ILSpy - .NET Decompiler Cheatsheet
ILSpy is the open-source .NET assembly browser and decompiler. It reverses the compilation process, converting Microsoft Intermediate Language (MSIL/CIL) back into readable, high-level C# (and other languages). It is the standard free tool for inspecting, analyzing, and reverse-engineering .NET binaries — from malware triage to debugging third-party libraries without source. It runs as a Windows GUI, a cross-platform Avalonia app, a VS Code extension, and the ilspycmd CLI.
Installation
| Variant | How |
|---|
| Windows GUI | Download the installer/zip from GitHub Releases |
| Cross-platform GUI | AvaloniaILSpy build (Linux/macOS) |
CLI (ilspycmd) | dotnet tool install --global ilspycmd |
| VS Code | Install the “ILSpy .NET Decompiler” extension |
| Verify CLI | ilspycmd --version |
GUI Essentials
| Action | How |
|---|
| Open assembly | File → Open, or drag a .dll/.exe in |
| Load dependencies | ILSpy resolves referenced assemblies automatically |
| Navigate | Expand the tree: assembly → namespace → type → member |
| Decompile a member | Click it; C# appears in the main pane |
| Analyze usages | Right-click → Analyze (who calls/uses this?) |
| Search | Ctrl+F / search box for types and members |
| Change language version | Toolbar dropdown (C# 1.0 … latest) |
| Save decompiled project | File → Save Code (export full .csproj) |
Analyze (Cross-References)
| Right-click → Analyze shows |
|---|
| Instantiated By |
| Used By |
| Assigned By / Read By (fields) |
| Overridden By / Overrides |
| Exposed By |
This is the core RE workflow: pick a suspicious method and trace who calls it and what it touches.
ilspycmd (Command Line)
| Command | Description |
|---|
ilspycmd Assembly.dll | Decompile the whole assembly to stdout |
ilspycmd -o out/ Assembly.dll | Decompile to a directory |
ilspycmd -p -o proj/ Assembly.dll | Export a compilable .csproj project |
ilspycmd -t Namespace.Type Assembly.dll | Decompile a single type |
ilspycmd -il Assembly.dll | Show raw IL instead of C# |
ilspycmd -lv CSharp10_0 Assembly.dll | Set the C# language version |
ilspycmd --nested-directories -p -o out/ A.dll | Mirror namespaces as folders |
ilspycmd -r LIBDIR Assembly.dll | Add an assembly reference search path |
| Target | How |
|---|
| Embedded resources | Tree → Resources node; extract via Save |
| Metadata tables | View → “Metadata” (raw tables, tokens) |
| Strings/IL | Switch the language dropdown to IL |
| PInvoke/native | Visible in method signatures |
Common Workflows
# Triage a suspicious .NET sample: full source dump for grepping
ilspycmd -o sample_src/ suspicious.dll
grep -rin "DownloadString\|FromBase64String\|Process.Start" sample_src/
# Recover a buildable project from a DLL you lost source for
ilspycmd -p -o recovered/ MyLib.dll
# Look at raw IL when the C# decompilation is obfuscated
ilspycmd -il obfuscated.dll | less
For heavily obfuscated assemblies, pair ILSpy with a deobfuscator (e.g. de4dot) first, then decompile the cleaned binary.
| Tool | Type | Notes |
|---|
| ILSpy | Decompiler + browser | Free, open-source, CLI + GUI |
| dnSpy / dnSpyEx | Decompiler + debugger | Edit & debug assemblies |
| dotPeek | Decompiler | Free (JetBrains), Windows |
| ILDASM | Disassembler | IL only, ships with .NET SDK |
Resources
