Search the Community

Description Provides readers with a solid foundation in Arm assembly internals and reverse-engineering fundamentals as the basis for analyzing and securing billions of Arm devices Finding and mitigating security vulnerabilities in Arm devices is the next critical internet security frontier—Arm processors are already in use by more than 90% of all mobile devices, billions of Internet of Things (IoT) devices, and a growing number of current laptops from companies including Microsoft, Lenovo, and Apple. Written by a leading expert on Arm security, Blue Fox: Arm Assembly Internals and Reverse Engineering introduces readers to modern Armv8-A instruction sets and the process of reverse-engineering Arm binaries for security research and defensive purposes. Divided into two sections, the book first provides an overview of the ELF file format and OS internals, followed by Arm architecture fundamentals, and a deep-dive into the A32 and A64 instruction sets. Section Two delves into the process of reverse-engineering itself: setting up an Arm environment, an introduction to static and dynamic analysis tools, and the process of extracting and emulating firmware for analysis. The last chapter provides the reader a glimpse into macOS malware analysis of binaries compiled for the Arm-based M1 SoC. Throughout the book, the reader is given an extensive understanding of Arm instructions and control-flow patterns essential for reverse engineering software compiled for the Arm architecture. Providing an in-depth introduction into reverse-engineering for engineers and security researchers alike, this book: Offers an introduction to the Arm architecture, covering both AArch32 and AArch64 instruction set states, as well as ELF file format internals Presents in-depth information on Arm assembly internals for reverse engineers analyzing malware and auditing software for security vulnerabilities, as well as for developers seeking detailed knowledge of the Arm assembly language Covers the A32/T32 and A64 instruction sets supported by the Armv8-A architecture with a detailed overview of the most common instructions and control flow patterns Introduces known reverse engineering tools used for static and dynamic binary analysis Describes the process of disassembling and debugging Arm binaries on Linux, and using common disassembly and debugging tools Blue Fox: Arm Assembly Internals and Reverse Engineering is a vital resource for security researchers and reverse engineers who analyze software applications for Arm-based devices at the assembly level. [Hidden Content] [hide][Hidden Content]]

dnSpy is a tool to reverse engineer .NET assemblies. It includes a decompiler, a debugger and an assembly editor (and more) and can be easily extended by writing your own extension. It uses dnlib to read and write assemblies so it can handle obfuscated assemblies (eg. malware) without crashing. Features Open Source (GPLv3) and Free Forever (:TM:) Assembly Editor Use C# or Visual Basic to edit any method, property and event Code editor has IntelliSense (code completion, signature help, quick info) Whole classes can be added to assemblies by adding C# and Visual Basic code Edit all metadata of types (classes), methods, properties, events, fields Add, remove, rename any type (class), method, property, event, field Edit, add, remove .NET resources and save them to disk The IL editor allows editing method bodies at the IL level: IL instructions, locals, exception handlers Debugger Debug any .NET assembly, no source code required Set breakpoints in any assembly, including framework assemblies, assemblies in the GAC and assemblies existing only in memory Memory window Output window Attach to process Locals window raw contents of locals (eg. decrypted byte arrays) can be saved to disk Call Stack window Threads window Modules window Modules (eg. decrypted in-memory modules) can be saved to disk Exception Settings Can debug dynamic assemblies Debugging CoreCLR assemblies is supported Decompile to C#, Visual Basic, IL Themes: blue, dark, light (and high contrast) Supports smaller screens (eg. laptops) Line height can be optimized for smaller screens Blank and non-alphanumeric lines are 75% the normal height No extra spacing between lines (saves 1 vertical pixel per line) Menu and toolbar share the same line Full screen mode (Shift+Alt+Enter) saves some vertical pixels High DPI support and per-monitor DPI-aware Translated to several languages Highly extensible Write your own extensions and add your own features All major features are already extensions (assembly editor, debugger, decompiler) Multiple tabs and tab groups Your screen is too big? Don’t cut it in half, add another vertical tab group and read two classes at once! The tabs and positions within the text editors are saved when you close dnSpy and restored at startup so you can continue where you left off Search assemblies Search for types (classes), methods, properties, events, fields Search for strings or numbers in code Assembly analyzer Find usages of types (classes), methods, properties, events, fields BAML to XAML decompiler Fast Highlighted references, keywords References under the caret are highlighted to make it easier to see all uses of the reference in the code Tab, Shift+Tab, Ctrl+Shift+Up, Ctrl+Shift+Down moves to the next or