cincan/ilspy repository overview

⁠ILSpy (console only) - version 7.1.0

A Dotnet assembly decompiler and portable PDB generator.

Reference to PDB.⁠

⁠Supported tags and respective Dockerfile links

• latest (ilspy/Dockerfile⁠)

⁠Input

.NET Assembly

⁠Output

Decompiled source code in C#, PDB or Visual Studio Project

⁠Usage

⁠Installation

Method 1. Clone the repository and build by yourself

git clone https://gitlab.com/CinCan/tools
cd tools/ilspy
docker build . -t cincan/ilspy

Method 2. Pull the docker image

docker pull cincan/ilspy

Method 3. use 'cincan'⁠ tool

Follow 'cincan' tool installation steps. If this tool is used, no need to install 'ILSpy' separately.

⁠Running

Method 1. Run the docker container

Analyse a sample in directory "/samples":

$ docker run -v /samples:/samples cincan/ilspy /samples/ilspy_sample.exe

Or get possible arguments for the program:

$ docker run -v /samples:/samples cincan/ilspy --help

Method 2. Run with 'cincan' tool:

Analyse a provided example sample from this directory:

$ cincan run cincan/ilspy samples/ilspy_sample.exe

Get help for specifically this tool:

$ cincan run cincan/ilspy --help

⁠Testing

Few tests are included for testing the functionality of container. These contains at least:

• Decompile without options
• Decompile only PDB file
• Decompile as Visual Studio Project

Tox can be used for testing this tool (run from root of this repository):

pip install tox
tox ilspy

⁠Sample file

Sample file was created for CriM-2019 workshop (Compiled binary C# .NET Assembly). It contains simple dropper for malicous binary from remote URL.

⁠Project homepage

https://github.com/icsharpcode/ILSpy⁠

⁠NuGet repository of console-only:

https://www.nuget.org/packages/ilspycmd/⁠

⁠Licence

Distributed under same terms (MIT Licence) than ILSpy itself.