Add .Net support

.gitignore

@@ -8,3 +8,5 @@ __pycache__/
 *.py[cod]
 *.egg-info/
 *_decompiler/
+/dist
+/build

AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS
 
-This repository contains ToCode, a Python-only binary exporter. ToCode takes one binary, IDA database, or Android APK path and writes one source-like project directory for reverse-engineering agents.
+This repository contains ToCode, a Python-only binary exporter. ToCode takes one binary, IDA database, Android APK, or .NET assembly/bundle/package path and writes one source-like project directory for reverse-engineering agents.
 
 ## Scope
 
@@ -16,6 +16,8 @@ This repository contains ToCode, a Python-only binary exporter. ToCode takes one
 - `src/tocode/__init__.py`: package version and `export_from_binaryview()`, the in-UI Binary Ninja library entry.
 - `src/tocode/analysis.py`: backend-neutral binary inventory and call graph normalization.
 - `src/tocode/backends/`: IDA Domain, radare2, angr, and Binary Ninja (`binja.py`) session adapters, plus the ASC/droidasc APK backend (`asc.py`: APK set discovery, DEX inventory, worker-side class decompilation).
+- `src/tocode/backends/dotnet.py` / `dotnet_pe.py`: .NET backend (input discovery for assemblies, apphosts, single-file bundles and NuGet packages; dnlib inventory; pure-Python PE/CLR/bundle parsing and IL token scan; worker-side C#/IL decompilation). `backends/dotnet_libs.py` downloads dnlib and ICSharpCode.Decompiler on demand (ask once, hash-pinned) into a per-user folder.
+- `src/tocode/dotnet.py`: .NET export pipeline; `dotnet_metadata.py`: .NET JSON documents and the generated `AGENTS.md`.
 - `src/tocode/apk.py`: APK export pipeline (extraction, decompile pool, resource decoding, metadata); `apk_metadata.py`: manifest parsing and Android JSON documents; `apk_native.py`: extraction and background native export of every `.so`.
 - `src/tocode/exporter.py`: project writer, function rendering, worker-session rendering, generated export `AGENTS.md`.
 - `src/tocode/metadata.py`: JSON metadata and triage documents.
@@ -71,6 +73,17 @@ APK input (`.apk`, `.apks`, `.xapk`) uses the ASC backend and writes instead:
 
 `base.apk` merges sibling `split_*.apk` files unless `--no-splits`; bundles are unpacked and merged. `--backend` selects the native backend for the `.so` exports (`binja` is rejected).
 
+.NET input (a managed PE, an apphost launcher with its `.dll`, a single-file bundle, or a `.nupkg`; detected by content, `--as-native` opts out) uses the .NET backend and writes instead:
+
+- `src/raw/<Assembly>/<Namespace>/**/<Type>.cs` and `<Type>.il` (C# and IL with raw bytecode per top-level type; nested types inside), `src/raw/<Assembly>/Properties/AssemblyInfo.cs` and `Manifest.il`, `src/raw/<Assembly>/<Assembly>.csproj`
+- `assemblies.json`, `types.json`, `namespace-graph.json`, `resources.json`, `container.json`, `native-libs.json`
+- `functions.json`, `function-index.json` (`c` = C#, `asm` = IL), `strings.json`, `imports.json`, `exports.json`, `sections.json`, `reachable.json`, `triage.json`, `project.json`, `export-manifest.json`
+- `data/resources/<Assembly>/*` (embedded resources, `.resources` decoded to JSON), `data/assemblies/*` and `data/<bundle|nupkg>/*` (extracted container entries)
+- `lib/<arch>/*` and `native/<arch>/<lib>/` for mixed-mode code, bundled native libraries, and P/Invoke targets next to the input (unless `--no-native`)
+- `tocode.log`, generated `AGENTS.md` and `CLAUDE.md`
+
+Framework/runtime assemblies and native runtime libraries inside bundles and packages are inventoried but only decompiled with `--include-framework`.
+
 ## Development
 
 - Prefer `uv` for local commands.
@@ -87,7 +100,8 @@ APK input (`.apk`, `.apks`, `.xapk`) uses the ASC backend and writes instead:
 - radare2/r2pipe is a fallback backend.
 - angr is the optional pure-Python fallback backend (`[angr]` extra).
 - ASC (`droidasc`, PyPI) is the APK/DEX backend and a core runtime dependency. It pulls androguard. `backends/asc.py` is the only module that imports it; it pre-imports the modules ASC would otherwise stub in `sys.modules` and silences androguard's loguru logging. Class decompilation is not thread-safe, so it runs in spawned worker processes (recycled in rounds; do not use `max_tasks_per_child`, it deadlocks spawn pools on some CPython builds). The big per-method/per-class/per-string JSON documents are streamed row by row (`apk_metadata.write_json_rows`), never built as one object.
-- APK native libraries are exported by `apk_native.py` on a background thread, each `export_binary` in its own spawned process so a backend OOM-kill or crash only fails that library (`native-libs.json` status). The thread waits for `TOCODE_APK_NATIVE_MIN_FREE_MB` (default 1024) of free memory before starting each library so it does not starve the DEX pool. `TOCODE_WORKER_TMP_DIR` also places the unpacked `.apks` bundle.
+- APK native libraries are exported by `apk_native.py` on a background thread, each `export_binary` in its own spawned process so a backend OOM-kill or crash only fails that library (`native-libs.json` status). The thread waits for `TOCODE_NATIVE_MIN_FREE_MB` (default 1024) of free memory before starting each library so it does not starve the DEX pool. `TOCODE_WORKER_TMP_DIR` also places the unpacked `.apks` bundle.
+- The .NET backend needs `pythonnet` (core dependency, pinned per Python version) and a .NET 9+ runtime on the host. Never commit or package DLLs: dnlib 4.5.0 and ICSharpCode.Decompiler 11.1 are downloaded from nuget.org by `backends/dotnet_libs.py` after the user agrees (asked once, remembered; `tocode --setup-dotnet` for non-interactive use). Their `.nupkg` and DLL SHA-256 hashes are pinned in `LIBRARIES` and checked at download time only (normal runs check presence; `--setup-dotnet` re-verifies). To bump a version, update both hashes. ICSharpCode.Decompiler 11 needs System.Reflection.Metadata 9, hence .NET 9+. Decompilation runs in spawned worker processes (recycled per round; a batch that crashes or hangs a worker is retried type by type so only the culprit fails). Tests must not require .NET: use `tests/dotnet_fixtures.py` (synthetic PE/bundles) and fake sessions; runtime-backed tests skip without it.
 - Binary Ninja is an opt-in backend (`--backend binja`, never auto-selected). The
   `binaryninja` module is supplied by the Binary Ninja install (in-UI) or the
   remote VM, so it is not a pip dependency. `rpyc`, the client used for the

