ISpy

A PowerShell module for decompiling .NET assemblies using the ILSpy decompiler engine.

Overview

ISpy module provides comprehensive cmdlets to decompile .NET assemblies into readable C# source code. Built on top of the ICSharpCode.Decompiler library (the engine behind ILSpy), it offers a powerful command-line interface for .NET assembly analysis and decompilation tasks.

Key Features

• Complete Assembly Decompilation: Decompile entire .NET assemblies to organized C# source code
• Targeted Type Analysis: Focus on specific types, methods, or namespaces
• Cross-Platform Support: Works with .NET Framework, .NET Core, and .NET 5+ assemblies
• Flexible Output Options: Console output, single files, or organized directory structures
• Advanced Search Capabilities: Find types and methods across multiple assemblies
• Pipeline Integration: Full PowerShell pipeline support for batch operations
• Dependency Analysis: Analyze assembly dependencies and relationships
• Syntax highlighting: PowerShell Module TextMate, pipe Expand-Type output to Format-TextMate

Installation

Install-Module ISpy

Prerequisites

• PowerShell: 7.4

Building from Source

1. Clone this repository
2. Open a terminal in the project directory
3. Build the project:

& .\build.ps1

1. Import the module:

Import-Module .\output\ISpy.psd1

Cmdlets

This module exposes the following cmdlets for assembly analysis and decompilation:

Cmdlet	Purpose
Expand-Type	Decompile specific methods or show type source (interactive)
Export-DecompiledSource	Export decompiled types to files with namespace organization
Get-AssemblyInfo	Assembly metadata and information
Get-DecompiledSource	Decompile types (returns an object per type)
Get-Dependency	Assembly dependency mapping
Get-Type	List and filter types within assemblies
New-Decompiler	Create configured CSharpDecompiler instances
New-DecompilerSetting	Creates a configurable DecompilerSettings
New-DecompilerFormattingOption	Creates a configurable CSharpFormattingOptions

Examples

Quick Start: list a few types

Get-Type -Path (Join-Path $PSHOME 'System.Console.dll')

Find types by name pattern

Get-Type -Path (Join-Path $PSHOME 'System.Console.dll') -NamePattern "*Console*" 

Show assembly metadata

Get-AssemblyInfo -Path (Join-Path $PSHOME 'System.Console.dll')

Show external dependencies

Get-Dependency -Path (Join-Path $PSHOME 'System.Console.dll') -ExternalOnly

Preview one type's decompiled source object

Get-DecompiledSource -Path (Join-Path $PSHOME 'System.Console.dll') | Select-Object -First 1

Expand just one method (small, focused output)

Expand-Type -Path (Join-Path $PSHOME 'System.Console.dll') -TypeName 'System.Console' -MethodName 'WriteLine' | Select-Object -First 3

Custom decompilersettings / formatting

# custom decompiler + settings + formatting
$formatSplat = @{
    ClassBraceStyle = 'NextLine'
    IndentationString = '  '
    MethodBraceStyle = 'NextLine'
    NewLineAferIndexerOpenBracket = 'NewLine'
    ChainedMethodCallWrapping = 'WrapAlways'
}
$decompilersettingsplat = @{
    AlwaysUseBraces = $true
    CSharpFormattingOptions = New-DecompilerFormattingOption @formatSplat
}
$decompilerSplat = @{ 
    Path = Join-Path $PSHOME 'System.Console.dll' 
    DecompilerSettings = New-DecompilerSetting @decompilersettingsplat
}
$decompiler = New-Decompiler @decompilerSplat
Expand-Type -Decompiler $decompiler -TypeName 'System.Console' -MethodName 'Write'

# settings + formatting
$formatSplat = @{
    # Stroustrup-ish formatting
    ClassBraceStyle               = 'EndOfLine'
    IndentationString             = '  '
    MethodBraceStyle              = 'EndOfLine'
    NewLineAferIndexerOpenBracket = 'NewLine'
    StatementBraceStyle           = 'EndOfLine'
    ChainedMethodCallWrapping     = 'WrapAlways'
    InterfaceBraceStyle           = 'EndOfLine'
    StructBraceStyle              = 'EndOfLine'
    EnumBraceStyle                = 'EndOfLine'
    ConstructorBraceStyle         = 'EndOfLine'
}
$options = @{
    FileScopedNamespaces    = $true
    AlwaysUseBraces         = $true
    CSharpFormattingOptions = New-DecompilerFormattingOption @formatSplat
}
$Settings = New-DecompilerSetting @options
Expand-Type -Settings $Settings -TypeName 'System.Console' -MethodName 'Write'

see docs/en-us/ for more examples.

Development

Project Structure

ISpy/
├── src/                    # Source code
│   ├── Cmdlets/            # PowerShell cmdlet implementations
│   ├── Models/             # Data transfer objects
│   └── Utilities/          # Helper classes
├── tests/                  # Pester test suite
├── docs/en-us/             # PowerShell help documentation
├── output/                 # Built module package
└── build.ps1               # Build script

Dependencies

• ICSharpCode.Decompiler: Core decompilation engine from ILSpy

Contributing

1. Fork the repository
2. Create a feature branch
3. Add tests for new functionality
4. Update documentation as needed
5. Submit a pull request

License

This project follows the same license terms as the ISpy project it's based on.

Libraries

• ILSpy - The original .NET decompiler GUI application
• ICSharpCode.Decompiler - The decompiler engine NuGet package

---

Note: This module is designed for legitimate reverse engineering, learning, and analysis purposes. Please respect intellectual property rights and licensing terms when decompiling third-party assemblies.