Decompile and deobfuscate .NET assemblies using dnSpy, ILSpy, and de4dot.
npx skills add https://github.com/dslsdzc/rev-skills --skill re-dotnet-dslsdzc
Please help me install this Agent Skill. Skill: re-dotnet Source: https://github.com/dslsdzc/rev-skills/tree/main/.claude/skills/re-dotnet Command: npx skills add https://github.com/dslsdzc/rev-skills --skill re-dotnet-dslsdzc
file output, mscoree imports, and the PE CLI header (COM Descriptor data directory), including ReadyToRun and NativeAOT variants. - Decompilation: Use ilspycmd CLI or ILSpy/dnSpy GUI to convert CIL back to C#, with directory-level batch decompilation for multi-assembly targets. - Deobfuscation: Run de4dot to automatically detect and remove ConfuserEx/SmartAssembly string encryption and control-flow obfuscation, with manual fallback strategies. - Use Case: Given a suspected .NET malware sample, confirm it is managed, unpack any single-file bundle with sfextract, deobfuscate with de4dot, then locate registration-key checks or network URLs in the decompiled C# code. ## Quick Start Analyze the attached sample.exe to determine if it is a .NET assembly, then decompile it to readable C# and locate any license-check or network logic.High-intent search queries and answers about installing and using this skill.
Use ilspycmd with the command `ilspycmd sample.exe -p -o decompiled/` to generate a full C# project, or open the file in ILSpy or dnSpy GUI and browse the class tree. First confirm it is a managed assembly with `file` or by checking for mscoree imports.
Run de4dot with `mono de4dot.exe -p ce sample.exe` to automatically remove ConfuserEx string encryption and control-flow obfuscation, producing a cleaned assembly. If de4dot fails on newer obfuscator versions, use community forks or manually replicate the string decryption routine.
dnSpy (Windows only) combines decompilation, editing, and debugging in one tool, while ILSpy runs cross-platform on Linux, macOS, and Windows with both GUI and ilspycmd CLI. Use ILSpy on non-Windows systems or dnSpy under Wine.
The file is likely a self-contained single-file bundle or NativeAOT binary. Extract bundles first with `sfextract sample.exe -o extracted/` or ILSpy's built-in extraction; NativeAOT binaries have no CLR metadata and must be analyzed as native code.
C# string literals are stored as UTF-16LE in the #US metadata stream, which default `strings` misses. Use `strings -e l sample.exe` to search UTF-16LE content for URLs, keys, and other literals.
Yes, static decompilation and deobfuscation work on Linux via ILSpy/ilspycmd and de4dot under mono. Dynamic analysis steps like Frida hooking or dotnet-dump should run inside a sandboxed environment.
258369123Analyze binary files with Ghidra to identify function purpose, encryption, and C2 servers.
charles2ganAutomate Android APK malware analysis with GDA.exe across phased workflows.
wgpsecAnalyzes CTF Windows malware samples to reveal hidden C2 infrastructure and decrypt payloads via static and dynamic methods.
2389-researchAnalyze binary structure and decompile functions with radare2 and Ghidra headless.