There is a program that is possibly a RAT, and I would like to view the source code. After opening the .exe in dnSpy, I was able to tell that it was compressed with Fody-Costura. (https://github.com/Fody/Costura) Is there any way to de-compress the file? If so, how?

2 Answers 2


Embedded assemblies needs to be decompressed before they can be used so you can inspect all the code that does that in the assembly. Just go to Costura.AssemblyLoader to check how it is done. below is a extract from a simple example using Costura.Fody.

Assembly executingAssembly = Assembly.GetExecutingAssembly();
if (fullName.EndsWith(".compressed"))
    using (Stream manifestResourceStream = executingAssembly.GetManifestResourceStream(fullName))
        using (DeflateStream deflateStream = new DeflateStream(manifestResourceStream, CompressionMode.Decompress))
            MemoryStream memoryStream = new MemoryStream();
            AssemblyLoader.CopyTo(deflateStream, memoryStream);
            memoryStream.Position = 0L;
            return memoryStream;

You could modify this code to save decompressed assemblies to disk by adding a line File.WriteAllBytes(fullName.Replace(".compressed", ""), memoryStream.ToArray()); or just extract dlls resources and decompress externally via python or anything else that can do deflate.

  • Hi! Thanks for the reply! How should I go about extracting the resources? I found a few resource extractors, but none of them seem to work.
    – Nqndi
    Commented Jun 5, 2021 at 12:29
  • dnSpy has an option to save reaources. Commented Jun 5, 2021 at 13:19

I had success using the Fody-Costura-Decompress tool.

You would need to build the solution from source. it has a simple GUI for choosing your file and decompressing it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.