previous reference Alt+Down and Alt+Up moves to the next or previous definition (type (class), method, property, event, field) Structure visualizer Vertical guide lines shown between start and end of code blocks Different colors are used for different blocks, eg. loop, conditional, method, etc dnlib is used to read and write assemblies so it can handle obfuscated code (eg. malware) without crashing Go to commands: Entry point Assembly static initialization method (<Module>..cctor) Any metadata token Any metadata row Syntax highlighted tooltips with XML doc comments when hovering over a type (class), method, property, event, field Methods, properties and events are decompiled in source code order or a custom user-defined order Source code order means that related methods are usually next to each other, just like the programmer wanted Background images can be shown in the text editor Export to project decompiles all selected assemblies and creates a Visual Studio solution Multiple assemblies can be exported at the same time Creates a Visual Studio solution (supports VS2005 – VS-latest) and project files Supports WinForms and WPF classes (creates a code-behind .cs/.vb file and a WinForms .resx / WPF .xaml file) Converts .NET resources to .resx files Open from GAC Command line decompiler Supports Windows, Linux and Mac Syntax highlights output to the screen Scripting with C# REPL Call public dnSpy methods from scripts Script the debugger and other extensions Hex editor Method tokens and addresses are shown in comments and can be clicked to go to the raw metadata or IL bytes Metadata editor Collapse Assembly Explorer nodes command to quickly collapse unused nodes And more… Dependency updates: Updated dnlib to 3.5.0 Updated Iced to 1.17.0 Roslyn compiler to 4.1.0 Ookii.Dialogs.Wpf to 5.0.1 VS MEF to 16.9.20 ILSpy to 2.4 Mono.Debugger.Soft was updated to the latest commit. [hide][Hidden Content]]

dnSpy is a tool to reverse engineer .NET assemblies. It includes a decompiler, a debugger and an assembly editor (and more) and can be easily extended by writing your own extension. It uses dnlib to read and write assemblies so it can handle obfuscated assemblies (eg. malware) without crashing. Features Open Source (GPLv3) and Free Forever (:TM:) Assembly Editor Use C# or Visual Basic to edit any method, property and event Code editor has IntelliSense (code completion, signature help, quick info) Whole classes can be added to assemblies by adding C# and Visual Basic code Edit all metadata of types (classes), methods, properties, events, fields Add, remove, rename any type (class), method, property, event, field Edit, add, remove .NET resources and save them to disk The IL editor allows editing method bodies at the IL level: IL instructions, locals, exception handlers Debugger Debug any .NET assembly, no source code required Set breakpoints in any assembly, including framework assemblies, assemblies in the GAC and assemblies existing only in memory Memory window Output window Attach to process Locals window raw contents of locals (eg. decrypted byte arrays) can be saved to disk Call Stack window Threads window Modules window Modules (eg. decrypted in-memory modules) can be saved to disk Exception Settings Can debug dynamic assemblies Debugging CoreCLR assemblies is supported Decompile to C#, Visual Basic, IL Themes: blue, dark, light (and high contrast) Supports smaller screens (eg. laptops) Line height can be optimized for smaller screens Blank and non-alphanumeric lines are 75% the normal height No extra spacing between lines (saves 1 vertical pixel per line) Menu and toolbar share the same line Full screen mode (Shift+Alt+Enter) saves some vertical pixels High DPI support and per-monitor DPI-aware Translated to several languages Highly extensible Write your own extensions and add your own features All major features are already extensions (assembly editor, debugger, decompiler) Multiple tabs and tab groups Your screen is too big? Don’t cut it in half, add another vertical tab group and read two classes at once! The tabs and positions within the text editors are saved when you close dnSpy and restored at startup so you can continue where you left off Search assemblies Search for types (classes), methods, properties, events, fields Search for strings or numbers in code Assembly analyzer Find usages of types (classes), methods, properties, events, fields BAML to XAML decompiler Fast Highlighted references, keywords References under the caret are highlighted to make it easier to see all uses of the reference in the code Tab, Shift+Tab, Ctrl+Shift+Up, Ctrl+Shift+Down moves to the next or previous reference Alt+Down and Alt+Up moves to the next or previous definition (type (class), method, property, event, field) Structure visualizer Vertical guide lines shown between start and end of code blocks Different colors are used for different blocks, eg. loop, conditional, method, etc dnlib is used to read and write assemblies so it can handle obfuscated code (eg. malware) without crashing Go to commands: Entry point Assembly static initialization method (<Module>..cctor) Any metadata token Any metadata row Syntax highlighted tooltips with XML doc comments when hovering over a type (class), method, property, event, field Methods, properties and events are decompiled in source code order or