Scott Hanselman

What's better than ILDasm? ILSpy and dnSpy are tools to Decompile .NET Code

May 30, '19 Comments [19] Posted in Open Source | Tools
Sponsored By

.NET code (C#, VB, F#, etc) compiles (for the most part) into Intermediate Language (IL) and then makes it way to native code usually by Just-in-time (JIT) compilation on the target machine. When you get a DLL/Assembly, it's pre-chewed but not full juiced, to mix my metaphors.

Often you'll come along a DLL that you want to learn more about. Sometimes you'll want to just see the structure of classes, methods, etc, and other times you want to see the IL - or a close representation of the original C#/VB/F#, etc. You're not looking at the source, you're seeing a backwards projection of the IL as whatever language you want. You're basically taking this pre-chewed food and taking it out of your mouth and getting a decent idea of what it was originally.

I've used ILDasm for years, but it's old and lame and people tease you for using it because they are cruel. ;)

Seriously, though, I use ILDasm - the IL Disassembler - simply because it's already installed. Those tweets got me thinking though that I need to update my options, so I'm trying out ILSpy and dnSpy.

ILSpy

ILSpy has been around for a while and has multiple front-ends, including ones for Linux/Mac/Windows based on Avalonia in the form of AvaloniaSpy. You can also integrate ILSpy into Visual Studio 2017 or 2019 with this extension. There is also a console decompiler and, interestingly, cross-platform PowerShell cmdlets.

ILSpy is a solid .NET decompiler

I've always liked the "Open List" feature of ILSpy where you can open a preconfigured list of assemblies you want to browse, like ASP.NET MVC, .NET 4, etc. A fun open source contribution for you might be to update the included lists with newer defaults. There's so many folks doing great work in open source out there, why not jump in and help them out?

dnSpy

dnSpy has a lovely UI AND a great Console app using the same engine. It's amazingly polished and VERY complete. I was surprised that it also has a full hex editor as well as property pages for common EXE file headers. From their GitHub, dnSpy features

  • Debug .NET Framework, .NET Core and Unity game assemblies, no source code required
  • Edit assemblies in C# or Visual Basic or IL, and edit all metadata
  • Light and dark themes
  • Extensible, write your own extension
  • High DPI support (per-monitor DPI aware)

dnSpy takes it to the next level with an integrated Debugger, meaning you can attach to a running process and debug it without source code - but it feels like source code because it's decompiling for you. Note where it says C#, I can choose C#, VB, or IL as a "view" on my decompiled code.

dnSpy is amazing for looking inside .NET apps

Here is dnSpy actually debugging ILSpy and stopped at a decompiled breakpoint.

image

There's a lot of great low-level stuff in this space. Another cool tool is Reflexil, a .NET Assembly Editor as well as de4dot by the same mysterious author as dnSpy. JetBrains has the excellent dotPeek and Telerik has JustDecompile. Commercial Tools include Reflector.

What's your favorite?


Sponsor: Manage GitHub Pull Requests right from the IDE with the latest JetBrains Rider. An integrated performance profiler on Windows comes to the rescue as well.

About Scott

Scott Hanselman is a former professor, former Chief Architect in finance, now speaker, consultant, father, diabetic, and Microsoft employee. He is a failed stand-up comic, a cornrower, and a book author.

facebook twitter subscribe
About   Newsletter
Sponsored By
Hosting By
Dedicated Windows Server Hosting by SherWeb
Tuesday, June 04, 2019 7:51:43 AM UTC
JetBrains dotPeek is another great free decompiler.
Oliver Hanappi
Tuesday, June 04, 2019 8:11:44 AM UTC
I knew about ILSpy and use it all the time, but now I will check DNSPY as it will help a lot to actually debug the DLLs.
Thanks
Shahar
Tuesday, June 04, 2019 8:15:48 AM UTC
When did JustDecompile go commercial? The website still says it's free.
Richard
Tuesday, June 04, 2019 8:59:20 AM UTC
Interesting that the article is sponsored by JetBrains and that dotPeek isn't mentioned. Which offers a symbol server, allowing any .NET debugger to step through decompiled sources.

