--- title: "ilspy-decompile by davidfowl · skilld" canonical_url: "https://skilld.dev/gh/davidfowl/dotnet-skillz" meta: description: "Understand implementation details of .NET code by decompiling assemblies. Use when the user wants to see how a .NET API works internally, inspect NuGet package source,… From davidfowl/dotnet-skillz." "og:description": "Understand implementation details of .NET code by decompiling assemblies. Use when the user wants to see how a .NET API works internally, inspect NuGet package source,… From davidfowl/dotnet-skillz." "og:title": "ilspy-decompile by davidfowl" "twitter:description": "Understand implementation details of .NET code by decompiling assemblies. Use when the user wants to see how a .NET API works internally, inspect NuGet package source,… From davidfowl/dotnet-skillz." "twitter:title": "ilspy-decompile by davidfowl" --- ` [All skills](https://skilld.dev/skills) [![davidfowl avatar](https://skilld.dev/_img/avatar?url=https%3A%2F%2Fgithub.com%2Fdavidfowl.png%3Fsize%3D96)](https://skilld.dev/gh/davidfowl) # **/ilspy-decompile** [@0cc5023](https://github.com/davidfowl/dotnet-skillz/commit/0cc50237837b172a8cafff825e4c6471bb0a034a "Your agent reads SKILL.md at commit 0cc5023") by [David Fowler](https://skilld.dev/gh/davidfowl)· [davidfowl](https://skilld.dev/gh/davidfowl)/ [dotnet-skillz](https://skilld.dev/gh/davidfowl/dotnet-skillz)·294 stars 14 Understand implementation details of .NET code by decompiling assemblies. Use when the user wants to see how a .NET API works internally, inspect NuGet package source, view framework implementation, or understand compiled .NET binaries. - 1 file - 5.1 KB - Updated 8 months ago - [GitHub](https://github.com/davidfowl/dotnet-skillz/blob/main/skills/ilspy-decompile/SKILL.md "View SKILL.md on GitHub") - [1 warning](#third-party-checks "Third-party checks: 1 warning · 4 checks · Risk SAFE") ## SKILL.md 5.1 KB **≈63** tokens always: the name and description. **≈1.2k** when used: this file. ## .NET Assembly Decompilation with ILSpy Use this skill to understand how .NET code works internally by decompiling compiled assemblies. ### Quick start ``` # Decompile an assembly to stdout (no install needed with .NET 10+) dnx ilspycmd MyLibrary.dll # Decompile to an output folder dnx ilspycmd -o output-folder MyLibrary.dll ``` ### Common .NET Assembly Locations #### NuGet Packages ``` # Windows ~/.nuget/packages///lib// # Example: Newtonsoft.Json ~/.nuget/packages/newtonsoft.json/13.0.3/lib/netstandard2.0/Newtonsoft.Json.dll # Example: Microsoft.Extensions.DependencyInjection ~/.nuget/packages/microsoft.extensions.dependencyinjection/8.0.0/lib/net8.0/Microsoft.Extensions.DependencyInjection.dll ``` #### .NET Runtime Libraries ``` # Find .NET install location dotnet --list-runtimes # Windows typical paths C:/Program Files/dotnet/shared/Microsoft.NETCore.App// C:/Program Files/dotnet/shared/Microsoft.AspNetCore.App// # Linux/macOS typical paths /usr/share/dotnet/shared/Microsoft.NETCore.App// /usr/share/dotnet/shared/Microsoft.AspNetCore.App// # Example: System.Text.Json from runtime C:/Program Files/dotnet/shared/Microsoft.NETCore.App/8.0.0/System.Text.Json.dll ``` #### .NET SDK Reference Assemblies ``` # Find SDK location dotnet --list-sdks # Reference assemblies (design-time facades) C:/Program Files/dotnet/packs/Microsoft.NETCore.App.Ref//ref/net8.0/ ``` #### Project Build Output ``` # Debug build ./bin/Debug/net8.0/.dll # Published output ./bin/Release/net8.0/publish/.dll ``` ### Core workflow 1. Identify what you want to understand (API, class, method) 2. Locate the assembly containing that code 3. Use `dnx ilspycmd -l class` to find the exact type name 4. Decompile the specific type with `-t` ### Commands #### Basic Decompilation ``` # Decompile to stdout dnx ilspycmd MyLibrary.dll # Decompile to output directory dnx ilspycmd -o ./decompiled