a custom user-defined order Source code order means that related methods are usually next to each other, just like the programmer wanted Background images can be shown in the text editor Export to project decompiles all selected assemblies and creates a Visual Studio solution Multiple assemblies can be exported at the same time Creates a Visual Studio solution (supports VS2005 – VS-latest) and project files Supports WinForms and WPF classes (creates a code-behind .cs/.vb file and a WinForms .resx / WPF .xaml file) Converts .NET resources to .resx files Open from GAC Command line decompiler Supports Windows, Linux and Mac Syntax highlights output to the screen Scripting with C# REPL Call public dnSpy methods from scripts Script the debugger and other extensions Hex editor Method tokens and addresses are shown in comments and can be clicked to go to the raw metadata or IL bytes Metadata editor Collapse Assembly Explorer nodes command to quickly collapse unused nodes And more… Changelog v6.2 RC2 Add support for searching by full name by @mobile46. Improvements to GitHub Actions workflow by @Gorialis. Optimized search module by reducing memory allocations. Use .NET Standard instead of .NET Framework for Roslyn projects by @mobile46 fixing #84. Micro-optimizations in various places. Fixed decompiler creating incorrect checked regions for some post increments. dnSpy now reads assembly resolution probe paths from .config files. [hide][Hidden Content]]

dnSpy is a tool to reverse engineer .NET assemblies. It includes a decompiler, a debugger and an assembly editor (and more) and can be easily extended by writing your own extension. It uses dnlib to read and write assemblies so it can handle obfuscated assemblies (eg. malware) without crashing. Features Open Source (GPLv3) and Free Forever (:TM:) Assembly Editor Use C# or Visual Basic to edit any method, property and event Code editor has IntelliSense (code completion, signature help, quick info) Whole classes can be added to assemblies by adding C# and Visual Basic code Edit all metadata of types (classes), methods, properties, events, fields Add, remove, rename any type (class), method, property, event, field Edit, add, remove .NET resources and save them to disk The IL editor allows editing method bodies at the IL level: IL instructions, locals, exception handlers Debugger Debug any .NET assembly, no source code required Set breakpoints in any assembly, including framework assemblies, assemblies in the GAC and assemblies existing only in memory Memory window Output window Attach to process Locals window raw contents of locals (eg. decrypted byte arrays) can be saved to disk Call Stack window Threads window Modules window Modules (eg. decrypted in-memory modules) can be saved to disk Exception Settings Can debug dynamic assemblies Debugging CoreCLR assemblies is supported Decompile to C#, Visual Basic, IL Themes: blue, dark, light (and high contrast) Supports smaller screens (eg. laptops) Line height can be optimized for smaller screens Blank and non-alphanumeric lines are 75% the normal height No extra spacing between lines (saves 1 vertical pixel per line) Menu and toolbar share the same line Full screen mode (Shift+Alt+Enter) saves some vertical pixels High DPI support and per-monitor DPI-aware Translated to several languages Highly extensible Write your own extensions and add your own features All major features are already extensions (assembly editor, debugger, decompiler) Multiple tabs and tab groups Your screen is too big? Don’t cut it in half, add another vertical tab group and read two classes at once! The tabs and positions within the text editors are saved when you close dnSpy and restored at startup so you can continue where you left off Search assemblies Search for types (classes), methods, properties, events, fields Search for strings or numbers in code Assembly analyzer Find usages of types (classes), methods, properties, events, fields BAML to XAML decompiler Fast Highlighted references, keywords References under the caret are highlighted to make it easier to see all uses of the reference in the code Tab, Shift+Tab, Ctrl+Shift+Up, Ctrl+Shift+Down moves to the next or previous reference Alt+Down and Alt+Up moves to the next or previous definition (type (class), method, property, event, field) Structure visualizer Vertical guide lines shown between start and end of code blocks Different colors are used for different blocks, eg. loop, conditional, method, etc dnlib is used to read and write assemblies so it can handle obfuscated code (eg. malware) without crashing Go to commands: Entry point Assembly static initialization method (<Module>..cctor) Any metadata token Any metadata row Syntax highlighted tooltips with XML doc comments when hovering over a type (class), method, property, event, field Methods, properties and events are decompiled in source code order or a custom user-defined order Source code order means that related methods are usually next to each other, just like the programmer wanted Background images can be shown in the text editor Export to project decompiles all selected assemblies and creates a Visual Studio solution Multiple assemblies can be exported at the same time Creates a Visual Studio solution (supports VS2005 – VS-latest) and project files Supports WinForms and WPF classes (creates