PAGES
← all tools
◆ Reverse Engineering

AsmResolver

v6.0.1 open-source

AsmResolver is a library for reading, modifying, and reconstructing Portable Executable files, supporting native Windows and managed .NET images.

Summary

AsmResolver is an open-source library, released under the MIT license, that .NET programmers import into their own code to read, modify and rebuild Portable Executable files, including both native Windows images and .NET assemblies. It gives low-level access to sections, data directories and the Import Address Table alongside a higher-level API modeled on System.Reflection, and it is built to tolerate malformed or obfuscated binaries, which points it at reverse engineers and malware analysts and tool builders doing binary patching or instrumentation rather than at application developers shipping product code. It runs cross-platform across .NET Framework, .NET Core, Mono and .NET standard, and can read PDBPDBA debug symbol file format used by Microsoft's toolchain that maps compiled binaries back to source code, function names, and variable types, letting cyber tools resolve symbols during reverse engineering or memory analysis. and PortablePdb symbols without a DIA dependency. First committed in 2013, it now has 48 contributors and remains active, with 215 commits and a release cut 27 days ago.

AsmResolver is a library for reading, modifying, and reconstructing Portable Executable files, supporting native Windows and managed .NET images.

How AsmResolver helps

What does a suspicious binary actually import, and can the packed IAT be trusted?

walks the Import Address Table and reconstructs it directly from the PE structures, even when the file is packed or obfuscated, instead of trusting whatever the loader would resolve at runtime

Which symbol belongs to which address when all I have is a PDB next to the binary?

reads PDB and PortablePdb symbol streams itself, with no DIA dependency, so the mapping works the same on Windows, Linux or macOS

Will this file even parse, given how mangled the headers look?

is built to tolerate malformed or obfuscated structures rather than reject them, so a binary that trips up other tooling can still be walked and dissected

Does this executable carry a single-file bundle or a ReadyToRun image I need to unpack first?

recognizes AppHost/SingleFileHost bundles and R2R binaries directly, so their inner structures are reachable without a separate extraction step

all 19 features, with the evidence for each →

Languages

Not documented

Features

19 capabilities

Built from AsmResolver's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date.

Compare with peers →

All capabilities 19 capabilities
PE file manipulation and modification shipped Reads, writes, and modifies PE headers, data directories, segments, and relocations. 19 releases · 1 other source · first seen Mar 2021

release 19 total

  • Platform class enables architecture-specific processing, including ARM32 and ARM64. v6.0.0 · May 2026 · source · release history
  • IDotNetDirectory::ManagedNativeHeader now returns IManagedNativeHeader segment type v5.5.0 · Nov 2023 · source · release history
  • Adds BinaryStreamReader::RemainingLength v5.5.0 · Nov 2023 · source · release history
  • Adds .NET ReadyToRun (R2R) assembly parsing to locate and read native code of precompiled managed method bodies v5.5.0 · Nov 2023 · source · release history
  • OptionalHeader::SetDataDirectory helper method is added. v5.2.0 · Mar 2023 · source · release history
  • DotNetDirectory now supports metadata tokens and unmanaged entry points. v5.2.0 · Mar 2023 · source · release history

example

  • Parse the native code region within a ReadyToRun module to analyze precompiled instructions. var peFile = PEImage.FromFile("app.dll"); var r2rSegment = peFile.ReadyToRun; if (r2rSegment != null) { var nativeCode = r2rSegment.NativeCode; // Read or locate specific method bodies... } v5.5.0 · Nov 2023 · source
Managed assembly analysis and resolution shipped Parses and resolves .NET managed assemblies, including directory probing logic that subclasses can override and handling of marshal type descriptors that are invalid or non-existent. 18 releases · 1 other source · first seen Mar 2021

