1

I'm have some .NET exes built with the single file option (https://learn.microsoft.com/en-us/dotnet/core/deploying/single-file) and I need to use a disassembler on them, but none of the disassembly tools (e.g. dnspy, ilspy, ildasm, etc.) work since these are actually native binaries with .NET assembly embedded in them, as explained in the Microsoft docs.

E.g., trying ildasm on these binaries outputs error: 'example.exe' has no valid CLR header and cannot be disassembled

How can I extract the .NET dlls from these single file exes so that I can disassemble them? Or is there any other way to disassemble these .NET single file exes?

philipsal
  • 21
  • 1
  • 4
  • Does this answer your question? [How to run ildasm on .Net core exe/assembly?](https://stackoverflow.com/questions/59818364/how-to-run-ildasm-on-net-core-exe-assembly) – Leandro Bardelli Nov 15 '21 at 21:22
  • No, so that explains that you need the dll to do disassembly. But in my case I don't have access to the dll, only the exe. So there must be some way to extract the embedded dll in this case, not sure how to do this – philipsal Nov 15 '21 at 21:26
  • If it has not changed, single file executable are unpacked to a temp directory and executed from there. I would try using task-manager to lookup the executing directory for the process. Or some tool like process-explorer for more detailed info. – JonasH Nov 15 '21 at 21:38
  • @JonasH Yes this might work for .NET 3.1 but starting with 5.0 `the managed DLLs are extracted and loaded in memory, avoiding the extraction to a folder.` as stated in the docs. So that wouldn't work with .NET 5.0 and later – philipsal Nov 15 '21 at 22:05
  • I think there would be some way to extract the embedded dll from the PE file using something like the `pefile` python library. But I'm not sure where exactly to find it in the PE – philipsal Nov 15 '21 at 22:10
  • might want to look at this question, one of the poster seem to have made a tool: https://stackoverflow.com/questions/60026667/can-net-core-3-self-contained-single-executable-be-decompiled – JonasH Nov 15 '21 at 22:40
  • @JonasH Thank you for sharing this. The [sfextract](https://www.nuget.org/packages/sfextract/) tool is exactly what I needed – philipsal Nov 15 '21 at 22:56
  • @phiilii [ILSpy 7.2 Preview 2](https://github.com/icsharpcode/ILSpy/releases/tag/v7.2-preview2) should include [this feature](https://github.com/icsharpcode/ILSpy/pull/2499) too – kapsiR Nov 16 '21 at 13:51

1 Answers1

6

ILSpy 7.0 supports .NET 5 single-file bundles.

ILSpy 7.1 adds support for .NET 6 bundles (added compression support).

ILSpy 7.2 also allows saving the embedded .dlls ("Extract package entry" in context menu).

If you're looking for a command-line tool, see https://www.nuget.org/packages/sfextract/

Daniel
  • 15,944
  • 2
  • 54
  • 60
  • Also note to make sure "View->Show All Types" is enabled in ILSpy. I didn't have this enabled previously, so mistakenly thought ILSpy was missing some things in its decompilation – philipsal Nov 16 '21 at 18:36