a code-behind .cs/.vb file and a WinForms .resx / WPF .xaml file) Converts .NET resources to .resx files Open from GAC Command line decompiler Supports Windows, Linux and Mac Syntax highlights output to the screen Scripting with C# REPL Call public dnSpy methods from scripts Script the debugger and other extensions Hex editor Method tokens and addresses are shown in comments and can be clicked to go to the raw metadata or IL bytes Metadata editor Collapse Assembly Explorer nodes command to quickly collapse unused nodes And more… Changelog v6.2 RC1 New features: dnSpy now runs under .NET 6 and .NET Framework 4.8. Move to VS2022 icons for UI and exe files (by @InKahootz and @SychicBoy) Support for tilt/horizontal scrolling in the UI. Added support for editing custom attributes on module resources. Added support for modifying the Log2Rid value when saving the module. Add support for ARM64 target architecture in the assembly editor. Add an enum for PE Magic field in the PE editor (by @riQQ) Show debugged process’s name in the title bar (by @InKahootz) Add support for writing VS2022 compatible .sln files. Added back the Save Code, Save BAML, and Save XAML options in the File context menu which save the contents of the currently open document tab. Debugger: Display a warning message before starting to debug a target file with a different bitness than the current dnSpy version running. Add a new option that allows to automatically break on <Module>::.cctor when starting to debug. Display the exception’s HResult property when an unhandled exception is hit. ILSpy decompiler: Added jump to reference support for jmp() expressions created when the jmp CIL opcode is present. CIL disassembler now includes information about generic parameter attributes and constraints. Add more information to the output when disassembling the module node when using the CIL disassembler. The decompiler now splits up long method call chains using a new line. Generate debug info for yield break; statements. Improvements and bug fixes: Fix the .NET 6 console executable having the incorrect subsystem set in the PE options resulting in a crash. Fixed escaping of namespaces in tooltips. Fixed syntax highlighting for structs in tooltips. Improved RVA <-> FileOffset conversions in PE editor to fix a crash with invalid values being passed in. Improved assembly resolution for .NET Standard, .NET Core, .NET 5, .NET 6. Read probe paths from .config files when searching for satellite assemblies during project export. Fixed incorrect label in the Save Module dialog. ILSpy Decompiler Optimized the variable naming step in the decompiler by reducing memory allocations. Improved insertion of checked() blocks. Improved decompilation of query expressions. Prevent delegate construction decompilation from crashing the entire decompiler if it failed. Improved analysis for unsafe modifier. Ignore invalid prefixes when constructing the ILAst. This prevents a common method used to crash the decompiler from working. Many improvements and fixes to the async method decompilation logic. Optimized the removal of dead nop instructions when building the ILAst. This deficiency was a known method to crash dnSpy’s decompiler by filling a method body with huge amounts of useless code. Fixed a rare case where field initializers would not be detected properly. Fixed a rarely occurring bug that resulted in incorrect ILAst being built. Optimized construction of ILAst by calculating the stack behavior of instruction only once and by caching the result of MethodDef.HasReturnType. Improved required parenthesis analysis. Debugger: Fixed a bug that caused the infamous ??? exception to occur when debugging. Improved debugging support for newer mono runtimes. Fixed a crash that occurred in the .NET Framework version of dnSpy when a module loaded into memory during debugging would contain an invalid file path resulting in a crash. BAML decompiler Resolve namespaces of properties. Fix Name attribute for properties incorrect in rare circumstances. Fix missing x:Static and x:Type (by @wwh1004) Dependency updates: Updated dnlib to 3.5.0 Updated Iced to 1.17.0 Roslyn compiler to 4.1.0 Ookii.Dialogs.Wpf to 5.0.1 VS MEF to 16.9.20 ILSpy to 2.4 Mono.Debugger.Soft was updated to the latest commit. [hide][Hidden Content]]

An introduction to basic Arm Instructions What you'll learn Arm assembly Requirements A pc Description Hello all, Welcome to the Arm assembly for Hackers course. This is a short course on the basic instructions in the arm architecture .This course can help you build a strong foundation on arm instructions for helping you in Reverse engineering / Exploit development in the arm platform. Arm devices are now becoming more and more popular now a days .Today ,even in IOT devices arm based processors are used so its important to learn about some basic security principles . This course covers from almost all the basic instructions in the armv6 .This is enough to reverse engineer Android apps and to perform Binary exploitation in the arm platform .we will walk through all the basic instructions step by step we will not only be explaining these instructions through the slides we will debugging the instructions in gdb so that you guys will get a visual representation and analyzing these instructions line by line in order to get a strong hold in grasping it .After taking this course you can move on arm exploitation very easily this would also help you if you want reverse native android apps .This course has a 30 day refund policy so even if you dont like this course you can just surely get your money 100%. Who this course is for: Anyone Reverse Engineers Exploit Developers Anyone who wants to learn arm exploitation Mobile security researchers [Hidden Content] [hide][Hidden Content]]

