How to use the dotnet-reverse .NET reverse engineering skill

What the skill makes the agent do

Without the skill, an agent has general knowledge of reverse engineering. With it, the agent follows a fixed workflow for .NET targets: identify, detect the obfuscator, deobfuscate, analyse statically, debug at runtime, then patch if needed. The source describes six phases in that order.

The skill also tells the agent which tool to prefer and when to switch away. It names dnSpyEx and de4dot as the default tools, and it points native binaries (C, C++, Go, Rust, or anything without a CLR header) to other reverse-engineering skills instead.

• Confirm the file is managed .NET code before going further
• Deobfuscate with de4dot and keep the original sample for comparison
• Read logic in the IL view, since the C# view can lose or distort information
• Debug at runtime to see decrypted strings and configuration
• Patch with the IL editor where logic must change

Install the dotnet-reverse skill

The skill ships as a ZIP file downloaded from this page. You can install it in one of three ways, depending on how you use your agent.

For a personal setup, unzip the download into ~/.claude/skills/ so the dotnet-reverse folder sits inside that directory. For a single project, unzip it into the project's .claude/skills/ folder instead. In the Claude apps, you can upload the ZIP under Settings → Capabilities → Skills.

The skill is released under the MIT licence, as listed on this page.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Check what you need before you start

The skill works best on a Windows host with dnSpyEx and de4dot installed. The source says to install them from Chocolatey or the release downloads. On Linux or macOS, the source suggests ilspycmd together with a dotnet runtime, which covers batch and scripted decompilation but not the dnSpyEx GUI.

For first identification, the skill expects Detect It Easy (DIE) or the file command. The skill also has an optional dnSpy MCP server for letting the agent drive decompilation directly. The skill runs scripts and uses the network, so review it before enabling it on a machine that holds sensitive material.

• Windows host preferred: dnSpyEx and de4dot
• Linux or macOS alternative: ilspycmd and a dotnet runtime
• Identification: Detect It Easy (DIE) or file
• Optional: dnSpy MCP server for AI-driven decompilation

How to trigger the skill with natural requests

You do not need to type a special command. Describe the task in plain words that name the target or the tool. The source lists these as phrases that route to the skill: .NET or C# binary reverse engineering, C# decompilation, dnSpy analysis, dnSpyEx patching, ConfuserEx, SmartAssembly or Babel deobfuscation, analysis of Sharp* tools such as Rubeus or SharpShell, .NET malware, loader or info-stealer reverse engineering, and C# patching or keygen work.

The metadata for this skill marks it as not user-invocable. In practice, that means you trigger it through the task description rather than by calling it by name.

• Good: 'Deobfuscate this ConfuserEx-protected C# loader and show me the config decryption logic.'
• Good: 'Analyse Rubeus.exe and tell me where the Kerberoasting code lives.'
• Good: 'This is a .NET info-stealer. Find where it decrypts its C2 address.'
• Less useful: 'Reverse this Go binary.' (native, so the skill routes elsewhere)

A typical workflow with the commands

The agent will usually run these steps itself. Knowing them helps you check its work. First confirm the file is managed .NET, then check for obfuscation, then deobfuscate into a new file so the original stays intact.

The source says the deobfuscated output is named target-clean.exe and that the original should be kept for comparison. When de4dot cannot detect the protector automatically, the source shows how to pass a type explicitly, for example cfze for ConfuserEx or sa for SmartAssembly.

• Identify the file type first, then look for the CLR header and the mscoree or _CorExeMain import
• Use DIE for a quick protector check
• Run de4dot to produce a clean copy, then open that copy in dnSpyEx
• Read key decisions in the IL view, then debug to see decrypted values
• Save the patched module as a new file and compare it with the original

Safety notes: scripts, network and scope

The skill runs scripts and uses the network. Its allowed tools include Bash, Read, Write, Edit, Glob, Grep, Task, WebFetch and WebSearch. Run it in an isolated analysis environment, such as a virtual machine, when you are handling malware or red-team tools.

The skill is written for analysing software you own, are auditing, or have permission to inspect. Its own scope says it covers patches, keygens and anti-tamper bypasses, so treat those capabilities carefully. Do not use it to crack licensing or change software you are not allowed to modify.

• Work in a disposable VM or sandbox when touching malware samples
• Keep original samples untouched and work on copies
• Use the skill only on software you own or have permission to analyse
• Review the scripts and network calls before enabling the skill on sensitive machines

Tips for better results

Give the agent the file path and say what you are trying to learn, such as where a password check happens or how a config is decrypted. Specific questions produce narrower, more useful work than a request to 'analyse this'.

When the C# view looks wrong or garbled, ask the agent to check the IL view. The source explains that compiler-generated code such as async methods, state machines and yield blocks often decompiles poorly to C#, while the IL view stays accurate. If the agent is set up with the dnSpy MCP server, it can use the decompile and IL inspection tools directly instead of you switching between windows.

• Name the target file and the goal in one sentence
• Ask for IL-level checks on critical logic
• Ask the agent to save outputs such as clean samples, extracted configs and patch diffs to disk
• Ask for a list of next-step options at the end of each phase