Get code from C# DLL Dynamically

Question

I would like to see if DLL's (possibly compiled accross different machines) are the same. To do that what I was doing was loading the DLL and computing the MD5, which failed for DLL's failed across different machines (but had same source). This seems to be due to other metadata which is added at compilation time (as someone mentioned here).

I thought of reverse engineering the whole DLL and see if the code matches, however, I have two problems with this:

• I can only find tools which do this, I can't quite seem to find a C# library or something similar which does what I need.
• I am not 100% sure if the decompiled source will be the same on source compiled across different machines.

Any hints, tips and pointers would be appreciated.

Answer 1

You might be right - it could be metadata. I don't think that is necessarily the most likely possibility, though.

The other reason the DLLs are different is likely that they were compiled against different versions of .NET, or possibly MONO.

There is no guarantee that decompiling the DLLs will yield identical code even if they were compiled from the same source; indeed, given the optimizing nature of compilers, there is a tiny, theoretical (but extant) chance that slightly different sources can compile to the same executable - often, a loop will be unrolled - that is, turned into sequential, non-looping instructions - when this would cause a savings in memory usage or CPU time.

If the programmer unrolls the loop manually and recompiles, that's an optimization that the compiler had been doing anyway - presto, two different sources with an identical output.

A better question would be what you're hoping to learn by comparing the two DLLs. If it's strictly for the sake of learning, that's awesome and to be commended - however, the amount of knowledge you'll need to make a meaningful study of this is quite high. You are likely to find better results by learning general, more applicable C#/.net techniques.

Answer 2

Sign this assembly using an strong name and you'll be able to be absolutely sure that two or more assemblies are just the same one - or different too -, because these have the same assembly version, same public key token and so.

I doubt that two different developers would have a repeated private key if code source and Visual Studio project aren't the same one.