dnSpy v6.3 releases: .NET assembly editor, decompiler, and debugger

dnSpy is a tool to reverse engineer .NET assemblies. It includes a decompiler, a debugger and an assembly editor (and more) and can be easily extended by writing your own extension. It uses dnlib to read and write assemblies so it can handle obfuscated assemblies (eg. malware) without crashing.

Features

• Open Source (GPLv3) and Free Forever (:TM:)
• Assembly Editor
  • Use C# or Visual Basic to edit any method, property and event
  • Code editor has IntelliSense (code completion, signature help, quick info)
  • Whole classes can be added to assemblies by adding C# and Visual Basic code
  • Edit all metadata of types (classes), methods, properties, events, fields
  • Add, remove, rename any type (class), method, property, event, field
  • Edit, add, remove .NET resources and save them to disk
  • The IL editor allows editing method bodies at the IL level: IL instructions, locals, exception handlers
• Debugger
  • Debug any .NET assembly, no source code required
  • Set breakpoints in any assembly, including framework assemblies, assemblies in the GAC and assemblies existing only in memory
  • Memory window
  • Output window
  • Attach to process
  • Locals window
    • raw contents of locals (eg. decrypted byte arrays) can be saved to disk
  • Call Stack window
  • Threads window
  • Modules window
    • Modules (eg. decrypted in-memory modules) can be saved to disk
  • Exception Settings
  • Can debug dynamic assemblies
  • Debugging CoreCLR assemblies is supported
• Decompile to C#, Visual Basic, IL
• Themes: blue, dark, light (and high contrast)
• Supports smaller screens (eg. laptops)
  • Line height can be optimized for smaller screens
    • Blank and non-alphanumeric lines are 75% the normal height
    • No extra spacing between lines (saves 1 vertical pixel per line)
  • Menu and toolbar share the same line
  • Full screen mode (Shift+Alt+Enter) saves some vertical pixels
• High DPI support and per-monitor DPI-aware
• Translated to several languages
• Highly extensible
  • Write your own extensions and add your own features
  • All major features are already extensions (assembly editor, debugger, decompiler)
• Multiple tabs and tab groups
  • Your screen is too big? Don’t cut it in half, add another vertical tab group and read two classes at once!
  • The tabs and positions within the text editors are saved when you close dnSpy and restored at startup so you can continue where you left off
• Search assemblies
  • Search for types (classes), methods, properties, events, fields
  • Search for strings or numbers in code
• Assembly analyzer
  • Find usages of types (classes), methods, properties, events, fields
• BAML to XAML decompiler
• Fast
• Highlighted references, keywords
  • References under the caret are highlighted to make it easier to see all uses of the reference in the code
  • Tab, Shift+Tab, Ctrl+Shift+Up, Ctrl+Shift+Down moves to the next or previous reference
  • Alt+Down and Alt+Up moves to the next or previous definition (type (class), method, property, event, field)
• Structure visualizer
  • Vertical guide lines shown between start and end of code blocks
  • Different colors are used for different blocks, eg. loop, conditional, method, etc
• dnlib is used to read and write assemblies so it can handle obfuscated code (eg. malware) without crashing
• Go to commands:
  • Entry point
  • Assembly static initialization method (<Module>..cctor)
  • Any metadata token
  • Any metadata row
• Syntax highlighted tooltips with XML doc comments when hovering over a type (class), method, property, event, field
• Methods, properties and events are decompiled in source code order or a custom user-defined order
  • Source code order means that related methods are usually next to each other, just like the programmer wanted
• Background images can be shown in the text editor
• Export to project decompiles all selected assemblies and creates a Visual Studio solution
  • Multiple assemblies can be exported at the same time
  • Creates a Visual Studio solution (supports VS2005 – VS-latest) and project files
  • Supports WinForms and WPF classes (creates a code-behind .cs/.vb file and a WinForms .resx / WPF .xaml file)
  • Converts .NET resources to .resx files
• Open from GAC
• Command line decompiler
  • Supports Windows, Linux and Mac
  • Syntax highlights output to the screen
• Scripting with C# REPL
  • Call public dnSpy methods from scripts
  • Script the debugger and other extensions
• Hex editor
• Method tokens and addresses are shown in comments and can be clicked to go to the raw metadata or IL bytes
• Metadata editor
• Collapse Assembly Explorer nodes command to quickly collapse unused nodes
• And more…

Changelog v6.3

dnSpyEx 6.3.0 brings many improvements to the already existing components in dnSpy as well as features an improved search component. Many bugs and issues caused by obfuscated or malformed binaries have been fixed. The debugger received quite a lot of improvements for both the CorDebug and Mono APIs to improve the debugging experience. The decompiler has also received quite a few changes to help fix crashes and incorrect decompiled code. This update is recommended for all users of dnSpy and dnSpyEx!

