导读
dnSpy,堪称.NET反编译神器。它是由ILSpy发展而来的免费开源的基于.NET语言的反编译与调试工具,用于实现.NET程序集逆向工程,可以对.NET开发的EXE和Dll程序集反编译为C#源码,支持断点调试和编辑C#代码,该项目包含反编译器,调试器、代码编辑器等功能,可以通过编写扩展插件的形式轻松实现功能扩展。该工具使用的dnlib读取和写入程序集,可以处理包含混淆代码的程序(如恶意程序)而不会崩溃。
介绍
dnSpy,堪称.NET反编译神器。它是由ILSpy发展而来的免费开源的基于.NET语言的反编译与调试工具,用于实现.NET程序集逆向工程,可以对.NET开发的EXE和Dll程序集反编译为C#源码,支持断点调试和编辑C#代码,该项目包含反编译器,调试器、代码编辑器等功能,可以通过编写扩展插件的形式轻松实现功能扩展。该工具使用的dnlib读取和写入程序集,可以处理包含混淆代码的程序(如恶意程序)而不会崩溃。
软件截图
软件特点
无需源代码,调试.NET程序,支持.NET Core平台;
编辑C#或IL代码,编辑所有元数据类,可扩展性高;
1、程序集代码编辑器(C# / Visual Basic)
2、反编译器、编译器(C# / Visual Basic)
3、调试器工具(.NET调试引擎,C# / Visual Basic语言)
4、BAML反汇编器(C#交互,支持多种语法代码风格)
5、HEX十六进制编辑器
运行要求:
dnSpy NET版本,需要 .NET Framework 4.7.2 或更高版。
dnSpy Core版本,不依赖于 .NET Framework 框架组件
Windows 7 操作系统必须安装KB2999226, KB2533623
更新日志
New features:
- All distributions of dnSpyEx now support resolving Windows shortcut files (
*.lnk
) when they are dragged onto the assembly explorer. - Extended the export to project feature by adding support for unpacking multi-element resources back to
.resx
source files - Introduce two additional options to the Save Module dialog. (
AddMvidSection
andForceBigColumns
) - Added a new menu command to copy the full name of any metadata member.
- Add support for horizontal scrolling with the shift key in the text and hex editors.
- Add support for multiline copy and paste to the text editor.
- Added support for
.url
shortcut files and modified the code to recursively resolve shortcuts until a target file is reached. - ILSpy Decompiler:
- Display custom attributes defined on interface implementations in the IL disassembly
- Add
IL with C#
decompiler language which annotates the IL disassembly with comments showing the higher level C# statements above the IL code responsible for them. - Show field initial value for simple primitive types in a comment located above the field declaration.
- Added a new decompiler option to disable the insertion of unnecessary parenthesis.
- Reworked BAML disassembler:
- Heavily improved syntax highlighting and other editor features like indent guides and brace pair highlighting.
- Add local jump to reference for BAML attribute, type, etc. declaration records.
- Add support for dnSpy’s number tooltips in the disassembler.
- Introduce tooltips for type, assembly, property, and resource references.
- Improved performance and memory efficiency.
Improvements and bug fixes:
- Fixed regular non-publish .NET 6 debug and release dnSpy builds, they no longer crash on startup and now also use the correct x86 icon when applicable.
- Fixed a commonly occurring
NullReferenceException
when editing event definitions using the assembly editor component. - Improved Chinese translation by
- Fixed incorrect handling of
__arglist
parameter in the Edit in C#/Edit in VB options. - Fix incorrect display of
VarArg
andNativeVarArg
in the signature editing dialog. - Properly handle
Unmanaged
calling convention across the dnSpyEx code base. - Fixed incorrect escaping behavior when displaying strings found in embedded resources.
- Refresh search results when the scope of the search operation is changed (e.g. a different file is selected and the search mode is set to the selected file)
- Fixed C# and VB tooltips for types with uninstantiated generic parameter signatures.
- Escape Hangul Filler characters and other similar whitespace characters that were previously not escaped across the dnSpyEx UI.
