Thanks for the pointer to dnSpy. I'd been using Lutz's .NET Reflector, but since Red Gate took it over, and despite even paying for the Pro license (I needed to be able to debug and step through assemblies that I didn't have the source for, and there was nothing similar at the time), it's become a total pain in the arse to use. This looks like it'll comfortably replace it.
Re:Reverse Engineering Malware 101
by lowleveldesign on Thursday March 30, 2017 @02:32AM
(#13993379)
+1 for dnSpy. It's not only a decompiler, but also a debugger. Additionally, it has the best IL editor I've ever used. A parser for the native parts of the PE file (headers and sections) is a great feature too.
What do you think of dotPeek by JetBrains?
It's free-of-charge but not open-source.
It lacks many of the more advanced features like integrated debugging and deobfuscation and it isn't open source, so unless it happened to work better with a given executable I probably wouldn't use it.
Don't screw around with other .NET decompilers, use dnSpy.
https://github.com/0xd4d/dnSpy
It's fully open source, integrates with deobfuscators and includes a binary-level debugger which doesn't require VS separately. Plus it lets you patch assemblies and export debugged data easily which is how I extract most .NET-based packers these days.