dncil

What it is and what it does

dncil is a pure-Python library for parsing and analyzing Common Intermediate Language (CIL) bytecode from .NET managed methods. It exposes the structure of CIL through two main classes: CilMethodBody (representing a complete method with header, instructions, and exception handlers) and Instruction (representing individual CIL operations). The library is designed to let developers write CIL analysis and reverse-engineering tools in Python without needing C# expertise or C#-based tools like dnLib.

Typically used alongside dnfile (a .NET metadata parser) to extract and disassemble managed methods from .NET executables. The library provides both low-level access (raw bytes, opcode/operand decomposition) and high-level helpers (instruction type checks, size queries, flag inspection). It is maintained by Mandiant's FLARE team and is positioned for security research, malware analysis, and .NET binary inspection workflows.

Use it for:

• Reverse-engineer .NET malware by disassembling and analyzing CIL instructions from suspicious executables.
• Build automated CIL analysis tools to detect patterns, extract metadata, or validate .NET binary integrity.
• Integrate .NET binary inspection into Python-based security pipelines without requiring C# or external tools.
• Parse and inspect CIL method bodies to extract control flow, operands, and exception handling logic.
• Develop educational tools or documentation generators that visualize or explain .NET bytecode.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

dncil is a Python library for disassembling Common Intermediate Language (CIL) instructions from .NET managed methods, parsing headers, instructions, and exception handlers into an object-oriented API.

Yes. dncil is a stable, actively maintained library with no security vulnerabilities, low install friction, and a permissive license. Install it if you need to analyze .NET CIL bytecode from Python—particularly for malware analysis, reverse engineering, or security research. It is a specialized tool; install only if you have a concrete need to work with .NET managed methods.

Install

dncil on PyPI

pip install dncil

uv add dncil

poetry add dncil

Installing dncil

Before you install

Low friction: pure Python wheel with no runtime dependencies. Maintenance is active with a recent commit on 2026-07-24, though the latest release dates to 2022-12-12.

License in practice

Licensed under Apache License (permissive), allowing commercial and private use with minimal restrictions.

Quickstart

pip install dncil

from dncil.cil.body import CilMethodBody

# Parse CIL from bytes (e.g., from a .NET executable)
method_body = CilMethodBody.from_bytes(cil_bytes)
for insn in method_body.instructions:
    print(f"{insn.offset:04x}  {insn.mnemonic}  {insn.operand}")

Requires Python 3.7 or later. To use example scripts, dnfile (.NET metadata parser) must be installed separately.

Verify before relying

• Whether the library handles all CIL opcode variants or only a subset of the full CIL specification.
• Performance characteristics when processing large or complex .NET assemblies.
• Compatibility with recent .NET Framework and .NET Core versions beyond what the fact sheet indicates.

Package facts

Evidence: dncil-1.0.2-py3-none-any.whl

Keywords: .net, dotnet, cil, il, disassembly, FLARE

Tags

More Security packages