.NET Reverse Engineering Skill in reverse-skill: Complete Toolchain Architecture

The .NET reverse engineering skill in the reverse-skill repository provides a specialized toolchain comprising de4dot, dnSpy, ILSpy, and custom cryptographic analysis scripts to deobfuscate, inspect, and rebuild .NET assemblies across static and dynamic analysis workflows.

The zhaoxuya520/reverse-skill repository defines the .NET reverse engineering skill as a dedicated sub-skill for analyzing managed binaries. This skill orchestrates a complete lifecycle toolkit that handles everything from initial deobfuscation to post-processing clean builds, integrating tightly with the framework's evidence slots like E-imports and E-triage-imports.

Core Tools in the .NET Reverse Engineering Skill

The architecture divides the toolkit into four distinct phases, each mapped to specific evidence gathering stages as defined in skills/ops/role-map.md.

Static Analysis and Deobfuscation Tools

Static analysis begins with identifying obfuscators and extracting clean Intermediate Language (IL) code.

de4dot serves as the automated deobfuscator for common .NET protectors. In skills/reverse-engineering/references/obfuscators.md, this tool is documented as the primary solution for handling ConfuserEx, SmartAssembly, and .NET Reactor protections. The skill routes protected binaries through de4dot first, storing the cleaned metadata in the E-imports evidence slot.

dnSpy and ILSpy function as the core IL decompilers and debuggers. According to skills/reverse-engineering/tools.md in the .NET Analysis section, these tools provide the clean IL view necessary for manual inspection. They enumerate entry points, embedded resources, and cryptographic patterns before dynamic execution.

dotnet-inspect provides CLI-based metadata extraction via commands like dotnet-inspect collect, populating the initial evidence state without executing the binary.

Dynamic Analysis and Runtime Monitoring

Dynamic execution captures runtime-generated data such as decrypted strings and API calls.

dnSpy (runtime debugger) attaches to .NET processes to enable stepping through IL instructions. This captures behavioral evidence written to the E-triage-imports slot, enabling subsequent phases to reference exact runtime behavior.

dotnet-trace collects .NET Core tracing data through the event pipe, monitoring method executions and garbage collection events during sandboxed runs.

Cryptographic Pattern Recognition

The skill includes a custom .NET-analysis script referenced in skills/reverse-engineering/tools.md under the .NET Analysis section. This specialized tool scans for RijndaelManaged implementations where the key equals the IV—a common pattern in CTF challenges. The script augments static evidence with a "crypto-signature" flag, automatically triggering deobfuscation routines when XOR and AES-256-CBC patterns are detected.

Post-Processing and Rebuilding

After cleaning, binaries require repackaging for further testing or deployment.

ILRepack merges multiple deobfuscated assemblies into a single output module. This tool is essential when the original binary relied on satellite DLLs that were separately cleaned.

dotnet-publish rebuilds a clean, production-ready package from the decompiled source, verifying that all framework hard-gates (such as mandatory E-imports verification) are satisfied before the artifact re-enters the generic routing pipeline.

Source File Architecture

The .NET reverse engineering skill is architected across several key files in the repository:

• skills/reverse-engineering/tools.md: Central catalog defining the .NET Analysis section and mapping tools to analysis phases.
• skills/reverse-engineering/references/obfuscators.md: Documents protection schemes and corresponding deobfuscation strategies.
• skills/reverse-engineering/references/sharp-tools.md: Enumerates red-team utilities (Rubeus, SharpHound) that produce target binaries for the skill to dissect.
• skills/reverse-engineering/SKILL.md: High-level overview linking the .NET sub-skill to the broader reverse engineering framework.
• skills/ops/role-map.md: Maps the .NET skill to evidence slots (E-imports, E-triage-imports) used throughout the pipeline.
• skills/ops/analysis-blindspot-cookbook.md: Documents edge-case handling for .NET Native AOT binaries (line 18, "R56 .NET Native AOT") and validates toolchain completeness.

Practical Workflow Examples

The following commands demonstrate the typical invocation sequence for the .NET reverse engineering skill toolchain.

Deobfuscate a protected binary using de4dot:

de4dot -r -o cleaned.dll target.dll

Open the cleaned assembly in dnSpy for interactive IL inspection:

dnSpy cleaned.dll

Execute the cryptographic pattern scanner to detect Rijndael implementations:

python3 tools/net_analysis.py --binary cleaned.dll

Debug the binary to capture runtime-decrypted strings:

dnSpy.exe -debug cleaned.dll

# Set breakpoint: System.Security.Cryptography.RijndaelManaged::TransformFinalBlock

Repack multiple cleaned modules into a single assembly:

ILRepack /out:final.dll cleaned.dll other.dll

Summary

• The .NET reverse engineering skill in zhaoxuya520/reverse-skill provides a four-phase toolchain covering static analysis, dynamic execution, cryptographic detection, and post-processing.
• de4dot, dnSpy, and ILSpy handle deobfuscation and IL-level static inspection, storing results in the E-imports slot defined in skills/ops/role-map.md.
• dnSpy debugger and dotnet-trace capture runtime behavior for the E-triage-imports evidence slot.
• A custom .NET-analysis script detects specific cryptographic patterns (RijndaelManaged with key=IV) to trigger automated workflows.
• ILRepack and dotnet-publish finalize cleaned binaries for redeployment.
• Source documentation resides in skills/reverse-engineering/tools.md, skills/reverse-engineering/references/obfuscators.md, and skills/ops/analysis-blindspot-cookbook.md.

Frequently Asked Questions

What is the primary deobfuscation tool recommended in the reverse-skill .NET reverse engineering skill?

The skill recommends de4dot as the primary deobfuscator for common .NET protectors like ConfuserEx and SmartAssembly. According to skills/reverse-engineering/references/obfuscators.md, de4dot automatically removes protection layers and outputs clean IL that can be processed by dnSpy or ILSpy for further analysis.

How does the .NET reverse engineering skill handle runtime-decrypted strings?

The skill uses dnSpy in debugger mode to attach to running .NET processes and step through IL instructions. This dynamic analysis captures runtime-generated data (such as decrypted strings) and stores it in the E-triage-imports evidence slot, allowing subsequent analysis phases to reference the exact runtime behavior observed during execution.

What cryptographic patterns does the custom .NET-analysis script detect?

The custom script, documented in skills/reverse-engineering/tools.md, specifically scans for RijndaelManaged implementations where the encryption key equals the initialization vector (IV). This pattern commonly appears in CTF challenges and malware samples using XOR plus AES-256-CBC configurations, triggering a "crypto-signature" flag in the evidence pipeline.

Where does the skill document edge cases for .NET Native AOT binaries?

Edge cases for .NET Native AOT (Ahead-of-Time) compilation are documented in skills/ops/analysis-blindspot-cookbook.md at line 18 under the identifier "R56 .NET Native AOT". This section outlines specialized toolchain requirements for analyzing AOT-compiled assemblies that lack traditional IL metadata, ensuring the skill can handle modern .NET deployment scenarios.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}