dotnet-reverse

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

.NET / C# 逆向作业规范

.NET / C# Reverse Engineering Operation Specification

ACTION REQUIRED（读完立刻执行）

ACTION REQUIRED (Execute immediately after reading)

```
NOW
```
: 用 DIE/
```
file
```
/CLR 头确认目标是 .NET 托管（否则 SWITCH 到
```
ida-reverse/
```
/
```
reverse-engineering/
```
）
```
NOW
```
: 若疑似混淆 → 先
```
de4dot
```
脱壳，产出
```
*-clean.exe
```
，保留原始样本
```
NEXT
```
: dnSpyEx（或 dnSpy MCP /
```
ilspycmd
```
）静态：C# 浏览 + IL 视图看关键判断
```
ACT
```
: 需要明文/C2 时动态调试；需要改逻辑时 IL patch 优先于 C# 重编译
阶段结束给用户 3–6 项下一步菜单（含导出报告）

```
NOW
```
: Confirm the target is .NET managed using DIE/
```
file
```
/CLR header (SWITCH to
```
ida-reverse/
```
/
```
reverse-engineering/
```
if not)
```
NOW
```
: If obfuscation is suspected → First use
```
de4dot
```
to unpack, output
```
*-clean.exe
```
, and keep the original sample
```
NEXT
```
: Static analysis with dnSpyEx (or dnSpy MCP /
```
ilspycmd
```
): Browse C# + check key judgments via IL View
```
ACT
```
: Dynamic debugging when plaintext/C2 is needed; prioritize IL patch over C# recompilation when logic modification is required
At the end of the phase, provide users with 3–6 next-step options (including report export)

适用范围

Scope of Application

当任务属于以下场景时优先使用本 skill：

识别并逆向 .NET / C# 编译产物（托管 PE / .exe / .dll）
分析红队 Sharp* 工具链（Rubeus、SharpHound、SharpShell 等）
脱混淆 ConfuserEx / SmartAssembly / Babel / Eazfuscator / .NET Reactor 等壳
逆向 .NET loader / info-stealer / RAT 的解密与 C2 逻辑
对 C# 程序做 patch（改判断、改常量、keygen）
分析 IL2CPP 之前的 Mono/Unity 托管层（注意：IL2CPP 编译后是 native，走
```
reverse-engineering/
```
+ seed-014）

如果目标是纯 native 二进制（C/C++/Go/Rust 编译、无 CLR），请改用

reverse-engineering/

、

ida-reverse/

或

radare2/

。

Prioritize using this skill for the following scenarios:

Identify and reverse-engineer .NET / C# compiled products (managed PE / .exe / .dll)
Analyze red team Sharp* toolchains (Rubeus, SharpHound, SharpShell, etc.)
Unpack shells from ConfuserEx / SmartAssembly / Babel / Eazfuscator / .NET Reactor, etc.
Reverse-engineer decryption and C2 logic of .NET loader / info-stealer / RAT
Patch C# programs (modify judgments, constants, keygen)
Analyze Mono/Unity managed layer before IL2CPP (Note: IL2CPP-compiled products are native, use
```
reverse-engineering/
```
+ seed-014)

If the target is a pure native binary (compiled with C/C++/Go/Rust, no CLR), please use

reverse-engineering/

ida-reverse/

radare2/

instead.

核心原则

Core Principles

先识别再下手：先确认是 .NET 托管程序（PE 头 CLR +
```
#~
```
/
```
#Strings
```
流 + mscoree
```
_CorExeMain
```
），再决定走 dnSpy 而非 IDA
IL 优先于 C#：dnSpyEx 的 C# 反编译器会丢失/扭曲信息（编译器生成的状态机、async/await、yield），关键判断与 patch 必须切到 IL 编辑器，C# 视图只用于快速浏览
de4dot 先行：遇到混淆器先
```
de4dot
```
脱一轮再做静态分析，否则字符串/控制流全是乱的
MCP 联动：环境里若注册了 dnSpy MCP（
```
dnspy_*
```
工具），优先走 MCP 面做 decompile / IL inspection，避免来回切 GUI
证据化输出：脱混淆产物、提取的配置/C2/key、patch diff 都要落盘

