.NET Debugger and Assembly Editor – dnSpy

CyberPunk Reverse Engineering
.NET Debugger and Assembly Editor – dnSpy

Introduction

dnSpy is a tool to reverse engineer .NET assemblies, including .NET debugger, a decompiler and an assembly editor. This tool can be easily extended by writing custom and your own plugin. It uses dnlib to read and write assemblies so it can handle obfuscated assemblies without crashing.

dnSpy: .NET debugger, decompiler & assembly editor

This amazing tool is open source, forever free and has very modern and intuitive design, kinda similar to Visual Studio. It uses many open source libraries:

  • ILSpy decompiler engine: C# and Visual Basic decompilers
  • Roslyn: C# and Visual Basic compilers
  • dnlib: .NET metadata reader/writer which can also read obfuscated assemblies
  • VS MEF: Faster MEF equals faster startup
  • ClrMD: Access to lower level debugging info not provided by the CorDebug API

Features

  • Debug .NET Framework, .NET Core and Unity game assemblies, no source code required
  • Edit assemblies in C# or Visual Basic or IL, and edit all metadata
  • High DPI support (per-monitor DPI aware)
  • Extensible, write your own extension
  • BAML decompiler
  • Blue, light and dark themes (and a dark high contrast theme)
  • Bookmarks
  • C# Interactive window can be used to script dnSpy
  • Search assemblies for classes, methods, strings etc
  • Analyze class and method usage, find callers etc
  • Multiple tabs and tab groups
  • References are highlighted, use Tab / Shift+Tab to move to next reference
  • Go to entry point and module initializer commands
  • Go to metadata token or metadata row commands
  • Code tooltips (C# and Visual Basic)
  • Export to project

Debugger

  • Debug .NET Framework, .NET Core and Unity game assemblies, no source code required
  • Set breakpoints and step into any assembly
  • Locals, watch, autos windows
  • Variables windows supports saving variables (eg. decrypted byte arrays) to disk or view them in the hex editor (memory window)
  • Object IDs
  • Multiple processes can be debugged at the same time
  • Break on module load
  • Tracepoints and conditional breakpoints
  • Export/import breakpoints and tracepoints
  • Call stack, threads, modules, processes windows
  • Break on thrown exceptions (1st chance)
  • Variables windows support evaluating C# / Visual Basic expressions
  • Dynamic modules can be debugged (but not dynamic methods due to CLR limitations)
  • Output window logs various debugging events, and it shows timestamps by default 🙂
  • Assemblies that decrypt themselves at runtime can be debugged, dnSpy will use the in-memory image. You can also force dnSpy to always use in-memory images instead of disk files.
  • Public API, you can write an extension or use the C# Interactive window to control the debugger

.NET Debugger

Assembly Editor

  • Editable metadata
  • Edit methods and classes in C# or Visual Basic with IntelliSense, no source code required
  • Add new methods, classes or members in C# or Visual Basic
  • IL editor for low level IL method body editing
  • Low level metadata also editable. This uses the hex editor internally.

Hex Editor

  • Click on an address in the decompiled code to go to its IL code in the hex editor
  • Reverse of above, press F12 in an IL body in the hex editor to go to the decompiled code or other high level representation of the bits. It’s great to find out which statement a patch modified.
  • Highlights .NET metadata structures and PE structures
  • Tooltips shows more info about the selected .NET metadata / PE field
  • Go to position, file, RVA
  • Go to .NET metadata token, method body, #Blob / #Strings / #US heap offset or #GUID heap index
  • Follow references (Ctrl+F12)

dnSpy Download

$ git clone --recursive https://github.com/0xd4d/dnSpy.git
Important: Windows – Make sure you use the latest/updated version of Visual Studio to compile the source code, and don’t forget to install all sub modules.

Usage

dnSpy.exe [files and options] [-- files]

Arguments

--settings-file <filename>              Override name of settings file (dnSpy.xml)
--multiple                              Allow multiple dnSpy instances
--dont-activate / --no-activate         Don't focus the dnSpy window
-l <language> / --language              Selects a language. Either human readable, eg. C# or a GUID, eg. F5A318D4-4B2A-48D2-AE33-F4D2B1EFF4B0
--culture <code>                        Selects display language, eg. --culture de
--new-tab                               Shows the file or member in a new tab
--select <member>                       Selects the member. It must be located in one of the opened files. member can be a metadata token, eg. --select 0x06001234 or an XML doc reference, eg. --select T:System.Type
--search <text>                         Searches for text
--search-for <type>                     Searches for type, one of asm, assembly, mod, module, ns, namespace, t, type, f, field, m, method, p, prop, property, e, evt, event, pm, param, loc, local, pl, pmloc, pm-loc, paramlocal, param-local, ar, asmref, asm-ref, assembly-ref, mr, modref, mod-ref, module-ref, r, res, rsrc, resource, generic, non-generic, enum, if, iface, interface, cl, class, st, struct, del, delegate, member, any, lit, literal, const, constant
--hide-tool-window <info>               Hides tool window(s), see --show-tool-window for more information.
--settings / --settings:guid            Shows the options dialog box.
Documentation Box
Download Box
.NET FrameworkC#DebuggerDecompiler