dotnet-sce
Extract assemblies and resources from self-contained .NET 5+ executables.
This is a Python conversion of the SelfContainedExtractor project, providing cross-platform bundle extraction with a simple command-line interface.
Features
- Automatic bundle detection: Scans executable PE headers to locate the embedded bundle
- Optional manual offset: Provide the bundle offset explicitly if needed
- Transparent decompression: Automatically handles compressed (zlib) and uncompressed files
- Cross-platform: Works on Windows, macOS, and Linux
- Single-file extraction: Extract individual files without extracting the entire bundle
How It Works
Self-contained .NET executables (.NET 5+) bundle all required runtime files and dependencies into a single executable file. This tool locates and parses the internal bundle structure to extract:
- Application assemblies (.dll files)
- Runtime configuration files (.runtimeconfig.json, .deps.json)
- System libraries and dependencies
- Supporting native binaries
The extraction process:
- Scans the PE (Portable Executable) header to locate the bundle signature
- Reads the bundle header to determine format version and file count
- Parses individual file entries (offset, size, compression status, type)
- Decompresses files as needed using zlib
- Writes extracted files to the output directory, preserving structure
Installation
Via PyPI (recommended)
Install the latest released version from PyPI:
pip install dotnet-sce
Or with uv:
uv pip install dotnet-sce
After installation, the dotnet-sce command will be available globally:
dotnet-sce --help
From source (development)
Requirements
- Python 3.8 or later
uvpackage manager (orpip)
Installation
git clone https://github.com/yourusername/dotnet-sce.git
cd dotnet-sce
uv pip install -e .
Or with development dependencies:
uv pip install -e ".[dev]"
With pip:
pip install -e .
Usage
Basic usage (auto-detect bundle offset)
dotnet-sce <executable> <output-directory>
Example:
dotnet-sce MyApp.exe ./extracted_files
Specify bundle offset manually
If auto-detection fails, you can provide the offset explicitly (in decimal or hex):
# Decimal offset
dotnet-sce MyApp.exe ./extracted_files --offset 1048576
# Hexadecimal offset
dotnet-sce MyApp.exe ./extracted_files --offset 0x100000
Display help
dotnet-sce -h
Example Output
$ dotnet-sce samples/WinChatClient.exe samples_out
Bundle details:
Bundle ID: wA4enLQ_7Ls8
Version: 6.0
Embedded files count: 171
Embedded file info: Name: WinChatClient.dll, Size: 14848, Type: 1
Embedded file info: Name: WinChatClient.runtimeconfig.json, Size: 372, Type: 4
...
Successfully extracted file WinChatClient.dll.
Successfully extracted file WinChatClient.runtimeconfig.json.
...
Architecture
The project follows a modular design:
binary_reader.py— Low-level binary I/O with variable-length encoding supportbundle_header.py— Bundle header parsing and validationbundle_file_entry.py— File entry metadata and type enumerationbundle.py— Core extraction logiccli.py— Command-line argument parsing and orchestration
All modules follow Google Python style conventions and include comprehensive docstrings.
Testing
Run the included test suite:
uv run pytest
Test the tool with the sample bundle:
uv run dotnet-sce samples/WinChatClient.exe samples_out
Limitations
- Only supports .NET 5+ self-contained executables (versions 2.x and 6.x bundles)
- Does not support bundled native executables or platform-specific resources
- Offset auto-detection works best on unmodified official .NET self-contained builds
Attribution
This project is a Python conversion of SelfContainedExtractor by LukeFZ.
The original C# implementation was reverse-engineered from the .NET Runtime source code and ported to Python for broader compatibility and ease of use.
The Python version maintains feature parity with the original while providing improved usability through:
- A simpler installation process
- Better error messages with contextual help
- Cross-platform compatibility without .NET dependencies
- Type hints and improved code documentation
License
This project is provided as-is for educational and practical use. Refer to the original SelfContainedExtractor repository for licensing details.
Metadata
Release files for dotnet-sce 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| dotnet_sce-0.1.0.tar.gz | 25.4 kB | With provenance | Details for dotnet_sce-0.1.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| dotnet_sce-0.1.0-py3-none-any.whl | Python 3 | none | any | Details for dotnet_sce-0.1.0-py3-none-any.whl |
Total release size: 47.2 kB
Release files / dotnet_sce-0.1.0.tar.gz
| Download URL | dotnet_sce-0.1.0.tar.gz |
|---|---|
| Size | 25.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
0d6411d308d5d8e847118b58d05484de6ed7460206d23ebc27e793d1fa8a8a80
|
|
BLAKE2b-256 checksum How to use checksums |
e2ebd752e3031d1090b0573ff31d54913645aef90a6cd694e7c8f8fee73b76c1
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Feb 7, 2026.
Transparency logRelease files / dotnet_sce-0.1.0-py3-none-any.whl
| Download URL | dotnet_sce-0.1.0-py3-none-any.whl |
|---|---|
| Size | 21.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
9046806c5ffb3d7f063269b98d4809241a8575ef1707cded382857f3db94cbde
|
|
BLAKE2b-256 checksum How to use checksums |
9894113b65fd4a612df5c12143cd764c059d0f22334e7bc343d503a60db35865
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Feb 7, 2026.
Transparency logSecurity for dotnet-sce 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for dotnet_sce-0.1.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Feb 7, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.