# How to Analyze .NET Assemblies with dnSpy and de4dot: A Complete Reverse Engineering Workflow

> Analyze obfuscated .NET assemblies with dnSpy and de4dot. Clean packed binaries with de4dot, then debug and patch decompiled C# code in dnSpyEx for complete reverse engineering.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-06

---

**Analyze obfuscated .NET binaries by running de4dot to automatically strip packers like ConfuserEx, then open the cleaned DLL in dnSpyEx to browse decompiled C#, debug runtime behavior, and patch IL instructions.**

The **reverse-skill** repository by zhaoxuya520 documents a systematic approach to analyze .NET assemblies with dnSpy and de4dot. According to [`skills/dotnet-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/dotnet-reverse/SKILL.md), the workflow combines automated de-obfuscation with interactive static and dynamic analysis to dissect protected commercial software and malware samples.

## Tool Overview and Prerequisites

Before analyzing a suspect binary, verify you have the correct toolchain installed.

### de4dot: The De-obfuscation Engine

**de4dot** is an open-source de-obfuscator that removes protections from ConfuserEx, SmartAssembly, Babel, and similar packers. As noted in [`skills/reverse-engineering/tools.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools.md), it acts as a mandatory preprocessing step that produces a clean Intermediate Language (IL) image suitable for deep inspection.

### dnSpyEx: The Integrated Analysis Environment

**dnSpyEx** is the actively maintained community fork of dnSpy. It merges a C# decompiler, IL viewer, debugger, and IL editor into a single Windows GUI. The repository's [`skills/dotnet-reverse/references/sharp-tools.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/dotnet-reverse/references/sharp-tools.md) identifies this as the primary environment for interactive analysis after de-obfuscation.

## The Five-Step Analysis Workflow

The canonical process defined in [`skills/dotnet-reverse/references/common-workflow.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/dotnet-reverse/references/common-workflow.md) follows a strict sequence from initial detection to final patching.

### Step 1 – Verify the Assembly Structure

Confirm the target is a managed .NET executable by checking for CLR metadata streams such as `#~` or `#Strings`. You can use `dotnet-inspect` or `pefile` to verify the presence of `_CorExeMain` in the PE import table before proceeding.

### Step 2 – De-obfuscate with de4dot

Run **de4dot** against the packed DLL to remove anti-tamper wrappers and string encryption. Use the following command structure:

```bash
de4dot -v -s -o clean.dll suspicious.dll

```

- `-v` enables verbose output to track progress.
- `-s` attempts automatic de-obfuscation for detected packers.
- `-o` specifies the output file containing the cleaned assembly.

For batch processing with logging, append the `-log` flag:

```bash
de4dot -v -log de4dot.log target.dll

```

### Step 3 – Static Analysis in dnSpyEx

Launch **dnSpyEx** and drag `clean.dll` into the Assembly Explorer. The tool immediately reconstructs C# source from the IL.

- Use the **C# view** for high-level logic review, especially for async/await state machines.

- Switch to the **IL view** for precise control-flow analysis of compiler-generated lambdas and obfuscated loops.

### Step 4 – Dynamic Debugging

Attach the dnSpyEx debugger to observe runtime behavior:

1. Select **Start Debugging** and launch the executable.
2. Locate suspicious methods (e.g., decryption routines) in the tree view.
3. Right-click and select **Breakpoint → New Breakpoint**.
4. Run until the breakpoint triggers to inspect local variables and decrypted strings in memory.

### Step 5 – Patch and Rebuild

Modify the binary directly within the GUI:

1. Right-click the target method and select **Edit Method (IL)**.
2. Modify the opcode sequence to alter behavior or bypass licensing checks.
3. Select **File → Save Module** to write the patched assembly.

The modified DLL can be re-executed immediately to verify the patch efficacy.

## Cross-Platform Considerations

While **dnSpyEx** provides the best experience on Windows, the repository notes alternatives for Linux and macOS. You can run **de4dot** via Mono to clean the assembly, then use `ilspycmd` for command-line decompilation. However, the integrated debugging and IL editing capabilities remain exclusive to the Windows dnSpyEx build.

## Key Repository Files

The **reverse-skill** repository contains detailed reference material supporting this workflow:

- [`skills/dotnet-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/dotnet-reverse/SKILL.md) – High-level skill definition and the recommended "dnSpyEx + de4dot" tool stack.
- [`skills/reverse-engineering/tools.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools.md) – Enumerates dnSpy as the primary decompiler and lists de4dot as the go-to de-obfuscator.
- [`skills/dotnet-reverse/references/obfuscators.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/dotnet-reverse/references/obfuscators.md) – Details specific packer behaviors and explains how de4dot neutralizes each protection layer.
- [`skills/dotnet-reverse/references/sharp-tools.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/dotnet-reverse/references/sharp-tools.md) – Installation matrices and OS-specific setup instructions for the toolchain.
- [`skills/dotnet-reverse/references/common-workflow.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/dotnet-reverse/references/common-workflow.md) – Step-by-step procedural guide matching the sequence detailed above.

## Summary

- **Detect** the CLR header and entry points before attempting analysis.
- **De-obfuscate** automatically using `de4dot -s -o` to strip ConfuserEx and similar protections.
- **Explore** the cleaned assembly in **dnSpyEx**, toggling between high-level C# and low-level IL views.

- **Debug** dynamically by attaching to the process and setting breakpoints on critical methods.
- **Patch** directly in the IL editor and save the modified module for immediate testing.

## Frequently Asked Questions

### What is the difference between dnSpy and dnSpyEx?

**dnSpyEx** is the community-maintained fork of the original dnSpy project, which was archived in 2020. According to [`skills/dotnet-reverse/references/sharp-tools.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/dotnet-reverse/references/sharp-tools.md), dnSpyEx receives active updates for modern .NET versions while preserving the original's integrated decompiler, debugger, and IL editor.

### Can de4dot handle all .NET obfuscators?

**de4dot** supports most commercial and open-source packers including ConfuserEx, SmartAssembly, and Babel, as documented in [`skills/dotnet-reverse/references/obfuscators.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/dotnet-reverse/references/obfuscators.md). However, heavily customized or novel packers may require manual unpacking before de4dot can process the underlying IL metadata.

### Is it possible to analyze .NET assemblies on Linux or macOS?

Yes, but with limitations. You can run **de4dot** via Mono or Wine to clean the assembly, then use `ilspycmd` for static decompilation. The full debugging and IL editing workflow requires **dnSpyEx**, which currently runs only on Windows.

### How do I patch an assembly after finding a vulnerability?

In **dnSpyEx**, navigate to the target method in the Assembly Explorer, right-click, and select **Edit Method (IL)**. Modify the instructions, then choose **Save Module** from the File menu. The patched DLL can be redeployed immediately without recompiling from source.