I want to be able to do what an ordinary disassembler does—list the assembler instructions of an arbitrary executable—but from C#. It would consist, for instance, of finding a specific instruction from its address and determining which memory address is accessed by it.

Any Google search I tried leads me rather to the resources which explain how to decompile C# applications themselves in order to get IL bytecode. Except that I don't care about IL bytecode: what I want is to get the actual instructions of any app, including ones written in plain C or any other language.

In other words, I want the same thing as in How can I see the assembly code for a C++ program? question, but to be able to do it programmatically instead of using a GUI tool.

How do I do that?

  • OllyDbg commandline may help – Sarvesh Mishra Aug 3 '16 at 13:03
  • I googled for "disassembler library" (which is what anyone would do) and found capstone. I don't know how good it is, but it seems to be used by a lot of software. – Margaret Bloom Aug 3 '16 at 14:18
  • Wait, I'm totally ignorant about C#, but isn't it interpreted/jit type language, so unless you use some extra tool to get pre-compiled native machine code, there're only that interpreter language bytecodes, and the virtual machine is turning them into machine code (either by interpreting it, or by using JIT compiler on the particular piece of code being interpreted)? That was the whole point of that "managed" circus, to avoid direct machine code, IIRC. – Ped7g Aug 3 '16 at 15:14
  • 1
    @Ped7g: He's not trying to disassemble a C# program. Per the title, he's trying to disassemble a C program using C#. – Brian Aug 3 '16 at 17:54

here is a possible way and it is open source

:\>nuget list capstone*
Gee.External.Capstone 1.2.2    
:\>cd Desktop    
:\>md capnet    
:\>cd capnet    
:\>nuget install Gee.External.Capstone
Successfully installed 'Gee.External.Capstone 1.2.2' to C:\xxx\capnet    
:\>md testcap    
:\>cd testcap    
:\>copy ..\Gee.External.Capstone.1.2.2\content\capstone.dll .
        1 file(s) copied.    
:\>copy ..\Gee.External.Capstone.1.2.2\lib\net45\Gee.External.Capstone.dll .
        1 file(s) copied.    
:\>cat capy.cs
using System;
using Gee.External.Capstone;
public class Dissy
    public static void Main()
        var dis = CapstoneDisassembler.CreateX86Disassembler(DisassembleMode.Bit32);
        var code = new byte[] {  0x8d, 0x4c, 0x32, 0x08, 0x01, 0xd8, 0x81 };
        var res = dis.DisassembleAll(code);
        foreach(var a in res) {
            Console.WriteLine("{0}\t{1}",a.Mnemonic , a.Operand);
:\>csc /r:Gee.External.Capstone.dll capy.cs
Microsoft (R) Visual C# Compiler version
Copyright (C) Microsoft Corporation. All rights reserved.   

lea     ecx, dword ptr [edx + esi + 8]
add     eax, ebx
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.