TransWikia.com

Modify code with ILSpy

Reverse Engineering Asked by sivlab on July 24, 2021

I want to modify an exe a little bit.

With ILSpy I see all the code that I need but I don’t know how to modify the code.

I tried “save code” on ILSpy that exports a .cs file, but when I open the .cs file in Visual Studio and change the code I can’t compile or run the modified code.

Is there a way to do that?

P.S.
I read that I can change the code in assembly but I don’t know assembly so I have to do that at high level, if there is a way.

4 Answers

Currently, there's no way to modify the binary directly with ILSpy. The only solution is the one you described, export the source and recompile it.

However, the feature you are looking for is included with .NET Reflector in the Reflexil plugin.

Answered by Spl3en on July 24, 2021

You may work according to the following pattern:

  • Save code in ILSpy (or in Reflector) as .cs files (as you already described)
  • Try to create a Visual Studio project from that code

  • Make all modifications in Visual Studio.

  • If VS compiles the code, it should open as well in ILSpy and/or Reflector.

  • If it doesn't it is most probably not complete and/or not correct. In that case you might simplify the code until you get something compilable, to identify the "missing links".

  • In this way I have been able to recompile also more complicated
    software. First do everything statically, until you have something
    where code is created in VS. Then test it and expand it.

Code parts which do not recompile in ILSpy or Reflector (each has its own strengths and weaknesses) can be exported in IL and perhaps manually rearranged to recompile in the tools, then further processed in Visual Studio. Unfortunately, VS does not allow for inline IL assembled code.

For instance, Reflector protects itself (among other means like obfuscation) against recompilation with useless jumps confusing the recompiler. ILSpy mostly is able to cope with this.

ILSpy for instance is not able to recompile subclasses (i.e. classes within a class). They just not show up in the class tree, when in C# view. In IL view, you see all of them.

Answered by josh on July 24, 2021

I used piece of software a few years ago that allowed limited editing of the generated code directly within the tool itself, but when I say 'limited', I really mean limited. In fact, this feature was actually removed from more recent releases of this software. The old version that had this feature is no longer available, but it's still a decent and free .NET decompiler so if you want to check it out, it's called DotNet Resolver.

There's also the Reflexil plugin for Reflector, which has already been mentioned, but it's also pretty unreliable and limited.

If you really want to get things done, however, I'd recommend using the ILDASM and ILASM tools which are installed with Visual Studio.

I know you want to be able to just edit the high level code, but that's just not very feasible. You can use Reflector to export the source code generated from a disassembled .NET application as a project, but then you have errors, missing dependencies, and the like to deal with.

With ILDASM and ILASM you would be editing the MSIL directly, but it's really the best way to go about modifying a .NET application. MSIL is actually pretty simple and you won't have to deal with the source code produced by tools like Reflector, which are often riddled with errors. Moreover, you generally won't have to worry about obfuscation. In 99% of cases you will always be able to disassemble .NET applications down to MSIL and then reassemble them without any issue.

There are plenty of resources online to aid you with both editing and understanding MSIL if you're not familiar with it. Good luck!

Answered by Radical Raccoon on July 24, 2021

For reference to those still looking for an answer to this question, I would recommend trying dnSpy - it allows you to do exactly what the requester asked - modify the high level code and recompile.

It isn't perfect, but I've been able to make small changes to the in-house exe's we have where we didn't have the latest source code (disgruntled employees, don't ask).

https://github.com/dnSpy/dnSpy

Answered by Raithlin on July 24, 2021

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP