dnSpy

dnSpy Cheatsheet

What It Is

.NET debugger and assembly editor. Decompiles .NET binaries to readable C# code.

Quick Start

1. Open dnSpy
2. File → Open → Select .NET executable/DLL
3. Browse the assembly tree in the left panel
4. Click methods to see decompiled C# code

Key Features

• Decompilation: Full C# source reconstruction
• Debugging: Set breakpoints and step through
• Editing: Modify IL code and save
• Search: Find strings, methods, types across assemblies

Analysis Workflow

1. Open sample → expand assembly tree
2. Find entry point (usually Main method)
3. Look for configuration class (C2 address, encryption key)
4. Search for suspicious namespace/class names
5. Check for obfuscation (Confuser, .NET Reactor)

Shortcuts

• Ctrl+Shift+K – Search assemblies
• F5 – Start debugging
• F9 – Toggle breakpoint
• F11 – Step into
• F10 – Step over