dotnet-reverse
.NET/C# binary reverse engineering: managed PE analysis, dnSpyEx debugging, de4dot deobfuscation (ConfuserEx/SmartAssembly/Babel), IL patching, NativeAOT targets, and analysis of red-team Sharp* tooling.
.NET / C# 逆向作业规范
When to Use
- Analyzing a .NET assembly, obfuscated C# product, or native-AOT binary.
- Understanding the internals of Sharp* red-team tools before use or defense.
适用范围
当任务属于以下场景时优先使用本 skill：
- 识别并逆向 .NET / C# 编译产物（托管 PE / .exe / .dll）
- 分析红队 Sharp* 工具链（Rubeus、SharpHound、SharpShell 等）
- 脱混淆 ConfuserEx / SmartAssembly / Babel / Eazfuscator / .NET Reactor 等壳
- 逆向 .NET loader / info-stealer / RAT 的解密与 C2 逻辑
- 对 C# 程序做 patch（改判断、改常量、keygen）
- 分析 IL2CPP 之前的 Mono/Unity 托管层（注意：IL2CPP 编译后是 native，走
reverse-engineering/+ seed-014）
如果目标是纯 native 二进制（C/C++/Go/Rust 编译、无 CLR），请改用 reverse-engineering/、ida-reverse/ 或 radare2/。
核心原则
- 先识别再下手：先确认是 .NET 托管程序（PE 头 CLR +
#~/#Strings流 + mscoree_CorExeMain），再决定走 dnSpy 而非 IDA - IL 优先于 C#：dnSpyEx 的 C# 反编译器会丢失/扭曲信息（编译器生成的状态机、async/await、yield），关键判断与 patch 必须切到 IL 编辑器，C# 视图只用于快速浏览
- de4dot 先行：遇到混淆器先
de4dot脱一轮再做静态分析，否则字符串/控制流全是乱的 - MCP 联动：环境里若注册了 dnSpy MCP（
dnspy_*工具），优先走 MCP 面做 decompile / IL inspection，避免来回切 GUI - 证据化输出：脱混淆产物、提取的配置/C2/key、patch diff 都要落盘
工具链映射
| 能力 | 首选 | 备注 |
|---|---|---|
| 反编译 + 调试 + patch | dnSpyEx | 王牌，唯一带 IL 编辑器的 GUI；老 dnSpy 已停更，用 Ex 分支 |
| 轻量 CLI / headless 反编译 | ILSpy (ilspycmd) | 适合批量、脚本化、Linux/macOS |
| 脱混淆 | de4dot | ConfuserEx 全家桶、SmartAssembly 等主流壳的默认解 |
| 混淆器识别 | Detect It Easy (DIE) / file | 先判断壳类型再决定 d |
Subscribers only
The full skill, its 4 bundled files and every download is included with every paid Complete AI plan.
Details
| Source | zhaoxuya520/reverse-skill |
|---|---|
| License | MIT |
| Risk label | safe ("critical" means the skill may run commands or touch files — read before use) |
| Files | SKILL.md, references/common-workflow.md, references/obfuscators.md, references/sharp-tools.md |
| Added | 2026-08-25 |
Related skills
accesslint-diff
Diff a live page's accessibility violations against a baseline — by default compares uncommitted changes (stash-based), or pass --branch [<name>] to diff against a branch. Reports only new violations introduced, violations fixed, and pre-existing count. Use `scan` for a full audit with no diffing.
accesslint-scan
Audit a live page for accessibility issues, locate each WCAG violation precisely, and return a selector-grounded fix worklist without editing.
accint-commitments
Triage acc's open promises and close them with honest real-world verdicts via acc_act(runtime="outcome").
accint-frames
Drain acc's deliberation queue — open/waiting brain_frames checkpointed by headless runs — via acc_act(runtime="continue").
accint-solve
Route a goal through acc's scored-memory loop via acc_act(runtime="solve"); deliberate any returned brain_frame and submit via continue.
ad-creative
Create, iterate, and scale paid ad creative for Google Ads, Meta, LinkedIn, TikTok, and similar platforms. Use when generating headlines, descriptions, primary text, or large sets of ad variations for testing and performance optimization.