PE-Packer PE-Packer is a simple packer for Windows PE files. The new PE file after packing can obstruct the process of reverse engineering. It will do the following things when packing a PE file: Transforming the original import table. Encrypting sections. Clearing section names. Installing the shell-entry. When running a packed PE file, the shell-entry will decrypt and load the original program as follows: Decrypting sections. Initializing the original import table. Relocation. Before packing, using some disassembly tools can disassemble the executable file to analyze the code, such as IDA Pro. [hide][Hidden Content]]

Introduction dnSpy is a tool to reverse engineer .NET assemblies, including .NET debugger, a decompiler and an assembly editor. This tool can be easily extended by writing custom and your own plugin. It uses dnlib to read and write assemblies so it can handle obfuscated assemblies without crashing. dnSpy: .NET debugger, decompiler & assembly editor This amazing tool is open source, forever free and has very modern and intuitive design, kinda similar to Visual Studio. It uses many open source libraries: ILSpy decompiler engine: C# and Visual Basic decompilers Roslyn: C# and Visual Basic compilers dnlib: .NET metadata reader/writer which can also read obfuscated assemblies VS MEF: Faster MEF equals faster startup ClrMD: Access to lower level debugging info not provided by the CorDebug API Features Debug .NET Framework, .NET Core and Unity game assemblies, no source code required Edit assemblies in C# or Visual Basic or IL, and edit all metadata High DPI support (per-monitor DPI aware) Extensible, write your own extension BAML decompiler Blue, light and dark themes (and a dark high contrast theme) Bookmarks C# Interactive window can be used to script dnSpy Search assemblies for classes, methods, strings etc Analyze class and method usage, find callers etc Multiple tabs and tab groups References are highlighted, use Tab / Shift+Tab to move to next reference Go to entry point and module initializer commands Go to metadata token or metadata row commands Code tooltips (C# and Visual Basic) Export to project Debugger Debug .NET Framework, .NET Core and Unity game assemblies, no source code required Set breakpoints and step into any assembly Locals, watch, autos windows Variables windows supports saving variables (eg. decrypted byte arrays) to disk or view them in the hex editor (memory window) Object IDs Multiple processes can be debugged at the same time Break on module load Tracepoints and conditional breakpoints Export/import breakpoints and tracepoints Call stack, threads, modules, processes windows Break on thrown exceptions (1st chance) Variables windows support evaluating C# / Visual Basic expressions Dynamic modules can be debugged (but not dynamic methods due to CLR limitations) Output window logs various debugging events, and it shows timestamps by default 🙂 Assemblies that decrypt themselves at runtime can be debugged, dnSpy will use the in-memory image. You can also force dnSpy to always use in-memory images instead of disk files. Public API, you can write an extension or use the C# Interactive window to control the debugger [hide][Hidden Content]]

dnSpy is a tool to reverse engineer .NET assemblies. It includes a decompiler, a debugger and an assembly editor (and more) and can be easily extended by writing your own extension. It uses dnlib to read and write assemblies so it can handle obfuscated assemblies (eg. malware) without crashing. Features Open Source (GPLv3) and Free Forever (:TM:) Assembly Editor Use C# or Visual Basic to edit any method, property and event Code editor has IntelliSense (code completion, signature help, quick info) Whole classes can be added to assemblies by adding C# and Visual Basic code Edit all metadata of types (classes), methods, properties, events, fields Add, remove, rename any type (class), method, property, event, field Edit, add, remove .NET resources and save them to disk The IL editor allows editing method bodies at the IL level: IL instructions, locals, exception handlers Debugger Debug any .NET assembly, no source code required Set breakpoints in any assembly, including framework assemblies, assemblies in the GAC and assemblies existing only in memory Memory window Output window Attach to process Locals window raw contents of locals (eg. decrypted byte arrays) can be saved to disk Call Stack window Threads window Modules window Modules (eg. decrypted in-memory modules) can be saved to disk Exception Settings Can debug dynamic assemblies Debugging CoreCLR assemblies is supported Decompile to C#, Visual Basic, IL Themes: blue, dark, light (and high contrast) Supports smaller screens (eg. laptops) Line height can be optimized for smaller screens Blank and non-alphanumeric lines are 75% the normal height No extra spacing between lines (saves 1 vertical pixel per