---
id: dnfile
version: "0.18.0"
license: MIT License
license_treatment: permissive
maintenance: active
---

# dnfile — Parse .NET executable files.

License: permissive · Maintenance: active · Downloads: 289.6K/mo

## What it is and what it does

dnfile is a .NET executable parser that reads PE files containing Common Language Runtime (CLR) metadata and exposes their internal structure as Python objects. It wraps the lower-level PE parsing (via pefile) and adds .NET-specific interpretation: CLR directory entries, metadata streams, heap structures (strings, GUIDs, blobs, user strings), metadata tables, and .NET resources. The library is designed to tolerate partially malformed files and continue parsing what it can.

You use it when you need to inspect, analyze, or extract information from compiled .NET binaries—for reverse engineering, malware analysis, binary instrumentation, or metadata extraction workflows. Everything is exposed as an object hierarchy with raw structure values accessible via a `.struct` attribute, and the library includes shortcuts for common access patterns (e.g., `pe.net.mdtables` for the metadata tables stream, `pe.net.resources` for .NET resources).

Use it for:

- Reverse-engineer or audit compiled .NET applications to inspect metadata, resources, and CLR structures
- Extract .NET assembly resources (strings, images, serialized objects) from binaries for analysis or recovery
- Analyze malware or suspicious .NET executables to identify embedded payloads or obfuscation patterns
- Build binary instrumentation or rewriting tools that need to parse and understand .NET metadata tables
- Validate or extract version, signing, and resource metadata from .NET builds in automated pipelines

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Parses .NET executable files to extract and inspect CLR metadata, streams, tables, resources, and structure information from compiled .NET binaries.

Yes. dnfile is actively maintained, has no known vulnerabilities, installs with minimal friction, and fills a clear niche for .NET binary analysis. It is well-suited for reverse engineering, malware analysis, and metadata extraction workflows. Install it if you work with compiled .NET binaries and need programmatic access to their CLR structures.

## Install

pip install dnfile
uv add dnfile
poetry add dnfile

## Installing dnfile

Before you install: Low friction installation with a single runtime dependency (pefile). Active maintenance with recent releases; last commit 2026-08-14 and version 0.18.0 released 2026-01-31. Supports Python 3.8 through 3.11.

License in practice: MIT license (permissive) means you can use, modify, and distribute this package with minimal restrictions, provided you include the license notice.

Quickstart:

pip install dnfile

import dnfile
pe = dnfile.dnPE('path/to/binary.exe')
pe.print_info()

# Access metadata tables
for s in pe.net.metadata.streams_list:
    if isinstance(s, dnfile.stream.MetaDataTables):
        num_tables = len(s.tables_list)

Verify before relying:

- Whether the package handles all .NET Framework versions and modern .NET Core/5+ formats equally well
- Performance characteristics when parsing very large binaries or deeply nested resource hierarchies

## Package facts

- License: MIT License (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 289.6K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

.NET executable parsing, CLR metadata extraction, dotnet binary analysis, .NET assembly inspection, PE file .NET parsing, metadata tables reader, dotnet resource extraction, binary-analysis, reverse-engineering, dotnet

[View on SkillFed](https://skillfed.io/packages/dnfile) · [View on PyPI](https://pypi.org/project/dnfile/)