dotscope 0.7.0

A high-performance, cross-platform framework for analyzing and reverse engineering .NET PE executables
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162

[package]
name = "dotscope"
version = "0.7.0"
authors = ["Johann Kempter <admin@binflip.rs>"]
edition.workspace = true
description = "A high-performance, cross-platform framework for analyzing and reverse engineering .NET PE executables"
license.workspace = true
repository.workspace = true
homepage.workspace = true
documentation = "https://docs.rs/dotscope"
keywords = ["dotnet", "cil", "assembly", "reverse-engineering", "metadata"]
categories = ["parsing", "development-tools", "encoding"]
readme = "../README.md"
# Exclude tests, docs, and working artifacts from crates.io package.
# Users don't run tests on library dependencies - they just use the compiled code.
# Tests and samples are available in the repository for contributors.
exclude = [
    "tests/",
    "docs/",
    "*.log",
    "*.exe",
]

[package.metadata.docs.rs]
all-features = true
rustdoc-args = ["--cfg", "docsrs"]

[dependencies]
thiserror = "2.0.18"
uguid = "2.2.1"
widestring = "1.2.1"
strum = { version = "0.28.0", features = ["derive"]}
cowfile = "0.2.2"
memmap2 = "0.9.10"
tempfile = "3.27.0"
goblin = { version = "0.10.5", default-features = false, features = ["pe32", "pe64", "std"] }
ouroboros = "0.18.5"
sha1 = { version = "0.11.0", optional = true, features = ["oid"] }
sha2 = { version = "0.11.0", features = ["oid"] }
md-5 = { version = "0.11.0", optional = true }
hmac = "0.13.0"
imbl = { version = "7.0.0", optional = true }
pbkdf2 = "0.13.0"
aes = "0.9.0"
des = { version = "0.9.0", optional = true }
cbc = "0.2.0"
ecb = "0.2.0"
dashmap = "6.1.0"
crossbeam-skiplist = "0.1.3"
rayon = "1.12.0"
rustc-hash = "2.1.2"
boxcar = "0.2.14"
quick-xml = "0.39.2"
hex = "0.4.3"
num-bigint = { version = "0.4.6", optional = true }
log = "0.4.29"
flate2 = "1.1.9"
lzma-rs = "0.3.0"
z3 = { version = "0.20.0", optional = true }
iced-x86 = { version = "1.21.0", default-features = false, features = ["std", "decoder", "instr_info"], optional = true }
tokio = { version = "1.52.1", optional = true, features = ["rt-multi-thread"] }

# Metal GPU acceleration for LLM inference on macOS (Apple Silicon / AMD GPU).
[target.'cfg(target_os = "macos")'.dependencies]
mistralrs = { version = "0.8.1", optional = true, features = ["metal"] }

# CUDA GPU acceleration for LLM inference on Linux/Windows with NVIDIA GPUs.
[target.'cfg(not(target_os = "macos"))'.dependencies]
mistralrs = { version = "0.8.1", optional = true }

[dev-dependencies]
criterion = "0.8.2"
env_logger = "0.11.10"
clap = { version = "4.6.1", features = ["derive"] }
ctrlc = "3.5.2"

[features]
default = ["legacy-crypto", "emulation", "x86", "deobfuscation"]

# Include legacy cryptographic algorithms for full .NET compatibility.
# Required for: public key token computation (SHA1), assembly hash verification (MD5/SHA1),
# and deobfuscation of .NET code using DES/3DES encryption.
# Disable with `default-features = false` if you need to exclude these from your dependency tree.
legacy-crypto = ["dep:sha1", "dep:md-5", "dep:des"]

# CIL bytecode emulation engine.
# Enables: controlled CIL execution, BCL method hooks, heap/stack emulation.
# Used by deobfuscation for runtime value computation and string decryption.
emulation = ["dep:imbl", "dep:num-bigint"]

# Compiler infrastructure: SSA optimization passes, code generation, pass scheduler.
# Enables: interprocedural analysis, inlining, constant propagation, SSA-to-CIL codegen.
compiler = []

# x86/x64 native code analysis: instruction decoding, CFG construction, SSA translation.
# Enables: native method stub analysis, mixed-mode binary support in PE writer.
x86 = ["dep:iced-x86"]

# Z3 symbolic constraint solver for advanced analysis.
# Enables: symbolic expression solving, satisfiability checking, constraint inversion.
# Optional enhancement — not required by any other feature.
z3 = ["dep:z3"]

# Deobfuscation framework: transformation passes, obfuscator detection, assembly rewriting.
# Automatically enables compiler, x86, and emulation features.
# Optionally enhanced by the `z3` feature for symbolic constraint solving.
# String decryption for BitMono requires `legacy-crypto` (PBKDF2-HMAC-SHA1).
deobfuscation = ["compiler", "x86", "emulation"]

# LLM-powered smart renaming for deobfuscated identifiers.
# Enables: local GGUF model inference via mistral.rs for semantic identifier naming.
# Without this feature, the renamer falls back to simple sequential names (A, B, AA...).
# GPU acceleration is automatic: Metal on macOS, CUDA-ready on Linux/Windows.
smart-rename = ["deobfuscation", "dep:mistralrs", "dep:tokio"]

# Skip expensive validation tests that use ProjectLoader with dependency resolution.
# These tests are slow on CI runners with limited cores/IO. Use this feature on slow runners (e.g., macOS/Windows CI).
skip-expensive-tests = []

[[example]]
name = "deobfuscate"
required-features = ["deobfuscation"]

[[example]]
name = "analysis"
required-features = ["deobfuscation"]

[[bench]]
name = "cilobject"
harness = false

[[bench]]
name = "cilassemblyview"
harness = false

[[bench]]
name = "assembly"
harness = false

[[bench]]
name = "resources"
harness = false

[[bench]]
name = "method_body"
harness = false

[[bench]]
name = "signatures"
harness = false

[[bench]]
name = "streams"
harness = false

[[bench]]
name = "cor20"
harness = false

[[bench]]
name = "security"
harness = false