Scott Hanselman

What's better than ILDasm? ILSpy and dnSpy are tools to Decompile .NET Code

May 31, 2019 Comment on this post [19] Posted in Open Source | Tools
Sponsored By

.NET code (C#, VB, F#, etc) compiles (for the most part) into Intermediate Language (IL) and then makes it way to native code usually by Just-in-time (JIT) compilation on the target machine. When you get a DLL/Assembly, it's pre-chewed but not full juiced, to mix my metaphors.

Often you'll come along a DLL that you want to learn more about. Sometimes you'll want to just see the structure of classes, methods, etc, and other times you want to see the IL - or a close representation of the original C#/VB/F#, etc. You're not looking at the source, you're seeing a backwards projection of the IL as whatever language you want. You're basically taking this pre-chewed food and taking it out of your mouth and getting a decent idea of what it was originally.

I've used ILDasm for years, but it's old and lame and people tease you for using it because they are cruel. ;)

Seriously, though, I use ILDasm - the IL Disassembler - simply because it's already installed. Those tweets got me thinking though that I need to update my options, so I'm trying out ILSpy and dnSpy.

ILSpy

ILSpy has been around for a while and has multiple front-ends, including ones for Linux/Mac/Windows based on Avalonia in the form of AvaloniaSpy. You can also integrate ILSpy into Visual Studio 2017 or 2019 with this extension. There is also a console decompiler and, interestingly, cross-platform PowerShell cmdlets.

ILSpy is a solid .NET decompiler

I've always liked the "Open List" feature of ILSpy where you can open a preconfigured list of assemblies you want to browse, like ASP.NET MVC, .NET 4, etc. A fun open source contribution for you might be to update the included lists with newer defaults. There's so many folks doing great work in open source out there, why not jump in and help them out?

dnSpy

dnSpy has a lovely UI AND a great Console app using the same engine. It's amazingly polished and VERY complete. I was surprised that it also has a full hex editor as well as property pages for common EXE file headers. From their GitHub, dnSpy features

  • Debug .NET Framework, .NET Core and Unity game assemblies, no source code required
  • Edit assemblies in C# or Visual Basic or IL, and edit all metadata
  • Light and dark themes
  • Extensible, write your own extension
  • High DPI support (per-monitor DPI aware)

dnSpy takes it to the next level with an integrated Debugger, meaning you can attach to a running process and debug it without source code - but it feels like source code because it's decompiling for you. Note where it says C#, I can choose C#, VB, or IL as a "view" on my decompiled code.

dnSpy is amazing for looking inside .NET apps

Here is dnSpy actually debugging ILSpy and stopped at a decompiled breakpoint.

image

There's a lot of great low-level stuff in this space. Another cool tool is Reflexil, a .NET Assembly Editor as well as de4dot by the same mysterious author as dnSpy. JetBrains has the excellent dotPeek and Telerik has JustDecompile. Commercial Tools include Reflector.

What's your favorite?


Sponsor: Manage GitHub Pull Requests right from the IDE with the latest JetBrains Rider. An integrated performance profiler on Windows comes to the rescue as well.

About Scott

Scott Hanselman is a former professor, former Chief Architect in finance, now speaker, consultant, father, diabetic, and Microsoft employee. He is a failed stand-up comic, a cornrower, and a book author.

facebook twitter subscribe
About   Newsletter
Hosting By
Hosted in an Azure App Service
June 04, 2019 11:51
JetBrains dotPeek is another great free decompiler.
June 04, 2019 12:11
I knew about ILSpy and use it all the time, but now I will check DNSPY as it will help a lot to actually debug the DLLs.
Thanks
June 04, 2019 12:15
When did JustDecompile go commercial? The website still says it's free.
June 04, 2019 12:59
Interesting that the article is sponsored by JetBrains and that dotPeek isn't mentioned. Which offers a symbol server, allowing any .NET debugger to step through decompiled sources.

And I've been a long user of Reflector .NET long before it became part of Red-Gate. It's been my default tool to find things in the Azure DevOps object model and other libraries with questionable levels of Documentation ;).
June 04, 2019 14:18
I also made the Reflector -> dotPeek journey. And once you have a good tool, you stop looking.
June 04, 2019 15:08
I've used dnSpy to edit and save a DLL file for which the source code was lost. Felt like magic.
June 04, 2019 17:26
dotPeek. How come as mentioned above it's not part of the list. It's free (not commercial as mentioned either).
June 04, 2019 17:35
Recent versions of Visual Studio actually have ILSpy built-in if you enable it.
June 04, 2019 19:08
I've gone through several of these tools, but JetBrains' DotPeek is the winner for me. It has great integration with ReSharper so you can actually use the ctrl + click go to definition shortcut to decompile from within your code. Then if you do open the full DotPeek UI and decompile an assembly you can use the standard Resharper fuzzy search; handy if you're looking for a specific type in an unfamiliar assembly.
June 04, 2019 20:37
JetBrain's dotPeek. It produces .cs and .csproj files which are can be opened in Visual Studio and therefore you can navigate between the code like the declaration of a type. Telerik's justDecompile does this also.

To compare these tools, it's best to look at the quality of the c# they produce and how they handle obfuscated assemblies.
June 04, 2019 22:55
Love and use ILSpy. It is powered by amazing Mono.Cecil library. Helping a lot in a compiled code analysis if you do have any kind of dependency tracking ;)
Have not tried dnSpy. Will try it. Thanks a lot.
June 05, 2019 0:15
The week of the blog is sponsored by Jetbrains, not individual posts. I hadn't thought about dotPeek in a while, but you're all right. I added a link!
June 05, 2019 0:52
dnSpy is pure Gold. You can debug on an installed machine with full Visual Studio feeling by unpacking a 20 MB zip file and you are ready to go. It also helps to debug rare errors by the ability to decompile an assembly, inject some exception which happens only once in thousand iterations and you can follow your error handling with ease in a predicatable manner without the need to wait for the error to happen again. Much better than Windbg which still doesn´t know anything about C# source code stepping.
June 05, 2019 2:56
Scott, what tools would you recommend to protect my C# DLLs from being reverse engineered?
June 05, 2019 9:15
It was a very interesting topic. but when I've used dnSpy to edit and save a DLL file I am getting an error. How can I resolve it?
June 06, 2019 1:01
best dating sites for lgbt http://big-girl-looking-for-love.seekingarrangement-com.bestonlinedating.website my friend is dating a married man
June 06, 2019 1:09
I've been using dnSpy for a few years, it has saved my arse so many times when I need to debug things where the symbols misbehaving, problems in the startup code of a process, or you need to remote debug something, especially on machines not on your domain (e.g. Azure DevTest).
June 06, 2019 1:28
lgbtq dating apps http://local-singals.cupid-com.bestonlinedating.website dating with cold sores
June 06, 2019 21:40
To clarify, JustDecompile and dotPeek are, in fact, "commercial" tools. They are close-source products of for-profit companies. Those companies choose to give them away for free (which is great) but doesn't change the essential nature of them.

Both ILSpy and DNSpy are open-source, hence non-commercial. (I'm not sure if ICSharpCode -- maker of ILSpy -- is a for-profit company or just a collective of volunteer coders; DNSpy seems to be by a solo developer)

Comments are closed.

Disclaimer: The opinions expressed herein are my own personal opinions and do not represent my employer's view in any way.