release 18 total

  • Adds CustomMarshalDescriptor::MarshalTypeName to support and preserve invalid or non-existing marshal type descriptors. v6.0.1 · Jul 2026 · source · release history
  • Makes AssemblyResolverBase::ProbeDirectory virtual, enabling subclasses to override directory probing logic. v6.0.1 · Jul 2026 · source · release history
  • All parameterless Resolve methods in favor of the new Resolve and TryResolve methods taking a RuntimeContext. v6.0.0 · May 2026 · source · release history
  • RuntimeContext automates assembly resolution and shared metadata caching for multi-assembly processing. v6.0.0 · May 2026 · source · release history
  • Updates ModuleReaderParameters::WorkingDirectory to be respected by the assembly resolution mechanism v5.4.0 · Jul 2023 · source · release history
  • Adds DotNetRuntimeInfo::GetDefaultCorLib and KnownCorlibs::FromRuntimeInfo to resolve default CORLIBs from runtime info v5.4.0 · Jul 2023 · source · release history

example

  • Handle unparseable method bodies like native entry points without crashing. var body = method.Body ?? new UnresolvedMethodBody(); v4.9.0 · Mar 2022 · source
Code generation and assembly building shipped Provides factory methods and helpers to construct new types, members, and generic instances. 9 releases · 1 other source · first seen Mar 2022

release 9 total

  • TemplatedPEFileBuilder provides a flexible foundation for building native Windows PEs and mixed-mode .NET modules. v6.0.0 · May 2026 · source · release history
  • BinaryStreamWriter::AlignRelative is available for controlling stream alignment. v5.5.1 · Feb 2024 · source · release history
  • Adds BinaryStreamReader::RemainingLength v5.5.0 · Nov 2023 · source · release history
  • Adds ManagedPEFileBuilder::ErrorListener for structured error handling during PE construction v5.4.0 · Jul 2023 · source · release history
  • Adds ZeroesSegment and ZeroesDataSource types for creating, reading, and writing memory-efficient segments containing only zero bytes v5.3.0 · May 2023 · source · release history
  • Adds Platform::Is32Bit, Platform::Is64Bit, and Platform::PointerSize properties for platform detection v5.3.0 · May 2023 · source · release history

example

  • Create a generic instance method in an assembly. var genericMethod = type.MakeGenericInstanceMethod(arg1, arg2); v4.9.0 · Mar 2022 · source
.NET Framework and Runtime version support shipped Supports loading, parsing, and generating assemblies for various .NET versions and runtimes. 8 releases · first seen Mar 2021

release 8 total

  • TargetRuntimeProber allows detection of the target runtime of a PE image without loading it as a full ModuleDefinition. v6.0.0 · May 2026 · source · release history
  • .NET 8.0 is an official target. v5.5.1 · Feb 2024 · source · release history
  • Adds netstandard2.1 target framework v5.5.0 · Nov 2023 · source · release history
  • Read/write support for bundled and fully self-contained .NET applications v4.10.0 · Apr 2022 · source · release history
  • Add .NET Core 3.1 and .NET 6.0 build targets for additional performance v4.9.0 · Mar 2022 · source · release history
  • Add .NET 7.0 file support v4.9.0 · Mar 2022 · source · release history
Metadata lookup and resolution shipped Provides methods to locate, resolve, and validate metadata tokens, types, and members. 6 releases · 1 other source · first seen Dec 2021

release

  • Function pointer type signatures can now be imported via reflection. v5.5.1 · Feb 2024 · source · release history
  • TypeSignature::IsCompatibleWith and TypeSignature::IsAssignableTo methods are added. v5.2.0 · Mar 2023 · source · release history
  • Adds ModuleDefinition::LookupMember<T> and ModuleDefinition::TryLookupMember<T> methods v5.1.0 · Jan 2023 · source · release history
  • Adds rudimentary custom attribute validation v5.1.0 · Jan 2023 · source · release history
  • Adds TryFindXXXIndex methods to BlobStream, StringsStream, UserStringsStream, and GuidStream for locating existing indices. v4.8.0 · Dec 2021 · source · release history
  • GenericContext now supports partial resolution of generic parameters within signatures and includes GenericContext.FromXXX convenience methods. v4.8.0 · Dec 2021 · source · release history

example

  • Retrieve a member by name and type using generic lookup methods var member = module.LookupMember<MethodDefinition>("MyMethod"); if (member == null) { var success = module.TryLookupMember<MethodDefinition>("MyMethod", out var found); } v5.1.0 · Jan 2023 · source
Resource and Manifest manipulation shipped Reads, writes, and traverses embedded resources, manifest modules, and .resources files. 6 releases · first seen May 2021

