Managed PE File

Intermediate language

In the. NET Framework, the common Language Infrastructure uses the CLS to bind different languages. The common language infrastructure allows different languages to be used, by requiring a different language to implement at least the part of the CTS contained in the CLS. NET Framework. Therefore, in the. NET Framework, all languages (C #, vb.net, effil.net, etc.) are eventually converted to a common language: Microsoft intermediate Language (Microsoft intermediate Language,msil, hereinafter referred to as IL).

Il is an intermediate language between high-level languages and intel-based Assembly languages, and is the assembly language of the. NET Platform. When the user compiles one. NET program, the compiler translates the source code into a set of instructions that can be effectively converted to native code and independent of the CPU. When these instructions are executed, the Just-in-time compiler converts them to CPU-specific code. Because the CLR supports multiple real-time compilers, the same section of IL code can be compiled and run on different structures in real time by different compilers.

Il includes instructions for loading, storing, and initializing objects and invoking methods on objects, as well as instructions for arithmetic and logical operations, control flow, direct memory access, exception handling, and other operations. For code to run, you must first convert IL to CPU-specific code, which is usually done through the Just-in-time (JIT) compiler. Because the CLR provides one or more JIT compilers for each of the computer structures it supports, the same set of IL can be JIT-compiled and run on any supported structure.

When the compiler produces IL, it also produces metadata. The metadata describes the types in the code, including the definition of each type, the signature of the members of each type, the members of the Code reference, and other data that the runtime uses when executing. Il and metadata are included in a portable executable (PE) file, and the following focuses on the managed PE file, as well as the knowledge about the metadata.

1.3.1 Managed PE File

PE (Portable execute, portable executable) is a program file on the Microsoft Windows operating system, common as EXE, DLL, OCX, SYS, COM. Figure 1-3 shows the standard Pe/coff file header format.

Figure 1-3 Standard Pe/coff file header format

MS DOS Head is the genetic content of a DOS system, which means that an application can operate in a DOS environment. MS DOS Root is a piece of code that, if a Windows program runs in a DOS environment, gives a hint that "the program cannot run in a DOS environment" (This is cannot to run in DOS mode). At the offset 0x3c, the MS dos header points to the address of the PE identity (PE Signature).

The PE identity indicates that the file is a PE file. The value is always 00004550h,45h representing the character e,50h representing the character p.

The COFF header (COFF header) provides the most general information about the COFF or executable file.

The PE header (PE header) provides the information required by the operating system to load files. This is the most important place for a PE file, which includes data index tables and sections.

For more information on the standard PE file, please read the relevant information, this section is only concerned about the specific content of the managed PE file. The CLR extends the traditional PE file as shown in Figure 1-4, which is the format of the managed PE file.

Figure 1-4 Format of a managed PE file

The standard Windows PE file header is similar to the COFF (Common Object file format) header, divided into PE32 and pe32+ two. If the file header is in PE32 format, the file can run on a 32-bit or 64-bit operating system. If the file header is in pe32+ format, the file can only run on a 64-bit operating system. PE32 or pe32+ headers also contain file type information: GUI, Cui, or DLLs. If the module contains local CPU code, the PE32 or pe32+ header will contain information about the local CPU code.

The CLR header contains information that enables this module to be hosted. This information includes the version information required by the CLR, some identification, metadata information for the entry method, metadata location and size information for the module, resource information, strong name, and some other information.

Each managed module contains a metadata table. There are two kinds of metadata tables, one is the metadata table describing the type description and the member description in the source code, the other is the metadata table containing the type description and the member description of the source code reference.

The IL code is the intermediate code that is generated by compiler compilation, and the CLR is responsible for compiling the intermediate code to execute the cost code when the program runs.