And I've been a long user of Reflector .NET long before it became part of Red-Gate. It's been my default tool to find things in the Azure DevOps object model and other libraries with questionable levels of Documentation ;).
Tuesday, June 04, 2019 10:18:56 AM UTC
I also made the Reflector -> dotPeek journey. And once you have a good tool, you stop looking.
Palle Due Larsen
Tuesday, June 04, 2019 11:08:17 AM UTC
I've used dnSpy to edit and save a DLL file for which the source code was lost. Felt like magic.
Gustav Tonér
Tuesday, June 04, 2019 1:26:15 PM UTC
dotPeek. How come as mentioned above it's not part of the list. It's free (not commercial as mentioned either).
Tuesday, June 04, 2019 1:35:44 PM UTC
Recent versions of Visual Studio actually have ILSpy built-in if you enable it.
Joe Sewell
Tuesday, June 04, 2019 3:08:00 PM UTC
I've gone through several of these tools, but JetBrains' DotPeek is the winner for me. It has great integration with ReSharper so you can actually use the ctrl + click go to definition shortcut to decompile from within your code. Then if you do open the full DotPeek UI and decompile an assembly you can use the standard Resharper fuzzy search; handy if you're looking for a specific type in an unfamiliar assembly.
Justin Madill
Tuesday, June 04, 2019 4:37:03 PM UTC
JetBrain's dotPeek. It produces .cs and .csproj files which are can be opened in Visual Studio and therefore you can navigate between the code like the declaration of a type. Telerik's justDecompile does this also.

To compare these tools, it's best to look at the quality of the c# they produce and how they handle obfuscated assemblies.
Abdu
Tuesday, June 04, 2019 6:55:37 PM UTC
Love and use ILSpy. It is powered by amazing Mono.Cecil library. Helping a lot in a compiled code analysis if you do have any kind of dependency tracking ;)
Have not tried dnSpy. Will try it. Thanks a lot.
Tomas
Tuesday, June 04, 2019 8:15:36 PM UTC
The week of the blog is sponsored by Jetbrains, not individual posts. I hadn't thought about dotPeek in a while, but you're all right. I added a link!
Scott Hanselman
Tuesday, June 04, 2019 8:52:17 PM UTC
dnSpy is pure Gold. You can debug on an installed machine with full Visual Studio feeling by unpacking a 20 MB zip file and you are ready to go. It also helps to debug rare errors by the ability to decompile an assembly, inject some exception which happens only once in thousand iterations and you can follow your error handling with ease in a predicatable manner without the need to wait for the error to happen again. Much better than Windbg which still doesn´t know anything about C# source code stepping.
Tuesday, June 04, 2019 10:56:03 PM UTC
Scott, what tools would you recommend to protect my C# DLLs from being reverse engineered?
rod macdonald
Wednesday, June 05, 2019 5:15:26 AM UTC
It was a very interesting topic. but when I've used dnSpy to edit and save a DLL file I am getting an error. How can I resolve it?
Wednesday, June 05, 2019 9:01:16 PM UTC
best dating sites for lgbt http://big-girl-looking-for-love.seekingarrangement-com.bestonlinedating.website my friend is dating a married man
Wednesday, June 05, 2019 9:09:51 PM UTC
I've been using dnSpy for a few years, it has saved my arse so many times when I need to debug things where the symbols misbehaving, problems in the startup code of a process, or you need to remote debug something, especially on machines not on your domain (e.g. Azure DevTest).
Wednesday, June 05, 2019 9:28:20 PM UTC
lgbtq dating apps http://local-singals.cupid-com.bestonlinedating.website dating with cold sores
Thursday, June 06, 2019 5:40:58 PM UTC
To clarify, JustDecompile and dotPeek are, in fact, "commercial" tools. They are close-source products of for-profit companies. Those companies choose to give them away for free (which is great) but doesn't change the essential nature of them.

Both ILSpy and DNSpy are open-source, hence non-commercial. (I'm not sure if ICSharpCode -- maker of ILSpy -- is a for-profit company or just a collective of volunteer coders; DNSpy seems to be by a solo developer)
Comments are closed.

Disclaimer: The opinions expressed herein are my own personal opinions and do not represent my employer's view in any way.