windows Defender and will try to download and run exe files from 4api(dot)net (possible crypto miners).

Kaspersky reports dnspy.net as safe website !

val2032 01-09-2022 07:53

I supose he is the same person who modified IDA...

I just found the article below:
Code:

hxxps://www.bleepingcomputer.com/news/security/trojanized-dnspy-app-drops-malware-cocktail-on-researchers-devs/amp/

CrackDJ 02-16-2022 06:03

This is the best tool for .net reversing in my opnion, thank you guys!

zionoobie 02-18-2022 19:09

Quote:

Originally Posted by CrackDJ (Post 124809)
This is the best tool for .net reversing in my opnion, thank you guys!

The same for me :cool:

foosaa 03-27-2022 14:20

It is really sad to see that dnSpy and De4Dot programs have been archived and unmaintained for years.

They are slowly starting to struggle with the newer protections and dnspy still works because of the core reflection methodology, but de4dot has not be updated for 10+ years.

Wish I had more time to update it to support most widely available .NET obfuscators.

I have a couple of questions.

If I can get some answers, it will be helpful to build something around that for updating de4dot application.

Please list the most commonly used .NET obfuscators. Recently I'm encountering some heavily obfuscated .NET assemblies and it is taking a lot of time to understand the flow.

I'm not looking at cracking or patching or keygenning, but I'm trying to understand certain implementation to uncover security issues in such packed applications.

Because of the protections and obfuscation, it is taking a lot of time to uncover the flow and identify the control branching and variables.

Please list the most commonly used .NET assembly obfuscators (which mostly work after the release / debug compilation and directly on .DLL and .EXE files).

Thank you so much.

atom0s 03-28-2022 08:46

dnSpy is still continued by community members here:
Code:

https://github.com/dnSpyEx
I'd recommend checking out ILSpy as well now, it has been heavily updated since dnSpy came into existence. ILSpy's decompiler is, in my opinion, much better than dnSpy's currently as well. (dnSpy still has other features ILSpy doesn't have like a debugger etc. though.)

atom0s 03-28-2022 09:43

Quote:

Please list the most commonly used .NET obfuscators. Recently I'm encountering some heavily obfuscated .NET assemblies and it is taking a lot of time to understand the flow.
There's a fairly large list of them here: https://github.com/NotPrab/.NET-Obfuscator

There's a ton of custom forks of Confuser/ConfuserEx that have different names too, but most of the newer tools are all based on ConfuserEx for the most part.
Some others can be found via Google easily too.

sendersu 04-02-2022 02:03

Quote:

Originally Posted by atom0s (Post 125066)
dnSpy is still continued by community members here:
Code:

https://github.com/dnSpyEx
I'd recommend checking out ILSpy as well now, it has been heavily updated since dnSpy came into existence. ILSpy's decompiler is, in my opinion, much better than dnSpy's currently as well. (dnSpy still has other features ILSpy doesn't have like a debugger etc. though.)

dnSpy .net decompiler is based on VERY old ILSpy engine... it is worse by an order of magniute comparing to ILSpy v7/8.x

but dnSpy has the super unique feature - .net debugger...
which is also started to be bad showing "Internal debugger error" in local tabs...

DARKER 06-15-2022 14:59

v6.2.0, released 2022-06-14

As of today, one full year has passed since the v6.1.9 release and I'm proud to announce that the v6.2.0 update is finally ready for release.

