---
id: dncil
version: "1.0.2"
license: unclear
license_treatment: permissive
maintenance: active
---

# dncil — The FLARE team's open-source library to disassemble Common Intermediate Language (CIL) instructions.

License: permissive · Maintenance: active · Downloads: 181.6K/mo

## What it is and what it does

dncil is a pure-Python library for parsing and analyzing Common Intermediate Language (CIL) bytecode from .NET managed methods. It exposes the structure of CIL through two main classes: CilMethodBody (representing a complete method with header, instructions, and exception handlers) and Instruction (representing individual CIL operations). The library is designed to let developers write CIL analysis and reverse-engineering tools in Python without needing C# expertise or C#-based tools like dnLib.

Typically used alongside dnfile (a .NET metadata parser) to extract and disassemble managed methods from .NET executables. The library provides both low-level access (raw bytes, opcode/operand decomposition) and high-level helpers (instruction type checks, size queries, flag inspection). It is maintained by Mandiant's FLARE team and is positioned for security research, malware analysis, and .NET binary inspection workflows.

Use it for:

- Reverse-engineer .NET malware by disassembling and analyzing CIL instructions from suspicious executables.
- Build automated CIL analysis tools to detect patterns, extract metadata, or validate .NET binary integrity.
- Integrate .NET binary inspection into Python-based security pipelines without requiring C# or external tools.
- Parse and inspect CIL method bodies to extract control flow, operands, and exception handling logic.
- Develop educational tools or documentation generators that visualize or explain .NET bytecode.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

dncil is a Python library for disassembling Common Intermediate Language (CIL) instructions from .NET managed methods, parsing headers, instructions, and exception handlers into an object-oriented API.

Yes. dncil is a stable, actively maintained library with no security vulnerabilities, low install friction, and a permissive license. Install it if you need to analyze .NET CIL bytecode from Python—particularly for malware analysis, reverse engineering, or security research. It is a specialized tool; install only if you have a concrete need to work with .NET managed methods.

## Install

pip install dncil
uv add dncil
poetry add dncil

## Installing dncil

Before you install: Low friction: pure Python wheel with no runtime dependencies. Maintenance is active with a recent commit on 2026-07-24, though the latest release dates to 2022-12-12.

License in practice: Licensed under Apache License (permissive), allowing commercial and private use with minimal restrictions.

Quickstart:

pip install dncil

from dncil.cil.body import CilMethodBody

# Parse CIL from bytes (e.g., from a .NET executable)
method_body = CilMethodBody.from_bytes(cil_bytes)
for insn in method_body.instructions:
    print(f"{insn.offset:04x}  {insn.mnemonic}  {insn.operand}")

Requires Python 3.7 or later. To use example scripts, dnfile (.NET metadata parser) must be installed separately.

Verify before relying:

- Whether the library handles all CIL opcode variants or only a subset of the full CIL specification.
- Performance characteristics when processing large or complex .NET assemblies.
- Compatibility with recent .NET Framework and .NET Core versions beyond what the fact sheet indicates.

## Package facts

- License: not declared (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 181.6K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

cil disassembly python, .net il disassembler, common intermediate language parser, dotnet method analysis, managed code disassembly, cil instruction parsing, .net reverse engineering, flare malware analysis, .net-analysis, reverse-engineering, malware-analysis

[View on SkillFed](https://skillfed.io/packages/dncil) · [View on PyPI](https://pypi.org/project/dncil/)