- Use reference assemblies for the compiler in the Edit in C#/Edit in VB options to fix issues with incorrect assembly references being emitted when editing .NET Standard or .NET Core assemblies.
- Added a workaround for a bug in WPF
WindowChromeWorker
that causedOverflowException
to be thrown for invalid hittest window messages. - Correctly set the available options based on the window state in the Windows Alt + Space menu.
- Improved .NET Standard assembly resolution to prioritize exact version match over the latest available version.
- Fixed a bug that resulted in the ability of the user to infinitely scroll horizontally.
- Fix an issue in the new RESX writer which resulted in incorrectly generated RESX for resources with user serialized types.
- ILSpy Decompiler:
- Fixed multiple NRE’s that occurred when decompiling heavily obfuscated property metadata.
- Fixed an issue that caused incorrect
dynamic
types to be introduced for method parameters. - Improved type inference for
calli
instructions as well as stores toreadonly
auto-properties. - Fixed several issues relating to the decompilation of member names containing a
.
character. - Display custom attributes in the same order that they appear in metadata by default.
- Improved performance and memory efficiency.
- Debugger:
- Fixed certain expressions in the Watch and Locals window being incorrectly syntax highlighted.
- Fixed a bug that prevented the
Show Raw Locals
option from working when the Roslyn EE failed to initialize due to invalid metadata. - Fixed a bug that prevented the
DebuggerDisplayAttribute
evaluator from working as intended. - Several improvements to the built-in IL interpreter and function evaluator aimed at improving performance and accuracy.
- Fixed type name parsing issues which lead to the debugger incorrectly resolving custom attributes, security declarations, and some marshal blobs.
- Improve the
Show in memory
command for objects in the locals and watch windows. - Improve the display of method names in the
Call stack
window.__arglist
,dynamic
,nint
,nuint
and tuple element names are now properly displayed. - Added an anti-anti-debug option to prevent the malicious use of NtRaiseHardError to trigger kernel faults (blue screens of death).
- Added an anti-anti-debug option to prevent the detection of the debugger using a call to
CloseHandle
with an invalid handle. - Update Roslyn debugger intrinsic handling to match what is expected by Roslyn 4.6.0
- CorDebug:
- Improved loading of dynamic modules (fixed issues with thread safety and added code to fetch more metadata from the CorDebug API)
- Fallback to COM-based metadata reading when the in-memory metadata is corrupted (e.g. anti-dumping protection)
- Display COM error code when the debugger fails to start.
- Made the timeout for CoreCLR debugger initialization configurable.
- Display the HRESULT when attaching the CoreCLR debugger fails.
- Improve support for debugging of single file bundle files which do not contain the required debugging components by trying to load them from the locally installed .NET installations.
- Mono:
- Improved loading of obfuscated modules when debugging
- Fixed several issues related to the resolution of method definitions on newer debugger protocol versions
- Fixed an unhandled
AggregateException
when connecting to a Unity debuggee - Display the IP and port used to connect to the debuggee in the output window.
- Improve loading of metadata from in-memory modules.
- BAML decompiler:
- Fixed resolution of
PresentationFramework
when it was referenced using its special ID0xFFFF
. - Lazily resolve known XAML types, properties, and other members to increase performance.
- Improve extraction of BAML connection ID information to work without all dependency assemblies and in other edge cases.
- Fixed an issue that resulted in dnSpy introducing markup extensions in cases where they were not syntactically valid.
- Properly place markup extension arguments containing spaces in single quotes.
- Fix issues regarding incorrect or missing escaping from markup extensions.
- Fixed crashes caused by the UI’s WPF markup extension parser when it encountered invalid syntax.
- Fix a bug that caused XAML paths to lack a
Z
character at the end. - Improved support for markup extensions where their classes inherit from generic classes.
- Improved support for nested types within XAML markup extensions.
- Fixed resolution of
Dependency updates:
- Updated Rosyn compiler to 4.6.0
- Updated VS MEF to 17.6.17
- Updated Newtonsoft.Json to 13.0.3
- Updated Iced to 1.19.0
评论0