line) Menu and toolbar share the same line Full screen mode (Shift+Alt+Enter) saves some vertical pixels High DPI support and per-monitor DPI-aware Translated to several languages Highly extensible Write your own extensions and add your own features All major features are already extensions (assembly editor, debugger, decompiler) Multiple tabs and tab groups Your screen is too big? Don’t cut it in half, add another vertical tab group and read two classes at once! The tabs and positions within the text editors are saved when you close dnSpy and restored at startup so you can continue where you left off Search assemblies Search for types (classes), methods, properties, events, fields Search for strings or numbers in code Assembly analyzer Find usages of types (classes), methods, properties, events, fields BAML to XAML decompiler Fast Highlighted references, keywords References under the caret are highlighted to make it easier to see all uses of the reference in the code Tab, Shift+Tab, Ctrl+Shift+Up, Ctrl+Shift+Down moves to the next or previous reference Alt+Down and Alt+Up moves to the next or previous definition (type (class), method, property, event, field) Structure visualizer Vertical guide lines shown between start and end of code blocks Different colors are used for different blocks, eg. loop, conditional, method, etc dnlib is used to read and write assemblies so it can handle obfuscated code (eg. malware) without crashing Go to commands: Entry point Assembly static initialization method (<Module>..cctor) Any metadata token Any metadata row Syntax highlighted tooltips with XML doc comments when hovering over a type (class), method, property, event, field Methods, properties and events are decompiled in source code order or a custom user-defined order Source code order means that related methods are usually next to each other, just like the programmer wanted Background images can be shown in the text editor Export to project decompiles all selected assemblies and creates a Visual Studio solution Multiple assemblies can be exported at the same time Creates a Visual Studio solution (supports VS2005 – VS-latest) and project files Supports WinForms and WPF classes (creates a code-behind .cs/.vb file and a WinForms .resx / WPF .xaml file) Converts .NET resources to .resx files Open from GAC Command line decompiler Supports Windows, Linux and Mac Syntax highlights output to the screen Scripting with C# REPL Call public dnSpy methods from scripts Script the debugger and other extensions Hex editor Method tokens and addresses are shown in comments and can be clicked to go to the raw metadata or IL bytes Metadata editor Collapse Assembly Explorer nodes command to quickly collapse unused nodes And more… [hide][Hidden Content]]

dnSpy is a tool to reverse engineer .NET assemblies. It includes a decompiler, a debugger and an assembly editor (and more) and can be easily extended by writing your own extension. It uses dnlib to read and write assemblies so it can handle obfuscated assemblies (eg. malware) without crashing. Features Open Source (GPLv3) and Free Forever (:TM:) Assembly Editor Use C# or Visual Basic to edit any method, property and event Code editor has IntelliSense (code completion, signature help, quick info) Whole classes can be added to assemblies by adding C# and Visual Basic code Edit all metadata of types (classes), methods, properties, events, fields Add, remove, rename any type (class), method, property, event, field Edit, add, remove .NET resources and save them to disk The IL editor allows editing method bodies at the IL level: IL instructions, locals, exception handlers Debugger Debug any .NET assembly, no source code required Set breakpoints in any assembly, including framework assemblies, assemblies in the GAC and assemblies existing only in memory Memory window Output window Attach to process Locals window raw contents of locals (eg. decrypted byte arrays) can be saved to disk Call Stack window Threads window Modules window Modules (eg. decrypted in-memory modules) can be saved to disk Exception Settings Can debug dynamic assemblies Debugging CoreCLR assemblies is supported Decompile to C#, Visual Basic, IL Themes: blue, dark, light (and high contrast) Supports smaller screens (eg. laptops) Line height can be optimized for smaller screens Blank and non-alphanumeric lines are 75% the normal height No extra spacing between lines (saves 1 vertical pixel per line) Menu and toolbar share the same line Full screen mode (Shift+Alt+Enter) saves some vertical pixels High DPI support and per-monitor DPI-aware Translated to several languages Highly extensible Write your own extensions and add your own features All major features are already extensions (assembly editor, debugger, decompiler) Multiple tabs and tab groups Your screen is too big? Don’t cut it in half, add another vertical tab group and read two classes at once! The tabs and positions within the text editors are saved when you close dnSpy and restored at startup so you can continue where you left off Search assemblies Search for types (classes), methods, properties, events, fields Search for strings or numbers in code Assembly analyzer Find usages of types (classes), methods, properties, events, fields BAML to XAML decompiler Fast Highlighted references, keywords References under the caret are