.NET / C# assembly reversing

When it applies

The binary is a managed .NET assembly — a thick client, a Sharp* red-team tool, or a captured loader/stealer — and it is in scope (tradecraft-scope-roe, scope.txt). Pure-native PEs, IL2CPP Unity builds, and NativeAOT output carry no CLR metadata: those go to reverse-eng-binary-triage. dnSpyEx (the only GUI with an IL editor and debugger) is Windows-only; on Linux/macOS use ilspycmd + dotnet de4dot.dll and accept that interactive patching/debugging needs Windows.

Why it works

Managed assemblies keep near-complete metadata — type, method, and field names survive compilation, so decompilation recovers close-to-source C#. Obfuscators only scramble names, strings, and control flow, and de4dot automates the unscrambling for the common families. The IL instruction stream is the ground truth: the C# view loses or distorts compiler-generated code (async state machines, closures, yield), so decisive reads and every patch happen at IL level.

Method

Obfuscator identification table, de4dot options, anti-tamper bypasses, and IL patch recipes: see cheatsheet.md next to this file.