How do I install the Dotnet Decompiler skill?

Run npx skillmds@latest add ptn1411/dotnet-decompiler in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Dotnet Decompiler safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Dotnet Decompiler?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Dotnet Decompiler free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Dotnet Decompiler?

ptn1411 (@ptn1411) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Dotnet Decompiler by ptn1411 — Agent Skill

Name: Dotnet Decompiler
Author: ptn1411

Dotnet Decompiler

Automated .NET/C# decompilation and security analysis. Uses ilspycmd for batch decompilation with manual IL fallback. Detects obfuscators (ConfuserEx, .NET Reactor, Babel) and scans for license logic, API keys, and protection patterns.

ptn1411 6760772 4 files · 23.3 KB Updated Sep 17, 2026

File contents

.NET Decompiler & Analyzer

Decompile .NET assemblies to C# source and analyze for license logic, secrets, and protection patterns.

Language rule: All skill instructions use English. Final summary presented to the user must be in Vietnamese.

0. Authorization & Routing

Operates under MASTER_POLICY.md §1-§2.

Sibling skill	When
binary-identifier	Upstream — confirms target is .NET
binary-patcher	Downstream — patch license checks
symbolic-execution-tools	Solve license constraints symbolically
frida-hooker	Dynamic bypass via CLR hooking

How .NET Works

source.cs → C# compiler → IL bytecode (.dll/.exe with CLI header)
                              ↓
              Metadata tables (types, methods, fields, strings)
              IL method bodies (CIL instructions)
              Resources (embedded files, configs, Costura.Fody merged DLLs)

.NET decompilation is high-fidelity — IL bytecode retains most source structure (names, types, control flow). Obfuscators try to break this by renaming, encrypting strings, flattening control flow.

Step 1 — Detect .NET and Obfuscator

python scripts/decompile_dotnet.py --detect-only target.exe

python scripts\decompile_dotnet.py --detect-only target.exe

Checks: mscoree.dll import, CLI header, BSJB metadata signature, obfuscator markers.

Step 2 — Decompile

python scripts/decompile_dotnet.py target.exe --out decompiled/

python scripts\decompile_dotnet.py target.exe --out decompiled\

Decompiler priority:

ilspycmd (ILSpy CLI) — install: dotnet tool install -g ilspycmd
Manual IL metadata extraction (built-in, no deps)

Step 3 — Analyze

python scripts/analyze_dotnet.py decompiled/ --out analysis/

Scans for:

License validation (LicenseManager, TrialCheck, ExpiryDate, HWID)
API keys and connection strings
Obfuscation artifacts (unprintable names, delegate CF, resource decryptors)
Costura.Fody merged assemblies

Workflow

1. DETECT    → decompile_dotnet.py --detect-only → .NET version + obfuscator
2. DECOMPILE → decompile_dotnet.py → C# source
3. ANALYZE   → analyze_dotnet.py → license logic + secrets + protection map
4. REPORT    → Present findings IN VIETNAMESE

Final Report to User (always in Vietnamese)

🔷 Decompile .NET hoàn tất:

  🏗️ Framework     : .NET <VERSION>
  🛡️ Obfuscator    : <DETECTED or None>
  📁 Files decompile: <COUNT> types
  🔑 License logic  : <FOUND/NOT FOUND>

  🔍 Phát hiện:
    - <license methods, API keys, protection patterns>

  💾 Output: decompiled/

  ▶ Bước tiếp theo:
    - binary-patcher: patch license check
    - frida-hooker: hook CLR methods runtime

Anti-Patterns

❌ Don't	✅ Do
Assume all .NET apps are unprotected	Check for obfuscator first
Skip resource extraction	Costura.Fody hides DLLs as resources
Use only GUI tools (dnSpy)	ilspycmd automates batch decompilation
Ignore string encryption	ConfuserEx encrypts strings — look for decryptor methods
Present findings in English	Final summary in Vietnamese

---name: dotnet-decompilerdescription: Automated .NET/C# decompilation and security analysis. Uses ilspycmd for batch decompilation with manual IL fallback. Detects obfuscators (ConfuserEx, .NET Reactor, Babel) and scans for license logic, API keys, and protection patterns.---# .NET Decompiler & Analyzer> Decompile .NET assemblies to C# source and analyze for license logic, secrets, and protection patterns.> **Language rule**: All skill instructions use English.> **Final summary presented to the user must be in Vietnamese.**---## 0. Authorization & RoutingOperates under [MASTER_POLICY.md](../MASTER_POLICY.md) §1-§2.| Sibling skill | When ||---|---|| [binary-identifier](../binary-identifier/SKILL.md) | Upstream — confirms target is .NET || [binary-patcher](../binary-patcher/SKILL.md) | Downstream — patch license checks || [symbolic-execution-tools](../symbolic-execution-tools/SKILL.md) | Solve license constraints symbolically || [frida-hooker](../frida-hooker/SKILL.md) | Dynamic bypass via CLR hooking |---## How .NET Works```source.cs → C# compiler → IL bytecode (.dll/.exe with CLI header) ↓ Metadata tables (types, methods, fields, strings) IL method bodies (CIL instructions) Resources (embedded files, configs, Costura.Fody merged DLLs)```**.NET decompilation is high-fidelity** — IL bytecode retains most source structure (names, types, control flow). Obfuscators try to break this by renaming, encrypting strings, flattening control flow.---## Step 1 — Detect .NET and Obfuscator```bashpython scripts/decompile_dotnet.py --detect-only target.exe``````powershellpython scripts\decompile_dotnet.py --detect-only target.exe```Checks: `mscoree.dll` import, CLI header, `BSJB` metadata signature, obfuscator markers.---## Step 2 — Decompile```bashpython scripts/decompile_dotnet.py target.exe --out decompiled/``````powershellpython scripts\decompile_dotnet.py target.exe --out decompiled\```**Decompiler priority:**1. `ilspycmd` (ILSpy CLI) — install: `dotnet tool install -g ilspycmd`2. Manual IL metadata extraction (built-in, no deps)---## Step 3 — Analyze```bashpython scripts/analyze_dotnet.py decompiled/ --out analysis/```Scans for:- License validation (LicenseManager, TrialCheck, ExpiryDate, HWID)- API keys and connection strings- Obfuscation artifacts (unprintable names, delegate CF, resource decryptors)- Costura.Fody merged assemblies---## Workflow```1. DETECT → decompile_dotnet.py --detect-only → .NET version + obfuscator2. DECOMPILE → decompile_dotnet.py → C# source3. ANALYZE → analyze_dotnet.py → license logic + secrets + protection map4. REPORT → Present findings IN VIETNAMESE```---## Final Report to User (always in Vietnamese)```🔷 Decompile .NET hoàn tất: 🏗️ Framework : .NET <VERSION> 🛡️ Obfuscator : <DETECTED or None> 📁 Files decompile: <COUNT> types 🔑 License logic : <FOUND/NOT FOUND> 🔍 Phát hiện: - <license methods, API keys, protection patterns> 💾 Output: decompiled/ ▶ Bước tiếp theo: - binary-patcher: patch license check - frida-hooker: hook CLR methods runtime```---## Anti-Patterns| ❌ Don't | ✅ Do ||----------|-------|| Assume all .NET apps are unprotected | Check for obfuscator first || Skip resource extraction | Costura.Fody hides DLLs as resources || Use only GUI tools (dnSpy) | ilspycmd automates batch decompilation || Ignore string encryption | ConfuserEx encrypts strings — look for decryptor methods || Present findings in English | Final summary in Vietnamese |

Frequently asked questions