Managed Code: .NET and Java Reversing
Managed Code
Managed code (.NET, Java) is usually much easier to reverse than native binaries because it compiles to intermediate bytecode with rich metadata, allowing near-perfect decompilation. The exception is an assembly published with NativeAOT, which ships as a native binary with no IL left to decompile: that one needs the native workflow on the static analysis and decompilation pages instead.
Where the Legal Boundary Sits
Decompiling managed code to understand it is ordinary reverse engineering; defeating a licence check is
not. In the US, 17 U.S.C. §1201 prohibits circumventing a technological measure that controls access to a
work, and the exemption it offers for security research is narrow and conditional — "educational use" is
not one of its conditions. In the EU, Directive 2009/24/EC Article 6 allows decompilation only to obtain
the information needed for interoperability with an independently created program, and only for a
licensee or other authorised user. Work on software you own or have written authorisation to analyse.
.NET Reversing with dnSpyEx
dnspy-example.cs
// dnSpyEx - the maintained fork of dnSpy, which was archived in 2021
// Open .exe or .dll → Browse classes → View decompiled C#
// Typical decompiled output. A licence check is a useful landmark to learn to
// recognise: it marks where the program decides that a caller is trusted.
public class LicenseChecker {
public static bool ValidateLicense(string key) {
string expected = GenerateKey(Environment.MachineName);
return key == expected;
}
private static string GenerateKey(string seed) {
using (MD5 md5 = MD5.Create()) {
byte[] hash = md5.ComputeHash(Encoding.UTF8.GetBytes(seed));
return BitConverter.ToString(hash).Replace("-", "");
}
}
}
// Adjacent tools:
// - ILSpy - decompiles IL to editable C# and can save a rebuilt assembly
// - dotPeek (JetBrains) - free decompiler and symbol server
// - de4dot - deobfuscation front end for obfuscated .NET assemblies; the
// upstream repository was archived in October 2020, so use a maintained
// fork such as de4dot-cex, which covers vanilla ConfuserExJava Reversing
java-reversing.sh
# Java decompilation tools
# Vineflower - actively maintained fork of Fernflower (the IntelliJ decompiler);
# current releases track recent JDK class files, so start here
# CFR - command-line decompiler; the last release was 0.152 in December 2021,
# so treat it as legacy for bytecode from a current JDK
# JADX - the practical choice for Android APKs
# Decompile JAR with Vineflower
java -jar vineflower.jar target.jar ./decompiled
# The same job with CFR, for an older target
java -jar cfr.jar target.jar --outputdir ./decompiled
# Decompile single class
java -jar cfr.jar MyClass.class
# Android APK analysis
jadx -d output/ app.apk
# Common obfuscators:
# - R8 - the shrinker and obfuscator Android Gradle builds run; it reads
# ProGuard-format keep rules, so older ProGuard configs still apply
# - ProGuard (free, basic) - still used outside Android
# - DexGuard (commercial)
# - Allatori (Java)
# De-obfuscation strategies:
# - Rename classes/methods based on usage
# - String decryption (find decrypt method, hook it)
# - Control flow analysis