ILSpy .NET Assembly Browser and Decompiler

Nodes can be queried using Per-node slots (specific to a type, e.g., BinaryOperatorExpression.LeftSlot) or Canonical kinds (shared across the AST, found in the Slots class).

Canonical kinds are matched by reference identity. You can use them for typed access or polymorphic checks:

// Typed access (T is inferred from the Slots constant)
node.GetChild(Slots.Left)              

// Collection access
node.GetChildren(Slots.Parameter)      

// Polymorphic check: "Is this node in an Initializer-kind slot?"
node.Slot.Kind == Slots.Initializer    

ILSpy uses the Managed Extensibility Framework (MEF) for its plugin architecture. To implement a plugin, you must export specific types for designated extension points.

Deployment Requirements:

• Plugins must be placed in the same directory as ILSpy.exe.
• Plugin assemblies must follow the naming convention *.Plugin.dll.

Development Setup: To develop a plugin, your project must include references to:

1. ILSpy.exe
2. System.Composition.AttributedModel
3. Other libraries shipped with ILSpy (depending on your plugin's specific functionality).

The ImageListStreamer format is a three-layer nested structure used to serialize WinForms ImageList data. When implementing or debugging a decoder (like ImageListDecoder.cs), you must process the data in this specific order:

1. Layer 1: NRBF Envelope — A .NET Remoting Binary Format (NRBF) payload containing a System.Windows.Forms.ImageListStreamer class record with a Data byte array member.
2. Layer 2: MSFt RLE Wrapper — An optional Run-Length Encoding (RLE) layer. If the data starts with the magic bytes MSFt (0x4D 0x53 0x46 0x74), it must be decompressed.
3. Layer 3: ILHEAD + DIBs — The raw Win32 ImageList_Write stream, consisting of an ILHEAD structure followed by color and (optionally) mask Device Independent Bitmaps (DIBs).

The C# Abstract Syntax Tree (AST) is composed of slot-based tree nodes. Instead of manual implementation, most mechanical code—including visitor plumbing, structural pattern matching, child-index APIs, constructors, and slot metadata—is automatically generated by a Roslyn source generator (DecompilerSyntaxTreeGenerator.cs).

To define a node, you declare a partial class and use attributes to define its structure. The generator then fills in the remaining implementation details.

[DecompilerAstNode]
public sealed partial class BinaryOperatorExpression : Expression
{
    [Slot("Left")]
    public partial Expression? Left { get; set; }     // a child slot (optional: nullable)

    public BinaryOperatorType Operator { get; set; }  // a scalar -- a plain auto-property

    [Slot("Right")]
    public partial Expression? Right { get; set; }    // another child slot
}

Large assemblies can lead to long build times, massive file sizes, and Mermaid rendering failures if the type selection is too large. To manage this:

1. Analyze first: Use the ILSpy GUI to identify specific subdomains worth diagramming.
2. Limit scope: Use --generate-diagrammer-include and --generate-diagrammer-exclude to restrict the diagrammer to specific namespaces or patterns.
3. Split diagrammers: Instead of one massive diagrammer, generate multiple smaller ones for different subdomains.

ILSpy emits performance trace events through two distinct EventSource providers. Tracing is disabled by default and only incurs performance costs when a collection session is actively attached. Events are emitted as Start/Stop pairs, allowing trace viewers to calculate durations and nesting levels based on timestamps.

Available Providers

• ICSharpCode.Decompiler: Instruments the decompilation pipeline, including per-type/per-member decompilation, type system initialization, assembly resolution, whole-project decompilation, and per-transform timing.
• ICSharpCode.ILSpyX: Instruments frontend support, including assembly loading, reference resolution, search, analyzers, bundle/zip extraction, and PDB loading.

The second layer uses a specific Run-Length Encoding (RLE) format.

Magic Bytes: The layer is identified by the 4-byte header MSFt (0x4D 0x53 0x46 0x74). If these bytes are missing, treat the buffer as uncompressed and skip to Layer 3.

RLE Algorithm:

• The format consists of (uint8 count, uint8 value) pairs.
• count (1..255) is the number of times the value repeats.
• There is no end marker; the length is determined by the NRBF byte array size.
• Long runs are split into multiple (0xFF, v) pairs followed by a remainder pair.

// Decoding logic summary
while (reader.TryRead(out byte count))
{
    reader.TryRead(out byte value);
    writer.TryWriteCount(count, value);
}