MyLibrary.dll # Decompile as compilable project dnx ilspycmd -p -o ./project MyLibrary.dll # Decompile with nested namespace folders dnx ilspycmd -p -o ./project --nested-directories MyLibrary.dll ``` #### Targeted Decompilation ``` # Decompile a specific type dnx ilspycmd -t Namespace.ClassName MyLibrary.dll # Decompile with specific C# version dnx ilspycmd -lv CSharp12_0 MyLibrary.dll # Decompile with reference path for dependencies dnx ilspycmd -r ./dependencies MyLibrary.dll ``` #### View IL Code ``` # Show IL code instead of C# dnx ilspycmd -il MyLibrary.dll # Show IL for specific type dnx ilspycmd -il -t Namespace.ClassName MyLibrary.dll ``` #### List Types ``` # List all classes dnx ilspycmd -l class MyLibrary.dll # List interfaces dnx ilspycmd -l interface MyLibrary.dll # List structs dnx ilspycmd -l struct MyLibrary.dll # List enums dnx ilspycmd -l enum MyLibrary.dll # List delegates dnx ilspycmd -l delegate MyLibrary.dll ``` #### Options ``` # Show help dnx ilspycmd -h # Disable update check (useful for CI/automation) dnx ilspycmd --disable-updatecheck MyLibrary.dll # Remove dead code dnx ilspycmd --no-dead-code MyLibrary.dll ``` ### Example: Understand how JsonSerializer works ``` # Find System.Text.Json in the runtime dotnet --list-runtimes # Microsoft.NETCore.App 8.0.0 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] # List classes to find JsonSerializer dnx ilspycmd -l class "C:/Program Files/dotnet/shared/Microsoft.NETCore.App/8.0.0/System.Text.Json.dll" # Decompile JsonSerializer dnx ilspycmd -t System.Text.Json.JsonSerializer "C:/Program Files/dotnet/shared/Microsoft.NETCore.App/8.0.0/System.Text.Json.dll" ``` ### Example: Inspect a NuGet package implementation ``` # Decompile Polly's retry logic dnx ilspycmd -t Polly.Retry.RetryPolicy ~/.nuget/packages/polly/8.0.0/lib/netstandard2.0/Polly.dll # Decompile entire package to project for exploration dnx ilspycmd -p -o ./polly-src ~/.nuget/packages/polly/8.0.0/lib/netstandard2.0/Polly.dll ``` ### Example: See how ASP.NET Core handles requests ``` # Find the ASP.NET Core runtime # C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.0\ # Decompile the Kestrel server dnx ilspycmd -l class "C:/Program Files/dotnet/shared/Microsoft.AspNetCore.App/8.0.0/Microsoft.AspNetCore.Server.Kestrel.Core.dll" dnx ilspycmd -t Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer "C:/Program Files/dotnet/shared/Microsoft.AspNetCore.App/8.0.0/Microsoft.AspNetCore.Server.Kestrel.Core.dll" ``` ### Example: Compare C# and IL ``` # View C# source dnx ilspycmd -t MyNamespace.MyClass MyLibrary.dll # View IL code for same type dnx ilspycmd -il -t MyNamespace.MyClass MyLibrary.dll ``` ### C# Language Versions Available versions for `-lv` option: - CSharp1 through CSharp12\_0 - Latest, Preview Source: [SKILL.md on GitHub](https://github.com/davidfowl/dotnet-skillz/blob/main/skills/ilspy-decompile/SKILL.md) ## Third-party checks
1 warning1d4 checks · Risk SAFE - Gen Agent Trust Hub1d The skill enables decompilation of .NET assemblies using ILSpy via the dnx tool. It is intended for inspecting library implementations but introduces a surface for indirect prompt injection from potentially malicious binaries. - Socket1d No alerts - Snyk1d Risk: LOW · No issues - Runlayer7mo 1/1 file flagged
## Provenance [Signed by skilld at 0cc5023.](https://github.com/davidfowl/dotnet-skillz/commit/0cc50237837b172a8cafff825e4c6471bb0a034a "0cc50237837b172a8cafff825e4c6471bb0a034a") This ties the file your Agent reads to that commit on GitHub. It does not review the instructions. Last checked against GitHub 2 months ago. Dormantupdated 8 months ago ## Capability What it can do Runs commands
All 1 allowed tools Bash(dnx:\*)
## README badge ![README badge for davidfowl/dotnet-skillz](https://skilld.dev/b/davidfowl/dotnet-skillz?theme=light&label=0) ## Related skills - - - - - -