Identify first, act later: Confirm it's a .NET managed program (CLR in PE header +
```
#~
```
/
```
#Strings
```
streams + mscoree
```
_CorExeMain
```
) before deciding to use dnSpy instead of IDA
IL takes precedence over C#: dnSpyEx's C# decompiler may lose/distort information (compiler-generated state machines, async/await, yield), key judgments and patches must switch to IL Editor, C# view is only for quick browsing
de4dot first: Use
```
de4dot
```
to unpack before static analysis when encountering obfuscators, otherwise strings/control flow will be garbled
MCP linkage: If dnSpy MCP (
```
dnspy_*
```
tools) is registered in the environment, prioritize decompile / IL inspection via MCP interface to avoid switching GUI back and forth
Evidence-based output: Unpacked products, extracted configurations/C2/keys, and patch diffs must be saved to disk

工具链映射

Toolchain Mapping

能力	首选	备注
反编译 + 调试 + patch	dnSpyEx	王牌，唯一带 IL 编辑器的 GUI；老 dnSpy 已停更，用 Ex 分支
轻量 CLI / headless 反编译	ILSpy ( `ilspycmd` )	适合批量、脚本化、Linux/macOS
脱混淆	de4dot	ConfuserEx 全家桶、SmartAssembly 等主流壳的默认解
混淆器识别	Detect It Easy (DIE) / file	先判断壳类型再决定 de4dot 参数
编程化操作 IL	dnlib	写 C# 脚本批量改 metadata / 字符串解密器
AI 直接操作	dnSpy MCP	`dnspy_decompile` / `dnspy_inspect_il` 等工具面

前置：Windows 主机装 dnSpyEx + de4dot（choco 或 release）；Linux/macOS 用
ilspycmd
+
dotnet runtime
。详见
references/sharp-tools.md
的安装矩阵。

Capability	Preferred Tool	Remarks
Decompilation + Debugging + Patching	dnSpyEx	Ace tool, the only GUI with IL Editor; old dnSpy is no longer maintained, use the Ex branch
Lightweight CLI / headless decompilation	ILSpy ( `ilspycmd` )	Suitable for batch processing, scripting, Linux/macOS
Deobfuscation	de4dot	Default solution for mainstream shells like ConfuserEx family, SmartAssembly, etc.
Obfuscator detection	Detect It Easy (DIE) / file	Determine the shell type first before deciding de4dot parameters
Programmatic IL operation	dnlib	Write C# scripts to batch modify metadata / string decrypters
Direct AI operation	dnSpy MCP	Tools like `dnspy_decompile` / `dnspy_inspect_il`

Prerequisites: Install dnSpyEx + de4dot on Windows host (via choco or release); use
ilspycmd
+
dotnet runtime
on Linux/macOS. See the installation matrix in
references/sharp-tools.md
.

六阶段工作流

Six-Phase Workflow

1. Identify（识别 .NET）

1. Identify (.NET Recognition)

确认目标是托管程序，别把 native PE 当 .NET 分析：

powershell

undefined

Confirm the target is a managed program, don't treat native PE as .NET:

powershell

undefined

Windows

file target.exe # "PE32 executable ... for MS Windows" 不够

file target.exe # "PE32 executable ... for MS Windows" is not sufficient

关键：看有没有 CLR

Key: Check if CLR exists

powershell -c "[System.Reflection.AssemblyName]::GetAssemblyName('target.exe')"

或

Or

dnSpyEx 直接拖进去 —— 能打开就是托管

drag directly into dnSpyEx —— if it can be opened, it's managed

通用

Cross-platform

strings target.exe | grep -iE "mscoree|_CorExeMain|mscorlib|System\."


**.NET 识别标志：**
- PE 头 `Data Directory[14]` (CLR Runtime Header) 非零
- `mscoree.dll` 导入 / `_CorExeMain` 入口
- `#~`、`#Strings`、`#US`、`#GUID`、`#Blob` metadata 流
- `mscorlib` / `System.Private.CoreLib` 字符串

**NativeAOT 例外：** 编译成 native，没有 CLR 头，但有 `System.Private.CoreLib` 字符串和重构过的类型元数据 —— 这类走 `reverse-engineering/`（IDA/r2），本 skill 仅做识别提示。

strings target.exe | grep -iE "mscoree|_CorExeMain|mscorlib|System\."


