.NET Analysis Tools
- dnSpy / dnSpyEx: decompiler and debugger. Read C#, set breakpoints, step through IL, edit-and-continue. dnSpyEx is the maintained community fork.
- ILSpy: clean, fast open-source decompiler (view only). Great for quick triage.
- de4dot: automated deobfuscator — undoes ConfuserEx, .NET Reactor, SmartAssembly and similar; renames, decrypts strings, removes junk.
- dotPeek (JetBrains): another solid decompiler.
Key Takeaway
With dnSpy you can often read managed malware like source code — and debug the in-memory loader as it decrypts the next stage.