This script is written in python and is used to quickly parse a .NET assembly to read its methods and instructions. It's just a quick way to parse and decompile raw bytecode to IL and read the instructions, instead of loading it to a decompiler like DnSpy, ILSpy etc.
It was just an exercise I did for myself and thought it would be a good tool for anyone looking to parse .NET code this way. So enjoy:D
Running the tool provides this output, which we can compare with the gui output of DnSpy:
Also, the script outputs the instructions of each non empty static method to the corresponding file for further analysis:
└─$ cat Main_instructions.txt System.Void qCaVAPJGIk.OItkKtykOO::Main(System.String[]) INSTRUCTIONS IL_0000: ldstr "kernel32.dll" IL_0005: call System.IntPtr qCaVAPJGIk.OItkKtykOO::LoadLibrary(System.String) IL_000A: stloc.0 IL_000B: ldloc.0 IL_000C: call System.Text.Encoding System.Text.Encoding::get_UTF8() IL_0011: ldstr "7Nlzeiulaok36CkiA7cg1PZCx7oWzwew3998xAF7DZY=" IL_0016: call System.Byte[] System.Convert::FromBase64String(System.String) IL_001B: ldstr "8AOx7b0fGddReqjf+6WzB7n6yOJGvgsGZXvpBa9764w=" IL_0020: call System.Byte[] System.Convert::FromBase64String(System.String) IL_0025: ldstr "T1D5QuS4MCdJRbPrcYCB/Q==" IL_002A: call System.Byte[] System.Convert::FromBase64String(System.String) IL_002F: call System.Byte[] qCaVAPJGIk.OItkKtykOO::GtsGqcLyiX(System.Byte[],System.Byte[],System.Byte[]) IL_0034: callvirt System.String System.Text.Encoding::GetString(System.Byte[]) IL_0039: call System.IntPtr qCaVAPJGIk.OItkKtykOO::GetProcAddress(System.IntPtr,System.String) IL_003E: stloc.1 IL_003F: ldloc.0 IL_0040: call System.Text.Encoding System.Text.Encoding::get_UTF8() IL_0045: ldstr "6EcApKsMBv3vWB/3DjNzSZqGNNgYdHg9di7QBebhuwQ=" -- more --
- pythonnet
- ironpython
- dnlib.dll (you can find it this in my Jlaive-Deobfuscator repo)