Is there any way to decompile a .NET assembly or program?

38

16

Are there any tools available to take an already compiled .dll or .exe file that you know was compiled from C# or Visual Basic and obtain the original source code from it?

APerson

Posted 2013-03-20T16:18:40.027

Reputation: 582

1ILSpy is probably the best choice (IMHO) – jyz – 2013-03-20T18:15:42.857

1Because decompiling .net is very easy most .net code is protected or obfuscated. So in order to use any of the tools suggested in the answer you must remove this protection (if present) first. – Remko – 2013-03-20T19:38:55.957

Answers

44

ILSpy is a great open-source decompiler.

ILSpy Features

  • Assembly browsing
  • IL Disassembly
  • Support C# 5.0 "async"
  • Decompilation to C#
  • Supports lambdas and 'yield return'
  • Shows XML documentation
  • Decompilation to VB
  • Saving of resources
  • Save decompiled assembly as .csproj
  • Search for types/methods/properties (substring)
  • Hyperlink-based type/method/property navigation
  • Base/Derived types navigation
  • Navigation history
  • BAML to XAML decompiler
  • Save Assembly as C# Project
  • Find usage of field/method
  • Extensible via plugins (MEF)
  • Assembly Lists

Mick

Posted 2013-03-20T16:18:40.027

Reputation: 5 920

Combine it with this useful add-on for Visual Studio SourceFly so you can open ILSpy from Visual Studio. Though it doesn't support Visual Studio 2012 in its latest release.

– Joseph – 2013-03-22T04:48:14.220

23

I've used JetBrains dotPeek (free of charge) before with some success.

Any JetBrains software I've ever used has been very solid.

It is not quite the 'original source' but it is very readable C# - about the closest thing I would expect to get. Quote from their website:

What's Cool about dotPeek?

  1. Decompiling .NET 1.0-4.5 assemblies to C#
  2. Support for .dll, .exe, .zip, .vsix, .nupkg, and .winmd files
  3. Quick jump to a type, assembly, symbol, or type member
  4. Effortless navigation to symbol declarations, implementations, derived and base symbols, and more
  5. Accurate search for symbol usage with advanced presentation of search results
  6. Overview of inheritance chains
  7. Support for downloading code from source servers
  8. Syntax highlighting
  9. Complete keyboard support
  10. dotPeek is free!

The last point is free as in free beer, not as in free speech.

Glides

Posted 2013-03-20T16:18:40.027

Reputation: 369

11

There is a free tool available called JustDecompile which does that.

Some features:

  • Creating a Visual Studio project from an assembly in order to export lost projects or obtain multiple classes without the need to copy and paste code. At present, JustDecompile is able to export decompiled code only to C#.
  • Exporting code directly from the command prompt
  • Quickly loading core .NET assemblies (.NET 2, .NET3.5, .NET 4, .NET 4.5, WinRT Metadata and Silverlight)
  • Directly editing assemblies loaded into the program

APerson

Posted 2013-03-20T16:18:40.027

Reputation: 582

JustDecompile has a De4Dot Deobfuscator plugin that will help with obfuscated exe – Michael Bahig – 2017-08-24T21:18:15.673

9

I have used .NET Reflector (Note: Commercial, but trial available) several times and quite like it:

http://www.red-gate.com/products/dotnet-development/reflector/

QAZ

Posted 2013-03-20T16:18:40.027

Reputation: 2 076

7Some examples of use cases would be a good addition to this answer. Currently, it is too vague to be of much use besides offering a tool and its website. Giving some real use examples helps define the product a little better. – JMcAfreak – 2013-03-20T17:09:59.217

7

Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code

https://github.com/0xd4d/dnSpy


Main difference from ILSpy :

  • Uses dnLib to read assemblies (vs ILSpy's Mono.Cecil)

https://github.com/0xd4d/dnlib

dnlib was created because de4dot needed a robust .NET assembly library that could handle all types of obfuscated assemblies. de4dot used to use Mono.Cecil but since Mono.Cecil can't handle obfuscated assemblies, doesn't fully support mixed mode assemblies, doesn't read .NET assemblies the same way the CLR does and many other missing features de4dot needed, dnlib was a necessity. The API is similar because it made porting de4dot to dnlib a lot easier.

Kalibr

Posted 2013-03-20T16:18:40.027

Reputation: 89

How is it different from/better than ILSpy? – BlueRaja - Danny Pflughoeft – 2015-12-03T23:48:52.510

This is my first answer, is linking to an external discussion appropriate? : https://www.reddit.com/r/ReverseEngineering/comments/3jau4m/dnspy_a_net_assembly_editor_decompiler_and/ ... I will also summarize above.

– Kalibr – 2015-12-03T23:59:42.703

I can vouch for dnSpy, it think its better than any other similar .NET tool out there. It can even debug the process. – Dominik Antal – 2016-02-11T16:38:16.913

I can really recommend this one. It is the only free tool I found that supports debugging of assembly. – bennofs – 2016-06-05T21:33:40.790

2

If you are interested into a decompiler on API level: https://code.google.com/p/facile-api/ (in Java though)

TomSmartBishop

Posted 2013-03-20T16:18:40.027

Reputation: 121

1

I would second the answer about ILSPY as being a really great.net decompiler. Also, checkout de4dot for deobfuscation. This is a cool writeup of it in action. http://blogs.cisco.com/security/talos/reversing-multilayer-net-malware

Compiled visual basic can be a different and painful animal. http://vrt-blog.snort.org/2014/08/discovering-dynamically-loaded-api-in.html?m=1

tyh

Posted 2013-03-20T16:18:40.027

Reputation: 121

1How is compiled Visual Basic (6) related to .NET? – Thomas Weller – 2015-03-24T22:04:48.340

The original question asked about Visual Basic as well. – tyh – 2015-03-25T18:47:18.007