Returned directory
This chapter providesIlasm--MsilA basic overview of the compilation language. (MsilIndicatesMicrosoftIntermediate Language, which will be discussed later in this chapter .) This chapter reviews a usageIlasmRelatively simple to writeProgramThen, I suggest you make some changes to illustrate how to use them.IlasmIndicatesMicrosoft. NETConcepts and elements in the program.
This chapter does not teach you how to useIlasmWrite a program. But this will help you understandIlasmAndIldasmWhat have you done and how to use your understanding and use these ubiquitous tools to analyze. NetThe internal structure of the program. You will also realize some interesting things inCLRThe mysterious events behind the scenes are quite interesting. I hope this will prompt you to read the rest of the book.
Note:For convenience, I willIlThe compilation language is abbreviatedIlasm. Do not associate itIlasmObfuscation, the latter isIlThe Compiler. NetShort Form in the document.
CLRBasic Concepts
. Net CLRNot only. NetIn many ways. NetCore. (Note that due to semantic diversity, I sometimesCLRIs called runtime .) I will focus on. NetThe part that actually occurs, not about. NetThe full description of the platform.
Note: Obtain information about . Net For more information about the half-structure of its components, see David S. Platt Written 《 Introducing micorsoft. net The third edition ( Microsoft Press, 2003 ), And Tom Archer And Andrew Whitechapel Co-author 《 Inside C # "Version 2 ( Microsoft Press, 2002 ).
In short,CLRYes. NetThe runtime environment where the application is running. It provides. NetAn operational layer between the application and the underlying operating system. Conceptually,CLRSimilar to interpreted language (for exampleGbasic). However, this similarity is only conceptual:CLRIt is not an interpreter.
Oriented. NetCompiler (suchMicrosoft Visual C #,Microsoft Visual Basic. net,IlasmAnd many other compilers ).. NetAn application is represented as an abstract intermediate form without relying on the originalProgramming LanguageThe target machine and its operating system. Because they can be expressed in this abstract form, written in various languages. NetApplications can closely interoperate with each other, not only at the level of mutual call methods, but also at the level of inheritance of classes.
Of course, since the differences between these programming languages are given, it is necessary to establish a set of rules for applications to make these languages work in harmony. For example, if you use C # To write an application, name three entries: myitem, and basic. net is not case sensitive, and it is very difficult to distinguish them. Similarly, if you use ilasm to write a program and define a global method, C # cannot call this method because C # does not have the concept of "global.
This set of rules ensures the interoperability of. NET applications, known as the common language specification (CLS), and its profile is described in the first part of the cli ecma International and ISO standards. CLS limits naming conversions, data types, function types, and other specific elements, forming a common point for different languages. However, it is important to keep in mind that CLS is just a suggestion and does not generate any function on CLR, but you cannot ensure that it can interwork with other applications at all levels.
As A. NET application designed for the CLR environment, this abstract intermediate representation includes two main parts: Metadata and hosting. Code . Metadata is a system composed of descriptors of all structural elements of an application, including classes, their members and features, and global items. Metadata also includes the relationship between these items. This chapter provides some examples of metadata, and the subsequent sections will describe all the metadata structures.
Managed code represents the functionality of the application's methods, which are encoded in an abstract binary format, known as Microsoft's intermediate language (msil) or a common intermediate language (CER ). In short, I abbreviated this encoding as an intermediate language (IL ). Of course, there are other intermediate languages in the world, but what we care about now is that we all think that Il is msil, unless otherwise specified.
CLR manages il code. CLR management includes (but is not limited to) type control, structured exception handling, and garbage collection. Type Control includes validation and conversion of element types during execution. Managed exception handling is functionally similar to "unmanaged" structured exception handling, but it is executed by CLR rather than the operating system. Garbage Collection includes automatic identification and processing of objects that are no longer in use.
A. NET application designed for the CLR environment consists of one or more managed executable bodies, each of which carries metadata and (optional) managed code. Managed code is optional because it is possible to create a managed executable body without any methods. (Obviously, such an executable can only be used as a subsidiary of an application .) The hosted. NET application is called an assembly ". (This statement is a bit simple. For more information about the Assembly and application, see Chapter 6th .) Managed executable bodies involve modules ). You can create single-Module assembly and multi-module assembly. As shown in Figure 1-1, each Assembly includes a main module that carries the Assembly verification information in its metadata.
Figure 1-1 multi-module. Net assembly
Figure 1-1 also shows two main parts of the managed executable body: Metadata and IL code. Two major CLR subsystems: the loader and the JIT (just-in-time) compiler process each part accordingly.
In short, the loader reads the metadata and creates the internal representation and layout of the class and its members in the memory. It is executed on demand, which means that a class is loaded and expressed only when it is referenced. Classes that are not referenced will not be loaded. When a class is loaded, the loader runs a series of consistency checks on the related metadata.
The JIT compiler relies on the results of the loader activity to compile the Il encoding method into the local code of the underlying platform. Because CLR is not an interpreter, it does not execute any il code. In place, the Il code is compiled into the local code in the memory, and the local code is executed. The JIT compiler is also executed on demand, which means that a method is compiled only when called. The compiler method leaves a cache in the memory. If the memory is limited, after all, there are examples of small computing devices, such as a PDA processor or a smart phone. If these methods are not used, they will be destroyed. If a method is called again after it is destroyed, the method will be re-compiled.
Figure 1-2 shows the order in which a hosted. NET application is created and executed. The arrows with hollow circles on the top indicate data transmission. The arrows with black solid circles indicate request and control information.
Figure 1-2 create and execute a hosted. NET application
You can use the ngen tool to pre-compile a hosted executable body, from Il to local code. You can do this by saving the time spent on the JIT compiler when the executable is repeatedly running on the local hard disk. This is a standard process. For example, the managed part of the. NET Framework will be pre-compiled during the installation process. (Tom Archer calls it "code generation during installation "). In this case, the pre-compiled code is saved to the hard disk or other storage media. Each time the executable body is called, the pre-compiled local code version is used instead of the original il version. The original file must also exist because the pre-compiled version must be identified by the original file before it can be executed.
With the determination of metadata and IL code roles, I will introduce you to the method of using ilasm to describe them.