dnfile

What it is and what it does

dnfile is a .NET executable parser that reads PE files containing Common Language Runtime (CLR) metadata and exposes their internal structure as Python objects. It wraps the lower-level PE parsing (via pefile) and adds .NET-specific interpretation: CLR directory entries, metadata streams, heap structures (strings, GUIDs, blobs, user strings), metadata tables, and .NET resources. The library is designed to tolerate partially malformed files and continue parsing what it can.

You use it when you need to inspect, analyze, or extract information from compiled .NET binaries—for reverse engineering, malware analysis, binary instrumentation, or metadata extraction workflows. Everything is exposed as an object hierarchy with raw structure values accessible via a `.struct` attribute, and the library includes shortcuts for common access patterns (e.g., `pe.net.mdtables` for the metadata tables stream, `pe.net.resources` for .NET resources).

Use it for:

• Reverse-engineer or audit compiled .NET applications to inspect metadata, resources, and CLR structures
• Extract .NET assembly resources (strings, images, serialized objects) from binaries for analysis or recovery
• Analyze malware or suspicious .NET executables to identify embedded payloads or obfuscation patterns
• Build binary instrumentation or rewriting tools that need to parse and understand .NET metadata tables
• Validate or extract version, signing, and resource metadata from .NET builds in automated pipelines

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Parses .NET executable files to extract and inspect CLR metadata, streams, tables, resources, and structure information from compiled .NET binaries.

Yes. dnfile is actively maintained, has no known vulnerabilities, installs with minimal friction, and fills a clear niche for .NET binary analysis. It is well-suited for reverse engineering, malware analysis, and metadata extraction workflows. Install it if you work with compiled .NET binaries and need programmatic access to their CLR structures.

Install

dnfile on PyPI

pip install dnfile

uv add dnfile

poetry add dnfile

Installing dnfile

Before you install

Low friction installation with a single runtime dependency (pefile). Active maintenance with recent releases; last commit 2026-08-14 and version 0.18.0 released 2026-01-31. Supports Python 3.8 through 3.11.

License in practice

MIT license (permissive) means you can use, modify, and distribute this package with minimal restrictions, provided you include the license notice.

Quickstart

pip install dnfile

import dnfile
pe = dnfile.dnPE('path/to/binary.exe')
pe.print_info()

# Access metadata tables
for s in pe.net.metadata.streams_list:
    if isinstance(s, dnfile.stream.MetaDataTables):
        num_tables = len(s.tables_list)

Verify before relying

• Whether the package handles all .NET Framework versions and modern .NET Core/5+ formats equally well
• Performance characteristics when parsing very large binaries or deeply nested resource hierarchies

Package facts

Evidence: dnfile-0.18.0-py3-none-any.whl

Keywords: dnfile

Tags

More Software Development packages