DEVELOPMENT.md

@@ -0,0 +1,98 @@
+# Developing ToCode
+
+ToCode was built with agentic coding, and contributing the same way works
+well. Agents (and humans) should read [AGENTS.md](AGENTS.md) first: it is the
+project's instruction file, with the layout, export contract, dependency
+rules, and per-backend notes.
+
+## Setup
+
+You need Python 3.10+ and [uv](https://docs.astral.sh/uv/).
+
+```bash
+git clone https://github.com/buzzer-re/ToCode
+cd ToCode
+uv sync --locked --extra dev        # project + pytest in .venv
+uv run tocode --help                # run the CLI from the checkout
+```
+
+`uv tool install --force --editable .` installs a `tocode` command that
+follows your working tree.
+
+## Backends for local testing
+
+The unit tests need none of these; real exports do. Install what matches the
+area you are changing:
+
+| Backend | What to install | Notes |
+| --- | --- | --- |
+| IDA | IDA Pro 9 with idalib | `ida-domain`/`idapro` come with ToCode; IDA is found via `IDADIR`, `--idadir`, or common install paths. |
+| radare2 | `r2` plus r2ghidra (`r2pm -ci r2ghidra r2ghidra-sleigh`) | Used by `--backend r2` and as the `auto` fallback. |
+| angr | `uv sync --extra angr` | Large; tests in `tests/test_angr_backend.py` skip without it. |
+| Binary Ninja | Binary Ninja with binja-headless | See the Binary Ninja section of the README. |
+| Android | nothing extra (`droidasc` is a core dependency) | Real APK test: set `TOCODE_TEST_APK=/path/to/app.apk`. |
+| .NET | a .NET 9+ runtime, then `uv run tocode --setup-dotnet` | The SDK (`dotnet-sdk-10.0`) lets you build test assemblies. Real test: `TOCODE_TEST_DOTNET=/path/to/App.dll`. |
+
+Tests that need a backend, runtime, or sample skip themselves when it is
+missing, so the suite always runs. CI installs only the Python dependencies
+(no IDA, radare2, angr, Binary Ninja, or .NET runtime).
+
+## Tests and the quality gate
+
+```bash
+uv run --extra dev pytest -q                       # all tests
+uv run --extra dev pytest -q tests/test_cli.py     # one file
+uv run --extra dev pytest -q -k dotnet             # by keyword
+```
+
+Before opening a PR, run the same checks as CI:
+
+```bash
+./ci-local.sh          # ruff format, ruff lint, mypy, pytest, compileall
+./ci-local.sh --fix    # apply ruff formatting and safe lint fixes first
+```
+
+On Windows PowerShell:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File .\ci-local.ps1        # add -Fix to auto-fix
+```
+
+Write tests so they do not depend on the machine running them: no network,
+no installed backend or runtime, and no particular amount of free memory.
+`tests/dotnet_fixtures.py` builds synthetic .NET files, and
+`tests/test_apk_export.py` / `tests/test_dotnet_export.py` show how to drive a
+whole export with fake sessions.
+
+## Checking a change on real inputs
+
+After touching an export path, run a real export and read the result:
+
+```bash
+uv run tocode /bin/true -o /tmp/tocode-check --backend auto -j 2
+```
+
+Confirm the tree matches the export contract in `AGENTS.md`, `tocode.log` has
+no tracebacks, and `export-manifest.json` reports no unexpected failures. Never
+commit export directories (`*_decompiler/` and similar).
+
+## Dependencies
+
+- Runtime dependencies go in `pyproject.toml` with exact pins (`==`); run
+  `uv lock` and commit `uv.lock` (CI uses `--locked`).
+- Keep dependencies few and tied to exporting a project.
+- Do not commit or package binaries. The .NET libraries are downloaded on
+  demand with pinned hashes (`src/tocode/backends/dotnet_libs.py`); to update
+  one, change its version and both hashes there.
+
+## Releasing
+
+The version lives only in `src/tocode/__init__.py` (`__version__`).
+
+```bash
+uv build                    # sdist + wheel in dist/
+uvx twine check dist/*      # metadata and README rendering
+uvx twine upload dist/*     # needs a PyPI token
+```
+
+The PyPI package is `tocode-cli`; the installed command is `tocode`.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 buzzer-re
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.