**.NET Identification Marks:**
- Non-zero `Data Directory[14]` (CLR Runtime Header) in PE header
- Import of `mscoree.dll` / `_CorExeMain` entry point
- `#~`, `#Strings`, `#US`, `#GUID`, `#Blob` metadata streams
- `mscorlib` / `System.Private.CoreLib` strings

**NativeAOT Exception:** Compiled to native, no CLR header, but has `System.Private.CoreLib` strings and reconstructed type metadata —— use `reverse-engineering/` (IDA/r2) for this type, this skill only provides identification prompts.

2. Detect（检测混淆器）

2. Detect (Obfuscator Detection)

powershell

undefined

powershell

undefined

DIE 快速识别

Quick identification with DIE

diec target.exe # Detect It Easy CLI

或拖进 dnSpyEx，看是否大量乱码类名 / 控制流变形

Or drag into dnSpyEx to check if there are a large number of garbled class names / control flow deformations


常见混淆器 → 脱壳策略（详见 `references/obfuscators.md`）：

| 混淆器 | 特征 | de4dot 处理 |
|--------|------|------------|
| ConfuserEx (1.0.0 / 2.x) | `<module>` anti-tamper、控制流变形、字符串加密 | `de4dot target.exe` 通常自动识别 |
| SmartAssembly | `circular`/`string encoding`、资源压缩 | `de4dot target.exe` |
| Babel.NET | 方法体加密、控制流 | `de4dot target.exe` |
| Eazfuscator.NET | 字符串/资源加密 | `de4dot`，部分版本需手动 |
| .NET Reactor | anti-tamper + necrobit | `de4dot`，新版可能失败需手动 |


Common obfuscators → Unpacking strategies (see `references/obfuscators.md` for details):

| Obfuscator | Features | de4dot Processing |
|--------|------|------------|
| ConfuserEx (1.0.0 / 2.x) | `<module>` anti-tamper, control flow deformation, string encryption | `de4dot target.exe` usually identifies automatically |
| SmartAssembly | `circular`/`string encoding`, resource compression | `de4dot target.exe` |
| Babel.NET | Method body encryption, control flow | `de4dot target.exe` |
| Eazfuscator.NET | String/resource encryption | `de4dot`, manual operation required for some versions |
| .NET Reactor | anti-tamper + necrobit | `de4dot`, manual operation may be needed if new versions fail |

3. Deobfuscate（脱混淆）

3. Deobfuscate (Unpacking)

powershell

undefined

powershell

undefined

de4dot 默认自动识别大多数壳

de4dot automatically identifies most shells by default

de4dot target.exe -o target-clean.exe

指定类型（自动识别失败时）

Specify type (when automatic identification fails)

de4dot --type cfze target.exe # ConfuserEx de4dot --type sa target.exe # SmartAssembly

多层混淆 / de4dot 报 unknown

Multi-layer obfuscation / de4dot reports unknown

de4dot --detect target.exe # 看它识别成什么

de4dot --detect target.exe # Check what it identifies as

可能要先 patch anti-tamper 再 de4dot（见 references/obfuscators.md）

May need to patch anti-tamper first before de4dot (see references/obfuscators.md)


产出：`target-clean.exe`，后续分析用它。**保留原始样本**做对照。


Output: `target-clean.exe`, use this for subsequent analysis. **Keep the original sample** for comparison.

4. Static Analyze（静态分析）

4. Static Analyze (Static Analysis)

dnSpyEx 加载脱壳后样本：

C# 视图：快速浏览类结构、方法签名、字符串（用于定位）
IL 视图：关键判断、加密逻辑、状态机必须看 IL（右键 → Edit IL 或 IL 视图）
找入口：
```
Main
```
/
```
Startup
```
/ 模块初始化器 (
```
Module .cctor
```
)

找关键逻辑：搜

flag

、

password

、

verify

、

check

、

encrypt

、

http

、

Config

text

定位字符串 → 反向引用 → 找到使用它的方法 → IL 视图看判断逻辑

Load the unpacked sample into dnSpyEx:

