Ever had to debug a third-party .NET API without having access to the source code? Or maybe a production bug popped up, and you need to see exactly what code is executing inside a compiled DLL file.
dnSpy is a powerful open-source tool that lets you decompile, edit, and debug .NET assemblies on the fly. In this guide, we will walk through how to intercept and step through the source code of a live .NET Core / .NET API when an endpoint is called.
🛠️ Prerequisites
Before we start, you will need:
• dnSpy (or dnSpy-net-framework): Download the latest release from GitHub.
• A running .NET API: This can be a local API or a running process on your machine.
• An API Client: Tools like Postman, cURL, or a browser to trigger the API calls.
🚀 Step-by-Step: Debugging a Live .NET API
- Locate the Compiled DLLs
When a .NET API builds or runs, it compiles its code into .dll files.
• Look inside your API's publish folder, bin/Debug/, or bin/Release/ directory.
• Find the main assembly file (usually named YourProjectName.dll).
Load the DLL into dnSpy
Open dnSpy. Make sure to open the correct architecture version (dnSpy.exe for 64-bit or dnSpy-x86.exe for 32-bit) matching your .NET runtime.
Go to File > Open and select your API's .dll file.
The assembly will appear in the Assembly Explorer tree view on the left.
Attach dnSpy to the API Process
To debug the code while making API calls, you must attach dnSpy to the active process running the API.
- Start your .NET API (e.g., via dotnet run or IIS).
- In dnSpy, click on Debug in the top menu and select Attach to Process... (or press Ctrl+Alt+P).
- If it is a modern .NET Core / .NET 5+ API, look for the dotnet.exe or YourProjectName.exe process. If it runs on IIS, look for w3wp.exe.
Click Attach.
text
[Assembly Explorer] [Debug Menu]
└── YourProject.dll └── Attach to Process -> dotnet.exe
Use code with caution.Find the API Controller and Set a Breakpoint
Now that dnSpy is attached to the live process, you can find the specific code executed during an API request:
- In the Assembly Explorer, expand your DLL.
- Navigate through the namespaces to find your Controllers or Minimal API endpoints (e.g., YourProject.Controllers > UsersController).
- Double-click the controller class to decompile it into readable C# code in the central editor pane.
- Locate the HTTP method function (like HttpGet or HttpPost).
Click on the left margin next to a line of code to set a red breakpoint, just like you would in Visual Studio.
Trigger the API Call
Switch to Postman or your browser and send a request to that specific API endpoint.
• Example: GET http://localhost:5000/api/users/1
• As soon as the request hits the server, the execution will pause.
• dnSpy will blink and highlight the breakpoint line in yellow.
- Inspect Variables and Step Through Code
With the execution paused, you can use dnSpy's debugging panels to inspect the state of the API:
• Locals Window: View the current values of parameters, query data, and instantiated objects passed into the API.
• Step Over (F10) / Step Into (F11): Execute the decompiled code line-by-line to see exactly where logic fails or data changes.
💡 Pro Tip: Edit the Code Directly
If you find a bug during your debugging session, you don't just have to watch it fail. You can patch it instantly:
- Right-click inside the decompiled method and select Edit Method (C#)....
- Change the code directly inside the popup window.
- Click Compile.
- Go to File > Save Module... to overwrite the original DLL with your patch.
⚠️ Important Considerations
• Optimized Code: If the API was built using the Release configuration, the compiler might optimize code lines, making breakpoints jump unexpectedly. You can disable optimizations by placing a .ini file next to the DLL or disabling it in dnSpy's options.
• Legal & Security: Only decompile and debug code you own or have permission to analyze.
Happy debugging! 🚀
Top comments (0)