New features:
  • dnSpy now runs under .NET 6 and .NET Framework 4.8.
  • Move to VS2022 icons for UI and exe files (by @InKahootz and @SychicBoy)
  • Support for tilt/horizontal scrolling in the UI.
  • Added support for editing custom attributes on module resources.
  • Added support for modifying the Log2Rid value when saving the module.
  • Add support for ARM64 target architecture in the assembly editor.
  • Add an enum for PE Magic field in the PE editor (by @riQQ)
  • Show debugged process's name in the title bar (by @InKahootz)
  • Add support for writing VS2022 compatible .sln files.
  • Added back the Save Code, Save BAML, and Save XAML options in the File context menu which save the contents of the currently open document tab.
  • Debugger:
    • Display a warning message before starting to debug a target file with a different bitness than the current dnSpy version running.
    • Add a new option that allows to automatically break on <Module>::.cctor when starting to debug.
    • Display the exception's HResult property when an unhandled exception is hit.
  • ILSpy decompiler:
    • Added jump to reference support for jmp() expressions created when the jmp CIL opcode is present.
    • CIL disassembler now includes information about generic parameter attributes and constraints.
    • Add more information to the output when disassembling the module node when using the CIL disassembler.
    • The decompiler now splits up long method call chains using a new line.
    • Generate debug info for yield break; statements.

Improvements and bug fixes:

  • Fix the .NET 6 console executable having the incorrect subsystem set in the PE options resulting in a crash.
  • Fixed escaping of namespaces in tooltips.
  • Fixed syntax highlighting for structs in tooltips.
  • Improved RVA <-> FileOffset conversions in PE editor to fix a crash with invalid values being passed in.
  • Improved assembly resolution for .NET Standard, .NET Core, .NET 5, .NET 6.
  • dnSpy now reads assembly resolution probe paths from .config files.
  • Read probe paths from .config files when searching for satellite assemblies during project export.
  • Fixed incorrect label in the Save Module dialog.
  • Add support for searching by full name (by @mobile46).
  • Optimized search module by reducing memory allocations.
  • Improvements to GitHub Actions workflow (by @Gorialis).
  • Use .NET Standard instead of .NET Framework for Roslyn projects fixing #84 (by @mobile46).
  • ILSpy Decompiler
    • Optimized the variable naming step in the decompiler by reducing memory allocations.
    • Improved insertion of checked() blocks.
    • Improved decompilation of query expressions.
    • Prevent delegate construction decompilation from crashing the entire decompiler if it failed.
    • Improved analysis for unsafe modifier.
    • Ignore invalid prefixes when constructing the ILAst. This prevents a common method used to crash the decompiler from working.
    • Many improvements and fixes to the async method decompilation logic.
    • Optimized the removal of dead nop instructions when building the ILAst. This deficiency was a known method to crash dnSpy's decompiler by filling a method body with huge amounts of useless code.
    • Fixed a rare case where field initializers would not be detected properly.
    • Fixed a rarely occurring bug that resulted in incorrect ILAst being built.
    • Optimized construction of ILAst by calculating the stack behavior of instruction only once and by caching the result of MethodDef.HasReturnType.
    • Improved required parenthesis analysis.
    • Fixed decompiler creating incorrect checked regions for some post increments.
  • Debugger:
    • Fixed a bug that caused the infamous ??? exception to occur when debugging.
    • Improved debugging support for newer mono runtimes.
    • Fixed a crash that occurred in the .NET Framework version of dnSpy when a module loaded into memory during debugging would contain an invalid file path resulting in a crash.
  • BAML decompiler
    • Resolve namespaces of properties.
    • Fix Name attribute for properties incorrect in rare circumstances.
    • Fix missing x:Static and x:Type (by @wwh1004)
Dependency updates:
  • Updated dnlib to 3.5.0
  • Updated Iced to 1.17.0
  • Roslyn compiler to 4.1.0
  • Ookii.Dialogs.Wpf to 5.0.1
  • VS MEF to 16.9.20
  • ILSpy to 2.4
  • Mono.Debugger.Soft was updated to the latest commit.

Note to extension developers: Please recompile your extensions for this version of dnSpyEx! Many dependencies have been updated and some of them have gone through API changes, for example, Iced.

Download and more info:
Code:

https://github.com/dnSpyEx/dnSpy/releases/tag/v6.2.0


All times are GMT +8. The time now is 06:31.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2022, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX