I read here that CAT.NET and FxCop are dead. As far as I understand, the successor Roslyn requires a visual studio project and source code.

Is there a tool that reads in a compiled .NET program and offers an API to do static data flow analysis?

  • I dont know the answer to your original question, but you could try using dnSpy to decompile the application to source, then open that in Visual Studio. – Dominik Antal Mar 19 '17 at 15:51
  • 1
    Does this work in all cases? Is this workflow reliable enough to be automated? Did you do this and did the visual studio data flow analysis plugins work? – langlauf.io Mar 19 '17 at 15:54
  • This method might work manually. I dont think it is a reliable method for automation. Usually after decompilation you will have to fix a lot of code manually to work and be compilable. I did this before manually and it worked. For automation, maybe you could take a look at dnLib to create such a project. – Dominik Antal Mar 19 '17 at 15:59
  • 1
    Do you have a specific example of the kind of analysis you want to do? – svick Mar 21 '17 at 19:13
  • Good question. I would like to detect data dependencies between variables, arguments, return values, or data hard-coded in the binary. For example, checking if an argument for function A depends on the return value of function B, or tracking user-entered data (taint analysis). – langlauf.io Mar 21 '17 at 19:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.