# .NET Reverse Engineering Skill in reverse-skill: Complete Toolchain Architecture

> Master .NET reverse engineering with reverse-skill's toolchain. Explore de4dot, dnSpy, ILSpy, and custom scripts for deobfuscation and analysis. Enhance your skills today.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: architecture
- Published: 2026-08-24

---

**The .NET reverse engineering skill in the reverse-skill repository provides a specialized toolchain comprising de4dot, dnSpy, ILSpy, and custom cryptographic analysis scripts to deobfuscate, inspect, and rebuild .NET assemblies across static and dynamic analysis workflows.**

The `zhaoxuya520/reverse-skill` repository defines the .NET reverse engineering skill as a dedicated sub-skill for analyzing managed binaries. This skill orchestrates a complete lifecycle toolkit that handles everything from initial deobfuscation to post-processing clean builds, integrating tightly with the framework's evidence slots like **E-imports** and **E-triage-imports**.

## Core Tools in the .NET Reverse Engineering Skill

The architecture divides the toolkit into four distinct phases, each mapped to specific evidence gathering stages as defined in [`skills/ops/role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/role-map.md).

### Static Analysis and Deobfuscation Tools

Static analysis begins with identifying obfuscators and extracting clean Intermediate Language (IL) code.

**de4dot** serves as the automated deobfuscator for common .NET protectors. In [`skills/reverse-engineering/references/obfuscators.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/references/obfuscators.md), this tool is documented as the primary solution for handling ConfuserEx, SmartAssembly, and .NET Reactor protections. The skill routes protected binaries through de4dot first, storing the cleaned metadata in the **E-imports** evidence slot.

**dnSpy** and **ILSpy** function as the core IL decompilers and debuggers. According to [`skills/reverse-engineering/tools.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools.md) in the *.NET Analysis* section, these tools provide the clean IL view necessary for manual inspection. They enumerate entry points, embedded resources, and cryptographic patterns before dynamic execution.

**dotnet-inspect** provides CLI-based metadata extraction via commands like `dotnet-inspect collect`, populating the initial evidence state without executing the binary.

### Dynamic Analysis and Runtime Monitoring

Dynamic execution captures runtime-generated data such as decrypted strings and API calls.

**dnSpy** (runtime debugger) attaches to .NET processes to enable stepping through IL instructions. This captures behavioral evidence written to the **E-triage-imports** slot, enabling subsequent phases to reference exact runtime behavior.

**dotnet-trace** collects .NET Core tracing data through the event pipe, monitoring method executions and garbage collection events during sandboxed runs.

### Cryptographic Pattern Recognition

The skill includes a custom **.NET-analysis** script referenced in [`skills/reverse-engineering/tools.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools.md) under the *.NET Analysis* section. This specialized tool scans for `RijndaelManaged` implementations where the key equals the IV—a common pattern in CTF challenges. The script augments static evidence with a "crypto-signature" flag, automatically triggering deobfuscation routines when XOR and AES-256-CBC patterns are detected.

### Post-Processing and Rebuilding

After cleaning, binaries require repackaging for further testing or deployment.

**ILRepack** merges multiple deobfuscated assemblies into a single output module. This tool is essential when the original binary relied on satellite DLLs that were separately cleaned.

**dotnet-publish** rebuilds a clean, production-ready package from the decompiled source, verifying that all framework hard-gates (such as mandatory **E-imports** verification) are satisfied before the artifact re-enters the generic routing pipeline.

## Source File Architecture

The .NET reverse engineering skill is architected across several key files in the repository:

- **[`skills/reverse-engineering/tools.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools.md)**: Central catalog defining the *.NET Analysis* section and mapping tools to analysis phases.
- **[`skills/reverse-engineering/references/obfuscators.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/references/obfuscators.md)**: Documents protection schemes and corresponding deobfuscation strategies.
- **[`skills/reverse-engineering/references/sharp-tools.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/references/sharp-tools.md)**: Enumerates red-team utilities (Rubeus, SharpHound) that produce target binaries for the skill to dissect.
- **[`skills/reverse-engineering/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/SKILL.md)**: High-level overview linking the .NET sub-skill to the broader reverse engineering framework.
- **[`skills/ops/role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/role-map.md)**: Maps the .NET skill to evidence slots (`E-imports`, `E-triage-imports`) used throughout the pipeline.
- **[`skills/ops/analysis-blindspot-cookbook.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/analysis-blindspot-cookbook.md)**: Documents edge-case handling for .NET Native AOT binaries (line 18, "R56 .NET Native AOT") and validates toolchain completeness.

