Skip to content
Get packs

.NET Reverse Engineering

Guides reverse engineering of .NET/C# binaries: identify, deobfuscate with de4dot, analyze in dnSpyEx, patch IL.

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
4 files

What it does

When installed, the agent follows a structured workflow for analysing Windows .NET (C#) programs: confirming the file is managed .NET code, removing common obfuscators such as ConfuserEx or SmartAssembly with de4dot, reading the code in dnSpyEx (preferring the IL view), debugging it at runtime, and patching logic where needed. It also points to the right tools for red-team Sharp* utilities and for handing off native binaries to other reverse-engineering skills.

Great for

  • Security researchers analysing .NET malware, loaders or info-stealers
  • Students learning how .NET assemblies and obfuscators work
  • Developers auditing a compiled C# tool they own or have rights to inspect

Skip it if

  • Native C/C++, Go or Rust binaries, which the skill itself says to route to other reverse-engineering skills; the guidance would be off-target
  • Cracking, bypassing licensing or altering software you do not have permission to modify, since the skill explicitly covers patches, keygens and anti-tamper bypasses

Try asking

  • “Identify whether target.exe is a .NET assembly and, if obfuscated, produce a de4dot-cleaned copy”
  • “Walk me through analysing the string decryption and C2 config in this ConfuserEx-protected loader”
  • “Explain how to patch a comparison in this C# program's IL and save the module”
  • “Help me analyse the Rubeus or SharpHound binary I found during an authorised assessment”
Step-by-step guide: how to use .NET Reverse EngineeringInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 4 original files, the MIT licence and an attribution note.

    dotnet-reverse.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip dotnet-reverse.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip dotnet-reverse.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Always keep the original sample and work on the de4dot-cleaned copy, as the skill recommends, so results can be reproduced
  • Run analysis on an isolated VM when handling suspected malware, since dynamic debugging executes the sample
  • Confirm you are authorised to analyse or modify the target before patching or debugging it

What's inside

  • references/common-workflow.md
  • references/obfuscators.md
  • references/sharp-tools.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.