C# View: Quickly browse class structure, method signatures, strings (for positioning)
IL View: Key judgments, encryption logic, state machines must be viewed in IL (right-click → Edit IL or IL View)
Find entry points:
```
Main
```
/
```
Startup
```
/ module initializer (
```
Module .cctor
```
)

Find key logic: Search for

flag

password

verify

check

encrypt

http

Config

text

Locate strings → Reverse reference → Find methods using them → Check judgment logic in IL View

5. Dynamic（动态调试）

5. Dynamic (Dynamic Debugging)

dnSpyEx 调试器：附加进程 / 启动调试，在关键方法下断点，观察运行时：

解密后的明文字符串（很多混淆器的字符串在运行时才解密）
C2 地址、配置解密结果
异常驱动的控制流（anti-debug 常用
```
try/catch
```
隐藏真实路径）

.NET 动态调试比 native 友好得多 —— 能直接看到对象值、字符串内容。优先动态而非死磕静态。

Use dnSpyEx debugger: Attach to process / start debugging, set breakpoints at key methods, observe runtime:

Decrypted plaintext strings (many obfuscators decrypt strings only at runtime)
C2 addresses, configuration decryption results
Exception-driven control flow (anti-debug commonly uses
```
try/catch
```
to hide real paths)

.NET dynamic debugging is much more user-friendly than native —— you can directly see object values and string content. Prioritize dynamic debugging over struggling with static analysis.

6. Patch（按需修改）

6. Patch (On-Demand Modification)

text

dnSpyEx → 右键方法 → Edit Method (C#) 或 Edit IL
  - 改判断：ldc.i4.0 → ldc.i4.1（false→true）
  - 改常量：直接编辑字符串/数字
  - 删除校验：nop 掉整段
File → Save Module → 替换原文件

IL patch 可靠性 > C# patch：C# 重编译可能失败（缺引用、语法不对），IL 编辑几乎不会失真。详见

references/common-workflow.md

。

text

dnSpyEx → Right-click method → Edit Method (C#) or Edit IL
  - Modify judgment: ldc.i4.0 → ldc.i4.1 (false→true)
  - Modify constants: Directly edit strings/numbers
  - Remove verification: Nop out the entire segment
File → Save Module → Replace original file

IL patch reliability > C# patch: C# recompilation may fail (missing references, syntax errors), while IL editing almost never distorts the original code. See

references/common-workflow.md

for details.

触发场景路由

Trigger Scenario Routing

用户说这些时进入本 skill：

".NET / C# 二进制逆向" / "C# 程序反编译"
"dnSpy 分析" / "dnSpyEx patch"
"ConfuserEx / SmartAssembly / Babel 脱混淆 / 脱壳"
"Sharp* 工具分析"（Rubeus / SharpHound / SharpShell）
".NET malware / loader / info-stealer 逆向"
"C# 程序 patch / keygen / 修改判断"

Enter this skill when users mention:

".NET / C# binary reverse engineering" / "C# program decompilation"
"dnSpy analysis" / "dnSpyEx patch"
"ConfuserEx / SmartAssembly / Babel deobfuscation / unpacking"
"Sharp* tool analysis" (Rubeus / SharpHound / SharpShell)
".NET malware / loader / info-stealer reverse engineering"
"C# program patch / keygen / judgment modification"

何时切出

When to Switch Out

IL2CPP 编译的 Unity 游戏 →
```
reverse-engineering/
```
+
```
seed-014_unity-il2cpp-reverse.md
```
（IL2CPP 是 native，不走 dnSpy）
NativeAOT 产物 →
```
reverse-engineering/
```
（同上，native）
纯 native PE（无 CLR）→
```
reverse-engineering/
```
/
```
ida-reverse/
```
需要符号/函数批量迁移到别的版本 →
```
binary-diff/
```
需要画攻击路径 / 调用链图 →
```
diagram-generator/
```

