1. By Sam Nasr September 28, 2004 Understanding MSIL

2. Objectives Learn MSIL terminology Learn MSIL terminology Understand sections of an Assembly Understand sections of an Assembly Discuss IL Tools Discuss IL Tools Discuss additional resources Discuss additional resources

3. Advantages of Understanding MSIL Better understanding=Better troubleshooting. Better understanding=Better troubleshooting. Understanding of possible security vulnerabilities. Understanding of possible security vulnerabilities. All roads lead to CLR All roads lead to CLR

4. Definitions CLR: Common Language Runtime CLR: Common Language Runtime Assembly: Managed.Net application. Assembly: Managed.Net application. Each assembly contains minimum 1 prime module, but possibly other additional modules. Each assembly contains minimum 1 prime module, but possibly other additional modules. Module: Managed executable Module: Managed executable

5. Definitions Metadata: Data descriptors (i.e. info that describes the data). Metadata: Data descriptors (i.e. info that describes the data). MSIL: Microsoft Intermediate Language MSIL: Microsoft Intermediate Language ILDASM: Intermediate Language Disassembler. ILDASM: Intermediate Language Disassembler.

6. Background Compiling in a.Net Framework (IL, similar to JVM) VS. Compiling in a traditional environment (native executable code)

7. Execution in.Net.Net Applications (assemblies) consist of one or more managed executables, each carrying metadata and managed code..Net Applications (assemblies) consist of one or more managed executables, each carrying metadata and managed code. JIT Compiler compiles IL to machine code dynamically as needed. JIT Compiler compiles IL to machine code dynamically as needed. Objects are loaded only when used. Objects are loaded only when used. Machine code compilations are cached for subsequent executions. Machine code compilations are cached for subsequent executions.

8. Execution in.Net Code is executed in Managed Environment (type control, garbage collection, exception handling). Code is executed in Managed Environment (type control, garbage collection, exception handling). Can compile from IL to native machine code using NGEN utility. Can compile from IL to native machine code using NGEN utility. Cost of Code: (Sizes of Hello World.exe) Cost of Code: (Sizes of Hello World.exe) C#(3K) VS. C(32K) VS. C++(173K)

9. CLR Requirements The CLR requires the following information about each method, which is available through metadata. 1. Instructions: each method has a pointer to the instruction set. 2. Signature: describes the calling convention, return type, parameter count and type

10. CLR Requirements 3. Exception Handling Array: a list of exceptions and the offset address to the handling code. 4. Evaluation Stack Size: typically seen as.maxstack in the ILDASM listing. 5. Locals Array: all local variables used.

11. Example 1. Create a program in Visual Studio.Net 2. Debug and compile. 3. Use ILDASM to generate.IL file. 4. Use file editor to edit.IL file. 5. Use ILASM to create the new assembly.

12. Reading IL RVA: Relative Virtual Address RVA: Relative Virtual Address ldstr: loads a string token ldstr: loads a string token.assembly extern: defines an external application referenced in the existing program..assembly extern: defines an external application referenced in the existing program..module: defines the current module..module: defines the current module..field: defines a metadata item used in the module.field: defines a metadata item used in the module

13. Reading IL.method: defines a member method of the given class..method: defines a member method of the given class..entrypoint: defines the entry point of the current method.entrypoint: defines the entry point of the current method.locals init: defines the single local variable of the current method..locals init: defines the single local variable of the current method.

14. ILDASM Conventions

15. MSIL Utilities ildasm.exe: Converts IL to human readable code ildasm.exe: Converts IL to human readable code C:\Program Files\Microsoft Visual Studio.NET\ FrameworkSDK\Bin dumpbin.exe: Converts IL to human readable code dumpbin.exe: Converts IL to human readable code C:\Program Files\Microsoft Visual Studio.NET\Vc7\bin Reflector.exe: Converts IL to human readable code Reflector.exe: Converts IL to human readable code http://www.aisto.com/roeder/dotnet/ ILASM.EXE: Converts human readable code to IL ILASM.EXE: Converts human readable code to ILC:\WINDOWS\Microsoft.NET\Framework\v1.1.4322 NGEN.exe: Compiles IL to machine code. NGEN.exe: Compiles IL to machine code.C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322

16. Resources Inside Microsoft.NET IL Assembler by Serge Lidin Inside Microsoft.NET IL Assembler by Serge Lidin.NET Common Language Runtime Unleashed by Kevin Burton.NET Common Language Runtime Unleashed by Kevin Burton (http://www.samspublishing.com/title/0672321246) http://www.samspublishing.com/title/0672321246 Assemblies Ins and Outs by Chris Rausch (http://www.vbdotnetheaven.com) Assemblies Ins and Outs by Chris Rausch (http://www.vbdotnetheaven.com)http://www.vbdotnetheaven.com DotFuscator DotFuscator (http://www.preemptive.com/products/dotfuscator/FAQ.html) http://www.preemptive.com/products/dotfuscator/FAQ.html