# Decompile .NET on Command Line
> Decompile a .NET assembly to C# source on REMnux

**Tools:** [[tools/ilspycmd|ilspycmd]], [[tools/de4dot|de4dot]]
**FOR610 Lab:** 4.8

## Commands
```bash
# Decompile to C# source
ilspycmd <assembly.exe> > source.cs
# Search for suspicious patterns
grep -n 'Assembly.Load\|WebClient\|Process.Start' source.cs
# If obfuscated, deobfuscate first
de4dot <assembly.exe>
ilspycmd <assembly-cleaned.exe> > source_clean.cs
```

#recipe #ilspycmd #de4dot