dncil
The FLARE team's open-source library to disassemble Common Intermediate Language (CIL) instructions.
Decision gist · record as of 2026-08-14
Yes. dncil is a stable, actively maintained library with no security vulnerabilities, low install friction, and a permissive license. Install it if you need to analyze .NET CIL bytecode from Python—particularly for malware analysis, reverse engineering, or security research. It is a specialized tool; install only if you have a concrete need to work with .NET managed methods.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.7 or later.
- To use example scripts, dnfile (.NET metadata parser) must be installed separately.
- Low friction: pure Python wheel with no runtime dependencies.
License · maintenance · safety
permissive license (permissive) — Licensed under Apache License (permissive), allowing commercial and private use with minimal restrictions.
last release 2022-12-12 (1341 days) · last repo commit 2026-07-24 · 179 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 181,576 downloads/mo, #10,121 on PyPI
Alternatives
Verify before relying
pip install dncil
from dncil.cil.body import CilMethodBody
# Parse CIL from bytes (e.g., from a .NET executable)
method_body = CilMethodBody.from_bytes(cil_bytes)
for insn in method_body.instructions:
print(f"{insn.offset:04x} {insn.mnemonic} {insn.operand}")- Whether the library handles all CIL opcode variants or only a subset of the full CIL specification.
- Performance characteristics when processing large or complex .NET assemblies.
- Compatibility with recent .NET Framework and .NET Core versions beyond what the fact sheet indicates.
What it is and what it does
dncil is a pure-Python library for parsing and analyzing Common Intermediate Language (CIL) bytecode from .NET managed methods. It exposes the structure of CIL through two main classes: CilMethodBody (representing a complete method with header, instructions, and exception handlers) and Instruction (representing individual CIL operations). The library is designed to let developers write CIL analysis and reverse-engineering tools in Python without needing C# expertise or C#-based tools like dnLib.
Typically used alongside dnfile (a .NET metadata parser) to extract and disassemble managed methods from .NET executables. The library provides both low-level access (raw bytes, opcode/operand decomposition) and high-level helpers (instruction type checks, size queries, flag inspection). It is maintained by Mandiant's FLARE team and is positioned for security research, malware analysis, and .NET binary inspection workflows.
Use it for
- Reverse-engineer .NET malware by disassembling and analyzing CIL instructions from suspicious executables.
- Build automated CIL analysis tools to detect patterns, extract metadata, or validate .NET binary integrity.
- Integrate .NET binary inspection into Python-based security pipelines without requiring C# or external tools.
- Parse and inspect CIL method bodies to extract control flow, operands, and exception handling logic.
- Develop educational tools or documentation generators that visualize or explain .NET bytecode.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
dncil is a stable, actively maintained library with no security vulnerabilities, low install friction, and a permissive license. Install it if you need to analyze .NET CIL bytecode from Python—particularly for malware analysis, reverse engineering, or security research. It is a specialized tool; install only if you have a concrete need to work with .NET managed methods.
Install
dncil on PyPI
Before you install
Low friction: pure Python wheel with no runtime dependencies. Maintenance is active with a recent commit on 2026-07-24, though the latest release dates to 2022-12-12.
Requires Python 3.7 or later. To use example scripts, dnfile (.NET metadata parser) must be installed separately.
License in practice
Licensed under Apache License (permissive), allowing commercial and private use with minimal restrictions.
Quickstart
pip install dncil
from dncil.cil.body import CilMethodBody
# Parse CIL from bytes (e.g., from a .NET executable)
method_body = CilMethodBody.from_bytes(cil_bytes)
for insn in method_body.instructions:
print(f"{insn.offset:04x} {insn.mnemonic} {insn.operand}")Verify before relying
- Whether the library handles all CIL opcode variants or only a subset of the full CIL specification.
- Performance characteristics when processing large or complex .NET assemblies.
- Compatibility with recent .NET Framework and .NET Core versions beyond what the fact sheet indicates.
Package facts
| License | permissive license permissive |
| Python support | Supports the current Python release >=3.7 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | None |
| Maintenance | Actively maintained 1,341 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 181,576 / month, #10,121 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableIntended Audience :: DevelopersIntended Audience :: Information TechnologyLicense :: OSI Approved :: Apache Software LicenseNatural Language :: EnglishProgramming Language :: Python :: 3Topic :: Security |
Evidence: dncil-1.0.2-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “cil disassembly python”
- dncildncil is a Python library for disassembling Common Intermediate…
- smdaSMDA is a recursive disassembler library that recovers control flow…
- capstoneCapstone is a disassembly engine that decodes binary machine code…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also dnfile · smda · ailment · capstone · pypcode · pythonnet · clr_loader · xdis · pydlt · pyccolo