highlighted to make it easier to see all uses of the reference in the code Tab, Shift+Tab, Ctrl+Shift+Up, Ctrl+Shift+Down moves to the next or previous reference Alt+Down and Alt+Up moves to the next or previous definition (type (class), method, property, event, field) Structure visualizer Vertical guide lines shown between start and end of code blocks Different colors are used for different blocks, eg. loop, conditional, method, etc dnlib is used to read and write assemblies so it can handle obfuscated code (eg. malware) without crashing Go to commands: Entry point Assembly static initialization method (<Module>..cctor) Any metadata token Any metadata row Syntax highlighted tooltips with XML doc comments when hovering over a type (class), method, property, event, field Methods, properties and events are decompiled in source code order or a custom user-defined order Source code order means that related methods are usually next to each other, just like the programmer wanted Background images can be shown in the text editor Export to project decompiles all selected assemblies and creates a Visual Studio solution Multiple assemblies can be exported at the same time Creates a Visual Studio solution (supports VS2005 – VS-latest) and project files Supports WinForms and WPF classes (creates a code-behind .cs/.vb file and a WinForms .resx / WPF .xaml file) Converts .NET resources to .resx files Open from GAC Command line decompiler Supports Windows, Linux and Mac Syntax highlights output to the screen Scripting with C# REPL Call public dnSpy methods from scripts Script the debugger and other extensions Hex editor Method tokens and addresses are shown in comments and can be clicked to go to the raw metadata or IL bytes Metadata editor Collapse Assembly Explorer nodes command to quickly collapse unused nodes And more… [HIDE][Hidden Content]]

dnSpy is a tool to reverse engineer .NET assemblies. It includes a decompiler, a debugger and an assembly editor (and more) and can be easily extended by writing your own extension. It uses dnlib to read and write assemblies so it can handle obfuscated assemblies (eg. malware) without crashing. Features Assembly Editor Use C# or Visual Basic to edit any method, property and event Code editor has IntelliSense (code completion, signature help, quick info) Whole classes can be added to assemblies by adding C# and Visual Basic code Edit all metadata of types (classes), methods, properties, events, fields Add, remove, rename any type (class), method, property, event, field Edit, add, remove .NET resources and save them to disk The IL editor allows editing method bodies at the IL level: IL instructions, locals, exception handlers Debugger Debug any .NET assembly, no source code required Set breakpoints in any assembly, including framework assemblies, assemblies in the GAC and assemblies existing only in memory Memory window Output window Attach to process Locals window raw contents of locals (eg. decrypted byte arrays) can be saved to disk Call Stack window Threads window Modules window Modules (eg. decrypted in-memory modules) can be saved to disk Exception Settings Can debug dynamic assemblies Debugging CoreCLR assemblies is supported Decompile to C#, Visual Basic, IL Themes: blue, dark, light (and high contrast) Supports smaller screens (eg. laptops) Line height can be optimized for smaller screens Blank and non-alphanumeric lines are 75% the normal height No extra spacing between lines (saves 1 vertical pixel per line) Menu and toolbar share the same line Full screen mode (Shift+Alt+Enter) saves some vertical pixels High DPI support and per-monitor DPI-aware Translated to several languages Highly extensible Write your own extensions and add your own features All major features are already extensions (assembly editor, debugger, decompiler) Multiple tabs and tab groups Your screen is too big? Don’t cut it in half, add another vertical tab group and read two classes at once! The tabs and positions within the text editors are saved when you close dnSpy and restored at startup so you can continue where you left off Search assemblies Search for types (classes), methods, properties, events, fields Search for strings or numbers in code Assembly analyzer Find usages of types (classes), methods, properties, events, fields BAML to XAML decompiler Fast Highlighted references, keywords References under the caret are highlighted to make it easier to see all uses of the reference in the code Tab, Shift+Tab, Ctrl+Shift+Up, Ctrl+Shift+Down moves to the next or previous reference Alt+Down and Alt+Up moves to the next or previous definition (type (class), method, property, event, field) Structure visualizer Vertical guide lines shown between start and end of code blocks Different colors are used for different blocks, eg. loop, conditional, method, etc dnlib is used to read and write assemblies so it can handle obfuscated code (eg. malware) without crashing Go to commands: Entry point Assembly static initialization method (<Module>..cctor) Any metadata token Any metadata row Syntax highlighted tooltips with XML doc comments when hovering over a type (class), method, property, event, field Methods, properties and events are decompiled in source code order or a custom user-defined order Source code order means that related methods are usually next to each