dnSpy v6.5 releases: .NET assembly editor, decompiler, and debugger

dnSpy is a tool to reverse engineer .NET assemblies. It includes a decompiler, a debugger and an assembly editor (and more) and can be easily extended by writing your own extension. It uses dnlib to read and write assemblies so it can handle obfuscated assemblies (eg. malware) without crashing.

Features

• Open Source (GPLv3) and Free Forever (:TM:)
• Assembly Editor
  • Use C# or Visual Basic to edit any method, property and event
  • Code editor has IntelliSense (code completion, signature help, quick info)
  • Whole classes can be added to assemblies by adding C# and Visual Basic code
  • Edit all metadata of types (classes), methods, properties, events, fields
  • Add, remove, rename any type (class), method, property, event, field
  • Edit, add, remove .NET resources and save them to disk
  • The IL editor allows editing method bodies at the IL level: IL instructions, locals, exception handlers
• Debugger
  • Debug any .NET assembly, no source code required
  • Set breakpoints in any assembly, including framework assemblies, assemblies in the GAC and assemblies existing only in memory
  • Memory window
  • Output window
  • Attach to process
  • Locals window
    • raw contents of locals (eg. decrypted byte arrays) can be saved to disk
  • Call Stack window
  • Threads window
  • Modules window
    • Modules (eg. decrypted in-memory modules) can be saved to disk
  • Exception Settings
  • Can debug dynamic assemblies
  • Debugging CoreCLR assemblies is supported
• Decompile to C#, Visual Basic, IL
• Themes: blue, dark, light (and high contrast)
• Supports smaller screens (eg. laptops)
  • Line height can be optimized for smaller screens
    • Blank and non-alphanumeric lines are 75% the normal height
    • No extra spacing between lines (saves 1 vertical pixel per line)
  • Menu and toolbar share the same line
  • Full screen mode (Shift+Alt+Enter) saves some vertical pixels
• High DPI support and per-monitor DPI-aware
• Translated to several languages
• Highly extensible
  • Write your own extensions and add your own features
  • All major features are already extensions (assembly editor, debugger, decompiler)
• Multiple tabs and tab groups
  • Your screen is too big? Don’t cut it in half, add another vertical tab group and read two classes at once!
  • The tabs and positions within the text editors are saved when you close dnSpy and restored at startup so you can continue where you left off
• Search assemblies
  • Search for types (classes), methods, properties, events, fields
  • Search for strings or numbers in code
• Assembly analyzer
  • Find usages of types (classes), methods, properties, events, fields
• BAML to XAML decompiler
• Fast
• Highlighted references, keywords
  • References under the caret are highlighted to make it easier to see all uses of the reference in the code
  • Tab, Shift+Tab, Ctrl+Shift+Up, Ctrl+Shift+Down moves to the next or previous reference
  • Alt+Down and Alt+Up moves to the next or previous definition (type (class), method, property, event, field)
• Structure visualizer
  • Vertical guide lines shown between start and end of code blocks
  • Different colors are used for different blocks, eg. loop, conditional, method, etc
• dnlib is used to read and write assemblies so it can handle obfuscated code (eg. malware) without crashing
• Go to commands:
  • Entry point
  • Assembly static initialization method (<Module>..cctor)
  • Any metadata token
  • Any metadata row
• Syntax highlighted tooltips with XML doc comments when hovering over a type (class), method, property, event, field
• Methods, properties and events are decompiled in source code order or a custom user-defined order
  • Source code order means that related methods are usually next to each other, just like the programmer wanted
• Background images can be shown in the text editor
• Export to project decompiles all selected assemblies and creates a Visual Studio solution
  • Multiple assemblies can be exported at the same time
  • Creates a Visual Studio solution (supports VS2005 – VS-latest) and project files
  • Supports WinForms and WPF classes (creates a code-behind .cs/.vb file and a WinForms .resx / WPF .xaml file)
  • Converts .NET resources to .resx files
• Open from GAC
• Command line decompiler
  • Supports Windows, Linux and Mac
  • Syntax highlights output to the screen
• Scripting with C# REPL
  • Call public dnSpy methods from scripts
  • Script the debugger and other extensions
• Hex editor
• Method tokens and addresses are shown in comments and can be clicked to go to the raw metadata or IL bytes
• Metadata editor
• Collapse Assembly Explorer nodes command to quickly collapse unused nodes
• And more…

