/dotnet

description: .NET assembly analysis — decompilation, deobfuscation, metadata extraction
allowed-tools: Bash, Read, Write, Glob, Grep, AskUserQuestion
argument-hint: <path-to-binary>

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

.NET Assembly Analysis

Parse `$ARGUMENTS` to get the binary path.

Step 1 — Verify .NET Binary

r2 -qc 'ii' <binary> | grep -i mscoree
file <binary> | grep -i "\.NET\|Mono\|CLR"

If not a .NET binary, inform the user and suggest `/analyze` instead.

Step 2 — Metadata Extraction

monodis --typedef <binary>             # Class/type listing
monodis --assembly <binary>            # Assembly metadata
monodis --typeref <binary>             # Referenced types

Step 3 — Obfuscation Detection

Look for signs of obfuscation:

• Garbled/non-readable class and method names
• Single-character namespaces
• Unusual control flow in IL code
• Known obfuscator watermarks:
• **ConfuserEx**: `ConfuserEx` in metadata or garbled names starting with `\u`
• **Dotfuscator**: `DotfuscatorAttribute`
• **.NET Reactor**: `.reacto` section or `__EncryptedAssembly__` resource
• **Babel**: `BabelAttribute`
• **Eazfuscator**: `EazAttribute`

Step 4 — Deobfuscation (if needed)

de4dot <binary> -o extracted/deobfuscated-<binary-name>

de4dot will auto-detect the obfuscator and apply appropriate cleaning.

Verify deobfuscation succeeded:

monodis --typedef extracted/deobfuscated-<binary-name>

Step 5 — Full Decompilation

Using ILSpy CLI (if available):

ilspycmd <binary> -o extracted/dotnet-<binary-name>/

Or using monodis for IL:

monodis --method <binary>

Step 6 — Extract Interesting Data

Look for:

• **Connection strings**: `Data Source=`, `Server=`, `mongodb://`
• **API endpoints**: `http://`, `https://`, `/api/`
• **Embedded resources**: Check `.rsrc` section
• **Hardcoded credentials**: `password`, `secret`, `key`, `token`
• **Encryption keys**: AES/RSA key material in code

Log findings:

node "${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js" add "<binary>" "<type>" "<value>" "<severity>" "<title>"

Step 7 — Report

Save decompiled source to `extracted/dotnet-<binary-name>/`. Generate analysis report including class hierarchy, suspicious methods, and findings.