Patrick Galbraith

Web developer - Adelaide, Australia

Living in a closed source world

Decompiling C# using dnSpy .NET debugger and assembly editor

Recently I was working on a project where I had to work with a C# library with limited to no code level documentation. Essentially what I had to work with was something like this:

/// <summary>
/// Factory for creating ObjectInfo objects for ObjectInfoProvider.
/// </summary>
public class ObjectInfoFactory { ... }

Factory for creating ObjectInfo objects for ObjectInfoProvider.” difficult to say what that means since it could be interpreted different ways. But wouldn’t it be great if we could see what the code does. Maybe we could even search the codebase and see how it is being used in other parts of the library.

Read the source Luke…

In my opinion one of the most beneficial things you can do is read the source code. Documentation is hard and there are many times I have worked with libraries where the documentation and examples are not up-to-date. Not to mention subtle unexpected behaviors that occur when working with other people’s code.

Reading source code has served me well over the years and as a result I have made a number of humble contributions to open source projects and had fun reading the code for projects like Chromium (Chrome Browser), Samba (SMB/CIFS), FFMPEG, and so on. I find that different ecosystems tend to come with an associated culture. Working more closely with Microsoft .NET recently I have found a bit of a new roadblock… the source code is not always readily available.

I tried to picture clusters of information as they moved through the computer. What did they look like? Ships, motorcycles. With the circuits like freeways. I kept dreaming of a world I thought I’d never see. And then one day, I got in.
Kevin Flynn – Tron Legacy

DnSpy (https://github.com/0xd4d/dnSpy) is a debugger and .NET assembly editor. You can use it to edit and debug assemblies even if you don’t have any source code available. Below I have an example of what it looks like viewing a dll from the DotNetNuke project.

dnspy-dnn

That project (DotNetNuke) is open source so we don’t necessarily need to decompile it but it’s just an example. This is a tool I have used extensively in the last few months and has made working with closed source legacy code a lot less painful.

It is also possible to use dnSpy to patch dll’s. There are two main ways to do this you can edit the decompiled C# source code. However doing so will require recompilation and I have found that this seldom works. The other option is to edit the IL code of a method or property. This is a much better way as long as you don’t mind rolling up your sleeves and reading through the CIL instructions. Honestly it’s not that hard, at least it’s easier than using a hex editor.

dnspy-ilcode

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>