other, just like the programmer wanted Background images can be shown in the text editor Export to project decompiles all selected assemblies and creates a Visual Studio solution Multiple assemblies can be exported at the same time Creates a Visual Studio solution (supports VS2005 – VS-latest) and project files Supports WinForms and WPF classes (creates a code-behind .cs/.vb file and a WinForms .resx / WPF .xaml file) Converts .NET resources to .resx files Open from GAC Command line decompiler Supports Windows, Linux and Mac Syntax highlights output to the screen Scripting with C# REPL Call public dnSpy methods from scripts Script the debugger and other extensions Hex editor Method tokens and addresses are shown in comments and can be clicked to go to the raw metadata or IL bytes Metadata editor Collapse Assembly Explorer nodes command to quickly collapse unused nodes And more… [HIDE][Hidden Content]]

dnSpy is a tool to reverse engineer .NET assemblies. It includes a decompiler, a debugger and an assembly editor (and more) and can be easily extended by writing your own extension. It uses dnlib to read and write assemblies so it can handle obfuscated assemblies (eg. malware) without crashing. Features Open Source (GPLv3) and Free Forever (:TM:) Assembly Editor Use C# or Visual Basic to edit any method, property and event Code editor has IntelliSense (code completion, signature help, quick info) Whole classes can be added to assemblies by adding C# and Visual Basic code Edit all metadata of types (classes), methods, properties, events, fields Add, remove, rename any type (class), method, property, event, field Edit, add, remove .NET resources and save them to disk The IL editor allows editing method bodies at the IL level: IL instructions, locals, exception handlers Debugger Debug any .NET assembly, no source code required Set breakpoints in any assembly, including framework assemblies, assemblies in the GAC and assemblies existing only in memory Memory window Output window Attach to process Locals window raw contents of locals (eg. decrypted byte arrays) can be saved to disk Call Stack window Threads window Modules window Modules (eg. decrypted in-memory modules) can be saved to disk Exception Settings Can debug dynamic assemblies Debugging CoreCLR assemblies is supported Decompile to C#, Visual Basic, IL Themes: blue, dark, light (and high contrast) Supports smaller screens (eg. laptops) Line height can be optimized for smaller screens Blank and non-alphanumeric lines are 75% the normal height No extra spacing between lines (saves 1 vertical pixel per line) Menu and toolbar share the same line Full screen mode (Shift+Alt+Enter) saves some vertical pixels High DPI support and per-monitor DPI-aware Translated to several languages Highly extensible Write your own extensions and add your own features All major features are already extensions (assembly editor, debugger, decompiler) Multiple tabs and tab groups Your screen is too big? Don’t cut it in half, add another vertical tab group and read two classes at once! The tabs and positions within the text editors are saved when you close dnSpy and restored at startup so you can continue where you left off Search assemblies Search for types (classes), methods, properties, events, fields Search for strings or numbers in code Assembly analyzer Find usages of types (classes), methods, properties, events, fields BAML to XAML decompiler Fast Highlighted references, keywords References under the caret are highlighted to make it easier to see all uses of the reference in the code Tab, Shift+Tab, Ctrl+Shift+Up, Ctrl+Shift+Down moves to the next or previous reference Alt+Down and Alt+Up moves to the next or previous definition (type (class), method, property, event, field) Structure visualizer Vertical guide lines shown between start and end of code blocks Different colors are used for different blocks, eg. loop, conditional, method, etc dnlib is used to read and write assemblies so it can handle obfuscated code (eg. malware) without crashing Go to commands: Entry point Assembly static initialization method (<Module>..cctor) Any metadata token Any metadata row Syntax highlighted tooltips with XML doc comments when hovering over a type (class), method, property, event, field Methods, properties and events are decompiled in source code order or a custom user-defined order Source code order means that related methods are usually next to each other, just like the programmer wanted Background images can be shown in the text editor Export to project decompiles all selected assemblies and creates a Visual Studio solution Multiple assemblies can be exported at the same time Creates a Visual Studio solution (supports VS2005 – VS-latest) and project files Supports WinForms and WPF classes (creates a code-behind .cs/.vb file and a WinForms .resx / WPF .xaml file) Converts .NET resources to .resx files Open from GAC Command line decompiler Supports Windows, Linux and Mac Syntax highlights output to the screen Scripting with C# REPL Call public dnSpy methods from scripts Script the debugger and other extensions Hex editor Method tokens and addresses are shown in comments and can be clicked to go to the raw metadata or IL bytes Metadata editor Collapse Assembly Explorer nodes command to quickly collapse unused nodes And more… [HIDE][Hidden Content]]