monodis

Disassemble an assembly to textual CIL

$ monodis [path/to/assembly.exe]

$ monodis --output=[path/to/output.il] [path/to/assembly.exe]

$ monodis --assembly [path/to/assembly.dll]

$ monodis --assemblyref [path/to/assembly.exe]

$ monodis --method [path/to/assembly.exe]

$ monodis --manifest [path/to/assembly.dll]

$ monodis --mresources [path/to/assembly.dll]

monodis [OPTIONS] ASSEMBLY

--help, -h
    Displays a brief help message explaining the command's usage and options.

--version, -v
    Shows the version information of the monodis utility.

--output=FILE, -o=FILE
    Redirects the disassembled output to the specified FILE instead of standard output.

--assembly, -a
    Disassembles only the assembly metadata, not the full CIL code.

--method=METHOD, -m=METHOD
    Disassembles a specific method by its full name (e.g., 'Namespace.Class::MethodName').

--type=TYPE, -t=TYPE
    Disassembles a specific type (class, struct, interface) by its full name (e.g., 'Namespace.ClassName').

--il, -i
    Forces the display of CIL instructions even if not explicitly requested by other options (e.g., with --method or --type, it's often implied).

--nofilter, -n
    Prevents any filtering of the output, showing all members including compiler-generated ones.

--nocomment, -c
    Suppresses the display of comments in the disassembled output, making it more concise.

--noheader, -q
    Omits the header information that usually appears at the beginning of the disassembled output.

The monodis command is a utility provided as part of the Mono project, which is a free and open-source implementation of Microsoft's .NET Framework. Its primary purpose is to disassemble compiled .NET assemblies (executables or libraries) into their Common Intermediate Language (CIL) form. Similar to Microsoft's ILDASM utility, monodis allows developers and analysts to inspect the CIL instructions, metadata, method bodies, and type definitions contained within a .NET assembly without needing the original source code.

It's an invaluable tool for understanding how compiled .NET code works, for debugging, for reverse engineering, or for verifying the contents of an assembly. While compilers translate high-level languages like C# or VB.NET into CIL, monodis performs the reverse operation, making the low-level instructions visible and understandable.

monodis requires the Mono runtime environment to be installed on your system to function. It is specifically designed for .NET assemblies and cannot be used to disassemble native (non-CIL) binaries. The output can be very verbose, especially for large assemblies, and interpreting it requires familiarity with Common Intermediate Language (CIL) and .NET assembly structure.

Unlike tools like objdump(1) which disassemble native machine code from compiled C/C++ programs, monodis operates exclusively on Common Intermediate Language (CIL) bytecode, which is the platform-agnostic intermediate language used by the .NET runtime. This distinction is crucial for understanding its specific application.

To disassemble a .NET executable named 'MyApplication.exe' and output the results to a file:
monodis --output=MyApplication.il MyApplication.exe

To disassemble only a specific method 'Program::Main' from 'MyApplication.exe':
monodis --method='Program::Main' MyApplication.exe

The monodis command emerged as a crucial component of the Mono project, which was initiated by Ximian (later acquired by Novell, then Xamarin, and now managed by Microsoft). Mono's goal was to create an open-source, cross-platform implementation of the .NET Framework. As part of this effort, a tool equivalent to Microsoft's proprietary ILDASM (.NET Intermediate Language Disassembler) was needed to allow developers to inspect and debug compiled Mono and .NET assemblies. monodis filled this role, providing a command-line interface for disassembling CIL and metadata, enabling deeper understanding and analysis within the Mono ecosystem.

mono(1), mcs(1)