Changelog v6.5

New features:

• dnSpy now runs on .NET 8 and .NET Framework 4.8.
• dnSpy now handles TypeRef rows with a ResolutionScope of 0 in the same way as the CLR rather than following the ECMA specification.
• The low-level metadata editor is now aware of the implications of the #JTD metadata stream being present.
• Enable Windows targetting in project files to allow compiling on other platforms (Note: dnSpy will still only run on Windows due to the WPF dependency)
• Added binding redirects for various common assemblies with frequent version bumps to make extensions compiled for older versions load more seamlessly.
• Added support for new resource serialization formats added as part of System.Resources.Extensions
• Added a new, opt-out, update checker which runs on startup and will display an update notification in a new information bar component.
• C# Interactive now references additional libraries giving access to newer features like Span<T> or immutable collections.
• Enabled Server and concurrent GC as well as RDP hardware acceleration in the .NET 8 builds
• ILSpy Decompiler:
  • Added support for C# ref types to the decompiler – ref types are now correctly decompiled into the proper C# syntax instead of being decompiled into pointer types.
  • Added support for C# function pointers to the decompiler – Function pointers are now correctly represented using the C# syntax rather than simple types of name method
• Debugger
  • The debugger now supports displaying tuple element names, dynamic types, and native integer types defined in custom attributes.
  • The debugger expression evaluator now includes support for tuple element names and dynamic types.
  • Debugger tool windows now use the correct C# 9 function pointer syntax as well as the correct ref type syntax.
  • Display a message dialog when valid metadata cannot be obtained when executing the Open module from memory command.
  • Added an additional option to the .NET Framework start debugging dialog to override the CLR version to use for debugging purposes. This can be helpful for files that use obfuscated native loaders when dnSpy can’t automatically detect the correct CLR version.

Improvements and bug fixes:

• Fixed loading XML documentation for System.Private.CoreLib.dll.
• Improve the method overridden by analyzer to take into account explicit overrides in the metadata.
• Minor improvements to the low-level metadata table editor.
• Improve dependency assembly resolution for cases where .NET Core/.NET 5+ or .NET Framework 2.0 might not be installed.
• Improve performance of members overridden by analyzers.
• Prevent the dependency assembly resolver from performing IO calls on assembly references with invalid file names.
• Minor improvements to the member analyzer to reduce false positives.
• Fixed some null reference errors that could occur when deleting a member or type that was still referenced in a module.
• Improve assembly resolution performance when the module list is frozen (this is a backend change, no behavioral changes will be observable)
• Updated Chinese translations.
• Debugger:
  • Fixed some cases where expressions generated for the expression evaluator were missing parenthesis leading to errors.
  • Improve formatting of multi-dimensional array types in the local, watch, and autos windows.
  • Extend the breakpoint filter expression evaluator to allow for more complicated expressions.
  • Fixed a bug that caused the Raw Locals view to fail when the assembly referenced multiple core libraries.
  • Improve handling of dynamic types in Raw Locals display mode.
  • Extend support for attaching to Unity processes (by @rigdern)
  • Gracefully handle the case when the CorDebug IMetaDataImport interface cannot be obtained for a given module.
  • Improve the accuracy of the Break on entry point and break on module constructor feature for single file bundle debugging.
• ILSpy Decompiler:
  • Usual round of optimizations and performance improvements.
  • Fixed incorrect methodof decompilation for ldtoken of a method.
  • Corrected expected prefixes on call and ldftn instructions.
  • Improve ambiguous type name analysis to include namespace names as ambiguous identifiers.
  • Improve IL disassembler display of function pointer types.
  • Improve decompilation of array access through special methods defined on array signatures.
• BAML decompiler:
  • Improve decompilation and detection of BAML connection ID mappings found in method bodies.
  • Improve behavior when member and type references cannot be resolved to the declaring definitions due to missing dependencies.
  • Added support for specially declared BAML attributes – xml:lang and xml:space are now properly decompiled on all occasions.
  • Avoid outputting invalid identifier characters by ensuring all identifiers are escaped before being written to the output.
  • Fixed a crash in the BAML decompiler which could occur when assembly references were missing.

Download & Use

Copyright (C) 2016 0xd4d

Source: https://github.com/0xd4d/