DnSpyXDX

DnSpyXDX is a cross-platform assembly browser and debugger for Windows and Linux. It combines a native Photino window, a Blazor interface, and the ILSpy decompiler engine to provide a compact desktop workflow for understanding compiled C# applications and libraries. Debugger foundation now includes CoreCLR launch/attach, direct Mono attach, execution control, stack/locals/output panels, and decompiled-source breakpoints.

Highlights

• Open managed .dll and .exe files without executing assembly code, from a dialog or by dragging them onto the window
• Lazily browse assemblies, references, resources, namespaces, and types; reach members through search and source navigation
• Decompile complete types or individual members into readable C#
• Switch between C#, IL, and sequence-point-mapped IL with C# views
• Search types, methods, fields, properties, and events across one or all open assemblies
• Analyze symbol relationships including uses, callers, derived types, overrides, implementations, instantiation, exposure, and event firing
• Reveal search results in the assembly tree
• Reopen previously decompiled documents quickly through a content-addressed local cache
• Export open assemblies as SDK-style C# projects in a .slnx solution
• Restore open assemblies, document tabs, search state, panel layout, and window placement
• Navigate large trees and source documents with persistent, themed scrollbars
• Read decompiler-derived semantic source highlighting and metadata tokens
• Expose the live workspace to local MCP hosts through an optional authenticated loopback endpoint
• Debug CoreCLR or attach to a Mono soft-debugger agent with IL-native decompiled-code breakpoints, automatic debug-module loading and stopped-source reveal, thread/frame navigation, and expandable variables

Safety model

DnSpyXDX treats assemblies as untrusted input. It reads PE files and CLI metadata through ICSharpCode.Decompiler; it does not inspect files using Assembly.Load, reflection, or an AssemblyLoadContext.

Malformed files can still consume significant CPU or memory while being parsed or decompiled. Do not treat the current in-process architecture as a security boundary.

The application UI is fully offline-capable: its HTML, CSS, JavaScript, images, and fonts are bundled with the published application. The optional MCP server uses an authenticated loopback HTTP endpoint only when explicitly started from the MCP Activity panel.

Requirements

• .NET 10 SDK for development
• Windows x64 with WebView2, or
• Linux x64 with GTK 3, WebKitGTK 4.1, and libnotify

Linux package names vary between distributions.

Run from source

git submodule update --init --recursive
dotnet restore DnSpyXDX.slnx
dotnet run --project src/DnSpyXDX.Host

Build and test

dotnet build DnSpyXDX.slnx
dotnet test DnSpyXDX.slnx

Host build downloads XDX NetCoreDbg release xdx-3.2.0-1092.2, pinned to backend commit 7be52ab5cf348c75ad028e3578d2fb0b96df748d, once, verifies its SHA-256 checksum, caches it under src/DnSpyXDX.Host/obj/netcoredbg, and copies the current RID payload into debuggers/netcoredbg/<RID> beside the application. Set -p:BundleNetCoreDbg=false only when building offline with an externally managed adapter.

Direct Mono attach uses the pinned Mono.Debugger.Soft source under third_party/debugger-libs. Start a Mono target with a debugger agent, then select Attach Mono in the debugger dialog:

mono --debug --debugger-agent=transport=dt_socket,server=y,address=127.0.0.1:55555 app.exe

Keep the endpoint on loopback unless the network is trusted; the soft-debugger transport is not an authenticated remote-access boundary.

Publish

dotnet publish src/DnSpyXDX.Host -c Release -r linux-x64 --self-contained true -p:PublishSingleFile=false
dotnet publish src/DnSpyXDX.Host -c Release -r win-x64 --self-contained true -p:PublishSingleFile=false

Trimming, Native AOT, and single-file publishing are intentionally disabled for the initial release. Both publish commands include the matching NetCoreDbg payload, Mono soft-debugger assemblies, and their licenses automatically.

Project structure

• DnSpyXDX.Host — Photino executable, native dialogs, and session/window persistence
• DnSpyXDX.UI — Blazor desktop interface and source presentation
• DnSpyXDX.Application — application contracts and workspace state
• DnSpyXDX.Decompilation — metadata browsing, analysis, persistent caching, and ILSpy decompilation backend
• DnSpyXDX.Debugging — runtime-neutral debugger lifecycle and engine boundary
• DnSpyXDX.Export — project export, reports, and .slnx generation
• DnSpyXDX.Tests — metadata, decompilation, analysis, MCP, export, cache, and presentation tests

The project and namespace names consistently use the DnSpyXDX product identity while retaining clear architectural boundaries.

Scope

DnSpyXDX currently ships read-only inspection, best-effort source export, cross-platform CoreCLR debugging, and direct Mono soft-debugger attach. Unity Mono discovery and compatibility work is under active development. Assembly editing, recompilation, IL patching, and metadata rewriting remain outside current scope.

Documentation

The original implementation guide is now organized into focused documents:

• Documentation index
• Product direction and scope
• Application architecture
• Assembly workspace and navigation
• Project export
• Dependencies and platform support
• Reliability and testing
• Implementation roadmap
• Architecture decisions
• Primary references

License

DnSpyXDX is licensed under the MIT License. Third-party packages and native components retain their respective licenses.