dnSpy
🧬 Reverse Engineering · C#
dnSpy is a debugger and .NET assembly editor that allows you to decompile, modify, and debug .NET assemblies even without source code. It includes a full-featured debugger that can debug .NET Framework, .NET Core, and Unity game assemblies, with support for breakpoints, stepping, locals, watch windows, and the immediate window. The decompiler produces readable C# or Visual Basic code from compiled assemblies, and the built-in editor allows direct modification of IL code, metadata, and resources. dnSpy is an essential tool for malware analysts examining .NET malware, reverse engineers working with Unity games, and security researchers analyzing compiled .NET applications. While the original repository is archived, several actively maintained forks continue development.
Installation
Download
$ Download latest release from GitHub releases pageChocolatey
$ choco install dnspyUse Cases
- Decompiling .NET malware to understand its behavior and extract IOCs
- Debugging .NET applications without source code using breakpoints and stepping
- Modifying compiled .NET assemblies to patch behavior or bypass protections
- Reverse engineering Unity game assemblies for security research
- Analyzing obfuscated .NET binaries by inspecting IL code and metadata
Tags
Details
- Category
- 🧬 Reverse Engineering
- Language
- C#
- Repository
- dnSpy/dnSpy
- Platforms
- 🪟windows
Links
Alternatives & Comparisons
Ghidra
JavaNSA's reverse engineering framework. Disassembly, decompilation, graphing, and scripting for binary analysis.
Compare dnSpy vs GhidraRadare2
CPortable reversing framework. Disassembly, debugging, analysis, patching, and scripting in a single CLI.
Compare dnSpy vs Radare2Cutter
C++GUI for Radare2. Makes reverse engineering accessible with graphs, decompiler, and hex editor built in.
Compare dnSpy vs CutterILSpy
C#Open-source .NET decompiler and assembly browser. Produces clean C# from compiled binaries with cross-platform support.
Compare dnSpy vs ILSpyx64dbg
C++Open-source x64/x32 debugger for Windows. Full-featured binary debugger with plugin ecosystem for malware analysis and reverse engineering.
Compare dnSpy vs x64dbgDetect It Easy
C++/QtBinary packer and compiler detection. Identifies compilers, linkers, packers, and protectors used to build PE, ELF, and Mach-O files.
Compare dnSpy vs Detect It Easyangr
PythonBinary analysis framework. Symbolic execution, CFG recovery, and vulnerability discovery for compiled binaries in Python.
Compare dnSpy vs angrRetDec
C++Retargetable decompiler by Avast. Converts machine code back to C from x86, ARM, MIPS, and PowerPC binaries.
Compare dnSpy vs RetDecRizin
CReverse engineering framework forked from radare2. Modernized API, improved UX, with Cutter as its official GUI.
Compare dnSpy vs RizinMore in Reverse Engineering
ILSpy
C#Open-source .NET decompiler and assembly browser. Produces clean C# from compiled binaries with cross-platform support.
x64dbg
C++Open-source x64/x32 debugger for Windows. Full-featured binary debugger with plugin ecosystem for malware analysis and reverse engineering.
Detect It Easy
C++/QtBinary packer and compiler detection. Identifies compilers, linkers, packers, and protectors used to build PE, ELF, and Mach-O files.
angr
PythonBinary analysis framework. Symbolic execution, CFG recovery, and vulnerability discovery for compiled binaries in Python.
RetDec
C++Retargetable decompiler by Avast. Converts machine code back to C from x86, ARM, MIPS, and PowerPC binaries.
Rizin
CReverse engineering framework forked from radare2. Modernized API, improved UX, with Cutter as its official GUI.