Compare decompiled code to source repository

[drj1057]

I have just joined a new company and needed to make a change to .net service we run. I have discovered that the config file on the server does not match the config file in the TFS repository. With some analysis I have found the code in the repository has not been updated for over 5 years whereas the executable was built in July last year, and there are around 60 changes in the service desk over the last 5 years.
So now I am nervous to build a new version just in case there are changes to the code which were not checked back into the repository.
I have generated to code using the ILSpy installation and a quick visual comparison of a couple of modules showed they were the same, but doing this for the whole application would be laborious, and likely to miss things, given the size of the code base. I have now installed ILSpy as an extension into Visual Studio 2019 but am not sure if or how to compare the code in the solution to the code in ILSpy.
Can someone tell me if its possible to compare the two code versions? (ILSpy vs TFS)
And if so, how I go about doing it?

[christophwille]

This is problematic at best - ILSpy never generates the "original" code. So even on unchanged code you will see differences. This problem gets worse when different compiler versions are used.

[dgrunwald]

Diffing the original code against the ILSpy-generated code will show lots of differences, as there's often multiple ways to express the same code (e.g. early return vs. if around remainder of method).

My suggestion:

1. Compile the code you have into another assembly, so that you have two executables from_code.exe and existing.exe
2. Decompile both executables with ILSpy using right click>Save Code on the assembly node (from_code.exe->from_code.csproj and existing.exe->existing.csproj)
3. Diff the two ILSpy-generated projects.
4. If there are a lot of changes that don't change the semantics of the code (e.g. local variables inlined into the following statement; or same control flow expressed in a different way), go back to step 1 but use a different compiler version / different debug/release setting.

Once you compile from_code.exe with the same compiler version+settings as were used to build existing.exe, you should get the clean diff you want.
You can also try enabling the option "Always inline local variables if possible" in ILSpy's decompiler settings; I think with that option enabled you should get fewer differences if the compiler doesn't match.