release

  • Adds option to suppress .NET resource data deduplication v5.5.0 · Nov 2023 · source · release history
  • PEImageBuildContext::DiagnosticBag is superseded by PEImageBuildContext::IErrorListener v5.3.0 · May 2023 · source · release history
  • The constructor PEImageBuildResult taking a DiagnosticBag is superseded by the one taking an IErrorListener v5.3.0 · May 2023 · source · release history
  • Read/Write support for resource sets stored in .resources manifest resource files. v4.8.0 · Dec 2021 · source · release history
  • Adds various convenience Win32 resource directory traversal methods. v4.8.0 · Dec 2021 · source · release history
  • Add ManifestResource.GetReader method v4.6.0 · May 2021 · source · release history
Ahead-of-time (AOT) compilation support shipped Marks assemblies with AOT-compatible attributes to improve compatibility with ahead-of-time compilation workflows. 4 releases · 1 other source · first seen Dec 2021

release

  • Mark assemblies with more AOT compatible attributes v6.0.1 · Jul 2026 · source · release history
  • Marks assemblies with additional AOT-compatible attributes for better ahead-of-time compilation support. v6.0.1 · Jul 2026 · source · release history
  • Add MakeGenericInstanceMethod helper method v4.9.0 · Mar 2022 · source · release history
  • Adds .NET 6.0 CorLib support to allow loading and manipulating assemblies targeting .NET 6.0. v4.8.0 · Dec 2021 · source · release history

example

  • Create a generic instance method in an assembly. var genericMethod = type.MakeGenericInstanceMethod(arg1, arg2); v4.9.0 · Mar 2022 · source
PDB and PortablePDB support shipped Reads and writes Windows PDB metadata streams and symbol information. 5 releases · first seen Mar 2021

release

  • Adds Source Link support (#469) for embedding source link information in assemblies v5.4.0 · Jul 2023 · source · release history
  • Read support for PDB modules is added, including many more symbol and leaf record types. v5.2.0 · Mar 2023 · source · release history
  • Add read / write support for PortablePDB metadata streams and tables v5.0.0 · Dec 2022 · source · release history
  • Add a new WIP package called AsmResolver.Symbols.Pdb for reading and writing Windows PDB files using only managed code v5.0.0 · Dec 2022 · source · release history
  • Add RSDS CodeView Debug Data read/write support v4.5.0 · Mar 2021 · source · release history
Type and member cloning shipped Imports and clones types, members, and references between modules with customizable behavior. 4 releases · 1 other source · first seen Apr 2022

release

  • Add the notion of IMemberClonerListeners, allowing for automatically post-processing cloned metadata (e.g., automatically injecting it into the target module) as the cloner is cloning metadata v5.0.0 · Dec 2022 · source · release history
  • Add ModuleDefinition.DefaultImporter reference importer (#302) v4.11.0 · May 2022 · source · release history
  • Add convenience factory methods for building up and importing new type and member references directly from IResolutionScope and ITypeDefOrRef instances (#303, #312) v4.11.0 · May 2022 · source · release history
  • MemberCloner now allows customizing the underlying reference importer behavior and redirects System.Object from other .NET framework versions by default v4.10.0 · Apr 2022 · source · release history

example

  • Implement IMemberClonerListener to automatically inject injected members into the target module during cloning. public class MyClonerListener : IMemberClonerListener { public void MemberCloned(IMember original, IMember clone, ModuleBuilder builder) { builder.Modules[0].MetaDataRoot.MetadataTables.Add(clone); }… v5.0.0 · Dec 2022 · source
IL code analysis and instruction manipulation shipped Provides access to method bodies, IL instructions, and helpers for modifying or analyzing code. 5 releases · first seen Mar 2021