New features:

• Improved Search tool window
  • Display member types in search results (return types, parameter types, etc.) to make it easier to locate the right member.
  • Tooltips on search results now contain more information, including full member signatures. If the result is located in a method body, the appropriate instruction is also included in the tooltip.
  • Literal and enum fields are now included in search results when searching for a constant.
  • Improved analysis of custom attributes. Previously arrays in custom attributes or boxed custom attributes were not searched, now they are.
  • Added an option to disable searching compiler-generated members.
  • Added support for searching DateTime resources when searching for constants.
  • Reduced heap allocations that occurred during the search process.
  • Include properties with literal constants in search results when searching for constants.
  • Refresh search results when a member was modified or deleted.
• Added a command under the File menu to close all framework and system assemblies (by @mitchcapper).
• Added a new context menu command for methods to replace their body with one which returns a default value and initializes all out parameters.
• Added support for exporting projects in the new SDK format in the form of a toggle in the project export dialog.
• Added additional toggles to the metadata writer options screen.
• Added support for .NET 7 assembly resolution.
• Added Vietnamese translations.
• Added an update checker to the About screen.
• Added support for displaying structure information for V1 multifile resources in the hex viewer.
• ILSpy decompiler:
  • Add an option to the decompiler settings to decompile calli instructions to invocation expressions. (co-authored by @cnsheds)
  • Add MethodCodeType field to [MethodImplOptions] attribute if necessary
• Debugger:
  • Add a new Static Fields tool window which displays and allows editing of values of all static fields available in the current context.
  • Add support for GetObjectValueAtAddress Roslyn expression compiler intrinsic. It is now possible to enter expressions like @0x12345678 to retrieve an object at a specific memory address. Due to debugger API limitations, this is only available when utilizing the CorDebug API (.NET Framework, .NET Core, .NET 5/6/7/etc.)
  • CorDebug:
    • Add support for Just My Code debugging including an option to disable stepping into system modules and an option to avoid stepping into code outside the primary module.
  • Mono/Unity:
    • Mono debugger API version of the debuggee is now written to the Output window when debugging is initiated.
    • Add support for dereferencing pointers in the Locals, Watch, etc. tool windows when using newer Mono debugger API versions.

Improvements and bug fixes:

• Added more links to the Help menu.
• Added support for displaying special C# types like nint, nuint, and dynamic in tooltips. Tuple element names are now also included.
• Added support for loading XMLDoc for .NET Core framework assemblies.
• Extended XMLDoc parser and analyzer to support documentation files generated by the MSVC compiler.
• Properly display the __arglist method parameter across the dnSpy UI.
• Properly update MethodSemanticsAttributes in the AsmEditor component.
• Fixed various bugs in the EventFiredBy analyzer.
• Fixed some bugs relating to parsing custom attributes.
• Improved detection of member obsolescence when displaying tooltips.
• Added support for displaying init property accessors in tooltips.
• Fixed an analyzer crash caused by invalid type attributes generated by obfuscators.
• Fixed a jump to reference issue in the entry point comment added when decompiling a module node
• ILSpy decompiler:
  • Fixed array initializer detection for enum arrays where the enum was located in a different module.
  • Fixed syntax highlighting color for preprocessor directives.
  • Fixed and improved delegate construction detection (co-authored by @mobile46).
  • Fixed decompiler not removing unnecessary parameter names in anonymous functions leading to compiler errors.
  • Improve debug info generation for inlined finally methods in yield return state machines.
  • Improve performance and reduced heap allocations in the decompiler and IL disassembler.
  • Extended type analysis for switch, throw, and ckfinite OpCodes.
  • Fixed a crash that occurred when the HandlerStart property of an exception handler was null (by @mobile46).
  • Fixed setting incorrect brace annotations for switch case blocks.
  • Extended support for methods utilizing the __arglist parameter.
  • Improved jump-to-reference navigation in the IL disassembler.
  • Improved ambiguous type name analysis.
  • Fixed a missing space not being added before the new() generic parameter constraint.
  • Fixed a rare bug that occurred when decompiling obfuscated exception handler filter blocks.
  • Fixed incorrect placement of the [Optional] attribute on a parameter with a decimal constant.
  • Fixed a nasty indentation bug in the C# decompiler leading to broken indentation of long property/method call chains
  • Improved decompilation of nested generic types for obfuscated assemblies where the type name does not contain generic argument count
• Debugger:
  • Fix a potential exception when searching a dynamic module (by @mitchcapper).
  • Improved debugger evaluation correctness and accuracy.
  • Fix timing issues in debugger thread dispatchers.
  • Display a warning message when detaching the debugger will lead to process termination.
  • Fix Locals windows failing to display locals when debugging a module with an invalid MVID.
  • Child nodes should not be displayed for values of types IntPtr and UIntPtr.
  • Fix the architecture incompatibility warning for files targeting .NET Framework 1.x but being executed on CLR version 2.
  • CorDebug:
    • Improve suppression of NGEN image loading leading to a better debugging experience for modules present in the GAC.
    • Introduce a workaround for a .NET 6.0 bug that occurred when a debugger was attached to a process that utilized dynamic modules. (by @josegomez)
    • Use the CorDebug API directly to read thread and exception information to avoid issues with certain anti-dumping techniques.
    • Improve debugging support for legacy .NET Framework versions.
  • Mono/Unity:
    • Improved dynamic module detection and metadata fetching for newer Mono debugger API versions.
    • Fix computation of OffsetToStringData value resulting in improved evaluation accuracy and fixed Show in Memory command result.
    • Improved and optimized computation of OffsetToArrayData, it should now work smoother on newer Mono debugger API versions.
    • Use MDToken-based resolution for types and methods when possible on newer Mono debugger API versions.
    • Improve the result of the Show in Memory command for objects on newer Mono debugger API versions.
• BAML decompiler:
  • Improved analysis of BAML connection IDs.
  • Fixed incorrect decompilation of readonly properties in XAML code.
  • Fixed a crash resulting from unescaped member identifiers.

Download & Use

Copyright (C) 2016 0xd4d

Source: https://github.com/0xd4d/