Warm tip: This article is reproduced from stackoverflow.com, please click
.net-core obfuscation decompiling ilspy

Can .Net Core 3 self-contained single executable be decompiled?

发布于 2020-04-11 22:30:48

I tried using Dotpeek and ILSpy.Net to decompile (my own code), they failed.

Do I need special obfuscation on distributed binaries of .Net Core 3 self-contained single executable ?

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>netcoreapp3.0</TargetFramework>
    <PublishTrimmed>true</PublishTrimmed>
    <PublishReadyToRun>true</PublishReadyToRun>
    <PublishSingleFile>true</PublishSingleFile>
    <RuntimeIdentifier>win-x64</RuntimeIdentifier>
  </PropertyGroup>
</Project>
Questioner
Abhijeet
Viewed
70
Eren Ersönmez 2020-02-27 18:54

The single-file exe is really an unmanaged wrapper and ILSpy doesn't support decompiling this. But when you run the exe, it unwraps its contents to a temp folder. So you can find the managed dll there and decompile it using ILSpy.

To find the temp folder, you can use any tool that shows locations of assemblies loaded by a process. SysInternals Process Monitor (procmon) is a good one.

You can setup procmon to filter by your exe name, and when you launch your exe, procmon should show some events for assemblies being loaded from a temp folder:

screenshot

You can browse to that folder and find your managed dll there. And you can decompile using ILSpy from that location.

I wrote a blog entry: https://eersonmez.blogspot.com/2020/02/ilspy-decompiling-net-core-self.html