release

  • Add ModuleDefinition.DefaultImporter reference importer (#302) v4.11.0 · May 2022 · source · release history
  • Add convenience factory methods for building up and importing new type and member references directly from IResolutionScope and ITypeDefOrRef instances (#303, #312) v4.11.0 · May 2022 · source · release history
  • Add CilInstruction.ReplaceWith and CilInstruction.ReplaceWithNop helper methods v4.9.0 · Mar 2022 · source · release history
  • Method bodies that could not be parsed are now represented using UnresolvedMethodBody v4.9.0 · Mar 2022 · source · release history
  • Add ICilOperandResolver interface to CilDisassembler v4.5.0 · Mar 2021 · source · release history
Native Code Region Analysis shipped Parses and analyzes the native code regions within ReadyToRun (R2R) modules to inspect precompiled instructions. 1 release · 1 other source · first seen Nov 2023

release

  • Adds .NET ReadyToRun (R2R) assembly parsing to locate and read native code of precompiled managed method bodies v5.5.0 · Nov 2023 · source · release history

example

  • Parse the native code region within a ReadyToRun module to analyze precompiled instructions. var peFile = PEImage.FromFile("app.dll"); var r2rSegment = peFile.ReadyToRun; if (r2rSegment != null) { var nativeCode = r2rSegment.NativeCode; // Read or locate specific method bodies... } v5.5.0 · Nov 2023 · source
Module type identification shipped Checks if a specific type is the module type in .NET Core 5+ binaries. 1 release · 1 other source · first seen Jan 2023

release

example

  • Check if a type is the module type in .NET Core/5+ binaries bool isModuleType = myTypeDefinition.IsModuleType; v5.1.0 · Jan 2023 · source
Assembly trimming and size optimization shipped Optimizes assembly output by folding strings and enabling trimming support. 2 releases · first seen Oct 2021

release

  • AsmResolver, AsmResolver.PE.File, AsmResolver.PE and AsmResolver.Win32Resources are now trimmable packages v4.10.0 · Apr 2022 · source · release history
  • Enable string folding in the #Strings stream to reduce output file sizes v4.7.0 · Oct 2021 · source · release history
PE Certificate Table Support shipped Reads and writes PE signature/certificate tables via PEFile APIs. 1 release · first seen Jul 2023

release

  • Adds read/write support for PE certificate tables via PEFile APIs (#451) v5.4.0 · Jul 2023 · source · release history
AppHost and SingleFileHost patching shipped Patches AppHost and single-file host binaries without requiring original SDK template files. 1 release · first seen Mar 2023

release

  • AppHost / SingleFileHost file patching works without the original SDK template file. v5.2.0 · Mar 2023 · source · release history
Parameter handling shipped Provides methods to get or create parameter definitions for methods. 1 release · first seen Mar 2023

release

  • Parameter::GetOrCreateDefinition() is added for parameter handling. v5.2.0 · Mar 2023 · source · release history
Metadata stream preservation shipped Preserves spurious metadata streams and their order during processing. 1 release · first seen Jan 2023

release

  • Adds option to preserve spurious metadata streams and their order v5.1.0 · Jan 2023 · source · release history
Member naming and generation shipped Generates names for members and properties using customizable logic. 1 release · first seen Dec 2022

release

  • Rename FullNameGenerator to MemberNameGenerator (not API compatible with the old version) v5.0.0 · Dec 2022 · source · release history
Malware analysis and identification helpers shipped Provides algorithms and properties for identifying malware via imported symbols, type references, and hashes. 1 release · first seen Oct 2021

release

  • Add implementations for ImpHash and TypeRefHash hash algorithms for malware identification based on imported symbols and type references v4.7.0 · Oct 2021 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for AsmResolver, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail AsmResolver puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

16 entries

  1. July 20261
  2. May 20261
  3. February 20241
  4. November 20231
  5. July 20231
  6. May 20231
  7. March 20231
  8. January 20231
  9. December 20221
  10. May 20221
  11. April 20221
  12. March 20221
  13. December 20211
  14. October 20211
  15. May 20211
  16. March 20211
    Show

    16 entries

    Project health

    Issue, contributor and maintainer activity in Washi1337/AsmResolver, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 12 +3 vs prior 12 months
    2. Maintainers 3 +3 joined · −3 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 88% of issues opened, last 12 months
    5. Median time to close 38 days first maintainer reply 2.3 days
    6. Open backlog 13 of 261 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 13
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 1,119
    Issue themes, last 12 months
    • bugs 63%
    • features 6%
    • questions 19%
    • other 12%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →