# How to Analyze .NET Assemblies with dnSpy and de4dot: A Complete Reverse Engineering Guide

> Reverse engineer .NET assemblies using de4dot and dnSpyEx. Remove obfuscation, browse C# source, debug code, and edit IL instructions with this complete guide.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-02

---

**You can reverse engineer .NET binaries by first running `de4dot` to remove obfuscation layers, then loading the cleaned DLL into dnSpyEx to browse C# source, debug execution, and edit IL instructions directly.**

The **zhaoxuya520/reverse-skill** repository documents a battle-tested workflow for analyzing .NET assemblies using dnSpy and de4dot. This guide extracts the precise methodology found in [`skills/dotnet-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/dotnet-reverse/SKILL.md) and [`skills/dotnet-reverse/references/common-workflow.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/dotnet-reverse/references/common-workflow.md) to help you inspect, debug, and patch compiled .NET binaries.

## Prerequisites and Tool Setup

According to [`skills/dotnet-reverse/references/sharp-tools.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/dotnet-reverse/references/sharp-tools.md), you need **dnSpyEx** (the actively maintained community fork of dnSpy) and **de4dot**. While dnSpyEx provides the integrated decompiler, debugger, and IL editor, de4dot handles automated deobfuscation of ConfuserEx, SmartAssembly, and Babel protections.

## Step‑by‑Step Analysis Workflow

### Step 1: Verify the Target is a .NET Assembly

Before running tools, confirm the PE contains CLR metadata streams like `#~` or `#Strings` and an entry point such as `_CorExeMain`. You can use `pefile` or the `dotnet-inspect` utility mentioned in the repository.

### Step 2: Strip Obfuscation with de4dot

The [`skills/reverse-engineering/tools.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools.md) file identifies de4dot as the primary deobfuscator for .NET packers. Run it from the command line:

```bash
de4dot -v -s -o clean.dll suspicious.dll

```

The `-v` flag enables verbose progress logging, `-s` triggers automatic deobfuscation detection, and `-o` specifies the output path. For batch processing with logging:

```bash
de4dot -v -log de4dot.log target.dll

```

This produces a cleaned assembly free of most anti-tamper wrappers.

### Step 3: Explore Decompiled Code in dnSpyEx

Open the cleaned DLL in dnSpyEx by dragging it into the Assembly Explorer. The tool renders both a high-level **C# view** for logic review and a low-level **IL view** for precise control-flow analysis—critical for examining async state machines or compiler-generated lambdas documented in [`skills/dotnet-reverse/references/common-workflow.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/dotnet-reverse/references/common-workflow.md).

### Step 4: Dynamic Analysis with the dnSpyEx Debugger

For runtime inspection, use dnSpyEx’s integrated debugger. Start the executable from the GUI, locate suspicious methods (e.g., decryption routines), and set breakpoints. When execution pauses, inspect locals and arguments to capture plaintext values or decrypted buffers.

### Step 5: Patch and Rebuild with the IL Editor

To modify behavior, right-click any method and select **Edit Method (IL)**. Modify the opcode sequence directly, then choose **Save Module** to write the patched assembly. This workflow is the standard technique described in the repository for bypassing license checks or neutralizing malicious payloads.

## Handling Common .NET Obfuscators

The [`skills/dotnet-reverse/references/obfuscators.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/dotnet-reverse/references/obfuscators.md) file catalogs protections from ConfuserEx, Dotfuscator, and SmartAssembly. While de4dot handles most automatically, manual unpacking may be required for custom virtualized protectors. After removal, always re-verify the assembly in dnSpyEx to ensure the IL stream is readable.

## Cross‑Platform Alternatives

The repository notes that while dnSpyEx runs best on Windows, Linux and macOS users can substitute `ilspycmd` for decompilation and run `de4dot` via Mono or Wine. However, the integrated debugging and IL editing experience remains Windows-specific.

## Summary

- **Detect** – Confirm CLR headers exist before proceeding.
- **Deobfuscate** – Use `de4dot -s -o clean.dll target.dll` to strip protections.
- **Inspect** – Load cleaned binaries into dnSpyEx for C# and IL analysis per [`skills/dotnet-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/dotnet-reverse/SKILL.md).

- **Debug** – Attach the dnSpyEx debugger to observe runtime behavior.
- **Patch** – Edit IL directly within dnSpyEx and save the modified module.

## Frequently Asked Questions

### What is the difference between dnSpy and dnSpyEx?

dnSpyEx is the community-maintained fork of the original dnSpy project, which was archived. dnSpyEx receives active updates for newer .NET versions and bug fixes, making it the recommended tool in the `zhaoxuya520/reverse-skill` repository for modern .NET reverse engineering.

### Can de4dot handle all .NET obfuscators?

de4dot automatically removes protections from common tools like ConfuserEx, SmartAssembly, and Babel, as documented in [`skills/dotnet-reverse/references/obfuscators.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/dotnet-reverse/references/obfuscators.md). However, heavily customized or virtualized obfuscators may require manual unpacking or additional specialized tools before de4dot can process them.

### Is it possible to debug a .NET assembly without Windows?

While dnSpyEx’s full debugging and IL editing capabilities require Windows, you can use `ilspycmd` on Linux and macOS to decompile assemblies. For deobfuscation, run `de4dot` under Mono or Wine, though the interactive debugging experience will be limited compared to the native Windows workflow.

### How do I save changes after editing IL in dnSpyEx?

After modifying instructions in the IL editor, click **Save Module** (or press Ctrl+S) to write changes back to the DLL. You can then replace the original binary with your patched version to test the modifications, as outlined in [`skills/dotnet-reverse/references/common-workflow.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/dotnet-reverse/references/common-workflow.md).