## Practical Workflow Examples

The following commands demonstrate the typical invocation sequence for the .NET reverse engineering skill toolchain.

Deobfuscate a protected binary using de4dot:

```bash
de4dot -r -o cleaned.dll target.dll

```

Open the cleaned assembly in dnSpy for interactive IL inspection:

```bash
dnSpy cleaned.dll

```

Execute the cryptographic pattern scanner to detect Rijndael implementations:

```bash
python3 tools/net_analysis.py --binary cleaned.dll

```

Debug the binary to capture runtime-decrypted strings:

```powershell
dnSpy.exe -debug cleaned.dll

# Set breakpoint: System.Security.Cryptography.RijndaelManaged::TransformFinalBlock

```

Repack multiple cleaned modules into a single assembly:

```bash
ILRepack /out:final.dll cleaned.dll other.dll

```

## Summary

- The **.NET reverse engineering skill** in `zhaoxuya520/reverse-skill` provides a four-phase toolchain covering static analysis, dynamic execution, cryptographic detection, and post-processing.
- **de4dot**, **dnSpy**, and **ILSpy** handle deobfuscation and IL-level static inspection, storing results in the **E-imports** slot defined in [`skills/ops/role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/role-map.md).
- **dnSpy debugger** and **dotnet-trace** capture runtime behavior for the **E-triage-imports** evidence slot.
- A custom **.NET-analysis** script detects specific cryptographic patterns (`RijndaelManaged` with key=IV) to trigger automated workflows.
- **ILRepack** and **dotnet-publish** finalize cleaned binaries for redeployment.
- Source documentation resides in [`skills/reverse-engineering/tools.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools.md), [`skills/reverse-engineering/references/obfuscators.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/references/obfuscators.md), and [`skills/ops/analysis-blindspot-cookbook.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/analysis-blindspot-cookbook.md).

## Frequently Asked Questions

### What is the primary deobfuscation tool recommended in the reverse-skill .NET reverse engineering skill?

The skill recommends **de4dot** as the primary deobfuscator for common .NET protectors like ConfuserEx and SmartAssembly. According to [`skills/reverse-engineering/references/obfuscators.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/references/obfuscators.md), de4dot automatically removes protection layers and outputs clean IL that can be processed by dnSpy or ILSpy for further analysis.

### How does the .NET reverse engineering skill handle runtime-decrypted strings?

The skill uses **dnSpy** in debugger mode to attach to running .NET processes and step through IL instructions. This dynamic analysis captures runtime-generated data (such as decrypted strings) and stores it in the **E-triage-imports** evidence slot, allowing subsequent analysis phases to reference the exact runtime behavior observed during execution.

### What cryptographic patterns does the custom .NET-analysis script detect?

The custom script, documented in [`skills/reverse-engineering/tools.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools.md), specifically scans for `RijndaelManaged` implementations where the encryption key equals the initialization vector (IV). This pattern commonly appears in CTF challenges and malware samples using XOR plus AES-256-CBC configurations, triggering a "crypto-signature" flag in the evidence pipeline.

### Where does the skill document edge cases for .NET Native AOT binaries?

Edge cases for .NET Native AOT (Ahead-of-Time) compilation are documented in [`skills/ops/analysis-blindspot-cookbook.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/analysis-blindspot-cookbook.md) at line 18 under the identifier "R56 .NET Native AOT". This section outlines specialized toolchain requirements for analyzing AOT-compiled assemblies that lack traditional IL metadata, ensuring the skill can handle modern .NET deployment scenarios.