Unity games compiled with IL2CPP →
```
reverse-engineering/
```
+
```
seed-014_unity-il2cpp-reverse.md
```
(IL2CPP is native, do not use dnSpy)
NativeAOT products →
```
reverse-engineering/
```
(same as above, native)
Pure native PE (no CLR) →
```
reverse-engineering/
```
/
```
ida-reverse/
```
Need to batch migrate symbols/functions to other versions →
```
binary-diff/
```
Need to draw attack path / call chain diagrams →
```
diagram-generator/
```

路由上下文

Routing Context

上游入口:

skills/SKILL.md

（总控）、

routing.md

下游出口:

IL2CPP / NativeAOT（native）→
```
reverse-engineering/
```
深度 native .so/.dll 段分析 →
```
ida-reverse/
```
/
```
radare2/
```
需要 AI 直接操作 dnSpy → 注册并联动 dnSpy MCP（见
```
references/sharp-tools.md
```
）

同级关联模块:

reverse-engineering/languages-compiled.md

（.NET 简介指向本模块）

```
apk-reverse/
```
（Xamarin/MAUI Android 逆向可切回本模块看 C# 层）

Upstream Entries:

skills/SKILL.md

(master control),

routing.md

Downstream Exports:

IL2CPP / NativeAOT (native) →
```
reverse-engineering/
```
In-depth native .so/.dll segment analysis →
```
ida-reverse/
```
/
```
radare2/
```
Need AI to operate dnSpy directly → Register and link with dnSpy MCP (see
```
references/sharp-tools.md
```
)

Peer Associated Modules:

reverse-engineering/languages-compiled.md

(.NET introduction points to this module)

```
apk-reverse/
```
(Xamarin/MAUI Android reverse engineering can switch back to this module to view C# layer)

参考文档

Reference Documents

references/obfuscators.md — ConfuserEx / SmartAssembly / Babel / Eazfuscator / .NET Reactor 脱混淆详解 + anti-tamper 绕过
references/common-workflow.md — 完整工作流、IL patch 可靠性、字符串解密器提取、状态机识别
references/sharp-tools.md — 红队 Sharp* 工具分析、工具安装矩阵、dnSpy MCP 集成、社区资源索引

references/obfuscators.md — Detailed deobfuscation of ConfuserEx / SmartAssembly / Babel / Eazfuscator / .NET Reactor + anti-tamper bypass
references/common-workflow.md — Complete workflow, IL patch reliability, string decrypter extraction, state machine identification
references/sharp-tools.md — Red team Sharp* tool analysis, tool installation matrix, dnSpy MCP integration, community resource index

dotnet-reverse

Original

Translation

.NET / C# 逆向作业规范

.NET / C# Reverse Engineering Operation Specification

ACTION REQUIRED（读完立刻执行）

ACTION REQUIRED (Execute immediately after reading)

适用范围

Scope of Application

核心原则

Core Principles

工具链映射

Toolchain Mapping

六阶段工作流

Six-Phase Workflow

1. Identify（识别 .NET）

1. Identify (.NET Recognition)

Windows

Windows

关键：看有没有 CLR

Key: Check if CLR exists

或

Or

通用

Cross-platform

2. Detect（检测混淆器）

2. Detect (Obfuscator Detection)

DIE 快速识别

Quick identification with DIE

或拖进 dnSpyEx，看是否大量乱码类名 / 控制流变形

Or drag into dnSpyEx to check if there are a large number of garbled class names / control flow deformations

3. Deobfuscate（脱混淆）

3. Deobfuscate (Unpacking)

de4dot 默认自动识别大多数壳

de4dot automatically identifies most shells by default

指定类型（自动识别失败时）

Specify type (when automatic identification fails)

多层混淆 / de4dot 报 unknown

Multi-layer obfuscation / de4dot reports unknown

可能要先 patch anti-tamper 再 de4dot（见 references/obfuscators.md）

May need to patch anti-tamper first before de4dot (see references/obfuscators.md)

4. Static Analyze（静态分析）

4. Static Analyze (Static Analysis)

5. Dynamic（动态调试）

5. Dynamic (Dynamic Debugging)

6. Patch（按需修改）

6. Patch (On-Demand Modification)

触发场景路由

Trigger Scenario Routing

何时切出

When to Switch Out

路由上下文

Routing Context

参考文档

Reference Documents

任务完成自检

Task Completion Self-Check