Package: dncil
dncilis a Common Intermediate Language (CIL) disassembly library written in Python that supports parsing the header, instructions, and exception handlers of.NETmanaged methods. Parsed data is exposed through an object-oriented API to help you quickly developCILanalysis tools usingdncil.WhyPython? Existing libraries that supportCILdisassembly, likednLib, are written inC#. To leverage these tools, you must buildC#applications which requiresC#development experience. Usingdncil, a purePythonalternative, you:Do not needC#experience to analyzeCILprogrammatically.Can quickly develop and test yourCILanalysis tools.Can easily integrate yourCILanalysis tools with existingPythonprojects.ExampleThe example scriptprint_cil_from_dn_file.pyusesdnciltogether with.NETanalysis librarydnfileto disassemble the managed methods found in a.NETexecutable. Let's see what it can do.First, we compile the followingC#source code:usingSystem;publicclassHelloWorld{publicstaticvoidMain(string[]args){Console.WriteLine("Hello World!");}}Compilation results in aPEexecutable containing.NETmetadata which informs theCommon Language Runtime(CLR) how to execute our code. We usednfileto parse this metadata which gives us the offset of our managed methodMain. We then usedncilto disassemble and display theCILinstructions stored at this location.Let's see the above in action:$ python scripts/print_cil_from_dn_file.py hello-world.exe 

Method: Main
0000    00                  nop            
0001    72 01 00 00 70      ldstr          "Hello World!"
0006    28 04 00 00 0a      call           System.Console::WriteLine
000B    00                  nop            
000C    2a                  retOur methodMainis represented by theCilMethodBodyclass. This class holds data that includes the header,CILinstructions, and exception handlers of a given managed method. It also exposes various helper functions:>main_method_body.flagsSmallFormat:falseTinyFormat:falseFatFormat:falseTinyFormat1:trueMoreSects:falseInitLocals:falseCompressedIL:false>main_method_body.size14>hexdump.hexdump(main_method_body.get_bytes())00000000:36007201000070280400000A002A6.r...p(.....*>hexdump.hexdump(main_method_body.get_header_bytes())00000000:366>hexdump.hexdump(main_method_body.get_instruction_bytes())00000000:007201000070280400000A002A.r...p(.....*EachCILinstruction found in our managed methodMainis represented by theInstructionclass. This class holds data that includes the offset, mnemonic, opcode, and operand of a givenCILinstruction. It also exposes various helper functions:>len(main_method_body.instructions)5>insn=main_method_body.instructions[1]>insn.offset1>insn.mnemonic'ldstr'>insn.operandtoken(0x70000001)>insn.is_ldstr()True>insn.size5>hexdump.hexdump(insn.get_bytes())00000000:7201000070r...p>hexdump.hexdump(insn.get_opcode_bytes())00000000:72r>hexdump.hexdump(insn.get_operand_bytes())00000000:01000070...pInstallingTo installdncilusepipto fetch thedncilmodule:$ pip install dncilTo execute the example scripts be sure to installdnfile. Alternatively, installdncilwith the development dependencies as described in theDevelopmentsection below.Seeprint_cil_from_bytes.pyfor a quick example of usingdncilto print theCILinstructions found in a byte stream containing a.NETmanaged method.DevelopmentIf you'd like to review and modifydncilsource code, you'll need to download it from GitHub and install it locally.Use the following command to installdncillocally with development dependencies:$ pip install /local/path/to/src[dev]You'll needdncil's development dependencies to run tests and linting as described below.TestingUse the following command to run tests:$ pytest /local/path/to/src/testsLintingUse the following commands to identify format errors:$ black -l 120 -c /local/path/to/src
$ isort --profile black --length-sort --line-width 120 -c /local/path/to/src
$ mypy --config-file /local/path/to/src/.github/mypy/mypy.ini /local/path/to/src/dncil/ /local/path/to/src/scripts/ /local/path/to/src/tests/Creditsdncilis based on theCILparsing code found indnLib.