ISpy

A PowerShell module for decompiling .NET assemblies using the ILSpy decompiler engine.

Overview

ISpy module provides comprehensive cmdlets to decompile .NET assemblies into readable C# source code.
Built on top of the ICSharpCode.Decompiler library (the engine behind ILSpy), it offers a powerful command-line interface for .NET assembly analysis and decompilation tasks.

Key Features

• Complete Assembly Decompilation: Decompile entire .NET assemblies to organized C# source code
• Targeted Type Analysis: Focus on specific types, methods, or namespaces
• Cross-Platform Support: Works with .NET Framework, .NET Core, and .NET 5+ assemblies
• Flexible Output Options: Console output, single files, or organized directory structures
• Advanced Search Capabilities: Find types and methods across multiple assemblies
• Pipeline Integration: Full PowerShell pipeline support for batch operations
• Dependency Analysis: Analyze assembly dependencies and relationships
• Syntax highlighting: PowerShell Module TextMate, pipe Expand-Type output to Format-TextMate

Installation

Install-Module ISpy

Prerequisites

• PowerShell: 7.6
• Windows Powershell: 5.1

Building from Source

1. Clone this repository
2. Open a terminal in the project directory
3. Build the project:

& .\build.ps1

1. Import the module:

Import-Module .\output\ISpy.psd1

Cmdlets

This module exposes the following cmdlets for assembly analysis and decompilation:

Cmdlet	Purpose
Expand-Type	Decompile specific methods or show type source (interactive)
Export-DecompiledSource	Export decompiled types to files with namespace organization
Get-AssemblyInfo	Assembly metadata and information
Get-DecompiledSource	Decompile types (returns an object per type)
Get-Dependency	Assembly dependency mapping
Get-Type	List and filter types within assemblies
New-Decompiler	Create configured CSharpDecompiler instances
New-DecompilerSetting	Creates a configurable DecompilerSettings
New-DecompilerFormattingOption	Creates a configurable CSharpFormattingOptions

Examples

Expand just one method (small, focused output)

[Math]::Truncate | Expand-Type

Expand a PowerShell cmdlet

Get-Command Get-ChildItem | Expand-Type

Quick Start: list a few types

Get-Item (Get-Module ISpy).Path | Get-Type

Find types by name pattern

Get-Type -Path (Join-Path $PSHOME 'System.Console.dll') -NamePattern "*Console*" 

Show assembly metadata

Get-AssemblyInfo -Path (Join-Path $PSHOME 'System.Console.dll')

Show external dependencies

Get-Item (Get-Module ISpy).Path | Get-Dependency -ExternalOnly

Preview one type's decompiled source object

Get-DecompiledSource -Path (Join-Path $PSHOME 'System.Console.dll') | Select-Object -First 1

Custom decompilersettings / formatting

# settings + formatting
$formatSplat = @{
    # Stroustrup-ish formatting
    ClassBraceStyle               = 'EndOfLine'
    IndentationString             = '  '
    MethodBraceStyle              = 'EndOfLine'
    NewLineAferIndexerOpenBracket = 'NewLine'
    StatementBraceStyle           = 'EndOfLine'
    ChainedMethodCallWrapping     = 'WrapAlways'
    InterfaceBraceStyle           = 'EndOfLine'
    StructBraceStyle              = 'EndOfLine'
    EnumBraceStyle                = 'EndOfLine'
    ConstructorBraceStyle         = 'EndOfLine'
}
$options = @{
    FileScopedNamespaces    = $true
    AlwaysUseBraces         = $true
    CSharpFormattingOptions = New-DecompilerFormattingOption @formatSplat
}
$Settings = New-DecompilerSetting @options
[System.Console]::Write | Expand-Type -Settings $Settings

see docs/en-us/ for more examples.

Development

Project Structure

ISpy/
├── src/                    # Source code
│   ├── Cmdlets/            # PowerShell cmdlet implementations
│   ├── Models/             # Data transfer objects
│   └── Utilities/          # Helper classes
├── tests/                  # Pester test suite
├── docs/en-us/             # PowerShell help documentation
├── output/                 # Built module package
└── build.ps1               # Build script

Contributing

1. Fork the repository
2. Create a feature branch
3. Add tests for new functionality
4. Update documentation as needed
5. Submit a pull request

License

This project follows the same license terms as the ISpy project it's based on.

Libraries

• ILSpy

---

Note: This module is designed for legitimate reverse engineering, learning, and analysis purposes. Please respect intellectual property rights and licensing terms when decompiling third-party assemblies.