I read here that CAT.NET and FxCop are dead. As far as I understand, the successor Roslyn requires a visual studio project and source code.

Is there a tool that reads in a compiled .NET program and offers an API to do static data flow analysis?

  • I dont know the answer to your original question, but you could try using dnSpy to decompile the application to source, then open that in Visual Studio. Mar 19, 2017 at 15:51
  • 1
    Does this work in all cases? Is this workflow reliable enough to be automated? Did you do this and did the visual studio data flow analysis plugins work? Mar 19, 2017 at 15:54
  • This method might work manually. I dont think it is a reliable method for automation. Usually after decompilation you will have to fix a lot of code manually to work and be compilable. I did this before manually and it worked. For automation, maybe you could take a look at dnLib to create such a project. Mar 19, 2017 at 15:59
  • 1
    Do you have a specific example of the kind of analysis you want to do?
    – svick
    Mar 21, 2017 at 19:13
  • Good question. I would like to detect data dependencies between variables, arguments, return values, or data hard-coded in the binary. For example, checking if an argument for function A depends on the return value of function B, or tracking user-entered data (taint analysis). Mar 21, 2017 at 19:17


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.