Everything starts from IL.

What is IL?

Il is an abbreviation for intermediate language, which is a middle language for converting. NET code into machine language, and therefore the IL language is called anti-assembly.

What are the Il tools?

As the saying goes, 工欲善其事 its prerequisite. Understanding IL begins with the use of tools first. There are a number of different IL tools in the. NET world, including compilers and anti-compilers. The most classic compilation and Decompile tool is the ILASM.exe and ILDASM.exe tools from the. Net framework, along with others, such as Reflector.exe,ilsay.exe and so on.

Introduction to specific IL directives

To understand the instructions for IL, we start with a very simple program with the following source code:

Using System;

Namespace HelloWorld
{
public class Program
{
static void Main (string[] args)
{
Console.WriteLine ("Hello world!");
}
}
}

I'm sure you'll be familiar with this code. However, for the compiled executable file, apply the ILDasm.exe anti-compilation tool, revert to the text MSIL encoding, the compiled IL structure, contains the manifest and HelloWorld classes, as shown in:

Where manifest is an additional information table that contains some of the properties of the Assembly, such as the assembly name, version number, hash algorithm, assembly module, and so on, as well as references to external reference assemblies, and we will focus on the Hello world class to introduce the IL directive.

The first is the Hello World type, and the IL code is as follows:

>.class indicates that HelloWorld is a class that inherits from the System.Object class mscorlib the external assembly.

>public for access control permissions, which means that there is no limit to access members with the highest access rights.

>auto indicates that the layout of the memory when the program is loaded is determined by the CLR, not the program itself.

The >.ansi property is designed to seamlessly transform between unmanaged and unmanaged code. Without the managed code, the value is code that is not running on top of the CLR runtime, such as the original c,c++ code.

The >.beforefieldinit property provides an additional information for HelloWorld that marks the runtime to execute a type constructor method at any time, as long as the method executes before it accesses its static field for the first time. If there is no beforefieldinit, the runtime must execute the constructor method at an exact time, thereby affecting performance optimizations.

Then there is the. ctor method, the code is as follows:

　　

The >.cil managed describes the IL code in the method body, indicating that the compiler compiles to managed code.

>.maxstack indicates the execution of the constructor. The evaluation stack during ctor can hold the maximum number of data items. About the evaluation stack, which holds the value of the variable required by the method and empties at the end of the method execution, or stores a return value.

. il_0000, which is the beginning of a tag line, in general, the part before the IL_ tag is the declaration and initialization of the variable.

>.ldarg.0 (ldarg, load argument) indicates that the first member parameter is loaded, that the value in the instance method is a reference to the current instance, and that the reference will be used in the accumulate constructor for the call.

The >.call directive is typically used to invoke static methods, because static methods are specified at compile time, where call is not called a static method, but rather a constructor. ctor () is also specified at compile time, while another instruction callvirt means invoking an instance method. Its invocation process is different from call, when the function is called at run time to determine whether the called function is a virtual function, if it is not directly called, if it is to check whether the subclass is reproduced, if there is a call to rewrite the implementation, if not also call the original function.

>.ret indicates that execution is complete and returned.

Finally, the main method, the code is as follows:

　　

The >.entrypoint directive indicates that the CLR loader HelloWorld.exe is first executed from the. EntryPoint method, which means that the main method will act as the entry function for the program. There is no managed program that must have only one entry program. This differs from the main function as a program entry flag.

The >.ldstr (that is, the load string) instruction represents a stack of strings, "Hello world! The string will be moved to the top of the stack. The CLR constructs a string object by getting literal constants from the metadata table.

The >.hidebysig property is used to indicate that a method in a class does not inherit from the quilt class if the current class is a parent class. Therefore, the main method is not visible in the HelloWorld subclass.

For comments, comments in the IL code are the same as those in high-level languages such as C #.

Reference:

The. Net you must know

Everything starts from IL.