Dis/Assembling CIL Code

IL Code

.NET compilers like mcs or mbas do not compile to native code, but to the Common Intermediate Language (CIL). IL code looks like this:

// hello world dissassembled with monodis

.assembly extern mscorlib
{
  .ver 0:0:0:0
}
.assembly 'hello'
{
  .hash algorithm 0x00008004
  .ver  0:0:0:0
}
  .class private auto ansi beforefieldinit Hello
        extends [mscorlib]System.Object
  {

    // method line 1
    .method public hidebysig  specialname  rtspecialname
           instance default void .ctor()  cil managed
    {
        // Method begins at RVA 0x20ec
        // Code size 7 (0x7)
        .maxstack 8
        IL_0000: ldarg.0
        IL_0001: call instance void valuetype [corlib]System.Object::.ctor()
        IL_0006: ret
    } // end of method instance default void .ctor()

    // method line 2
    .method public static
           default void Main()  cil managed
    {
        // Method begins at RVA 0x20f4
        .entrypoint
        // Code size 11 (0xb)
        .maxstack 8
        IL_0000: ldstr "Hello Mono World!"
        IL_0005: call void class [corlib]System.Console::WriteLine(string)
        IL_000a: ret
    } // end of method default void Main()

  } // end of type Hello

There are two Mono tools for using IL code:

• ilasm

  The Mono Assembler can be given disassembled text, and it creates an assembly file. This is very important, because many compilers don’t create the assembly themselves, and depend on this tool. Of course it can be also seen as a form of a compiler.

• monodis

  The Mono Disassembler extracts code like shown above from an assembly.

The Mono Disassembler

The monodis program is used to dump the contents of an ECMA CIL image. You can execute it by typing:

monodis FILE.exe

The following options are supported:

--output=FILENAME

Write output into FILENAME.

--mscorlib

For non-corlib assemblies, use “mscorlib” as the assembly name. This is useful for round-tripping the IL with ilasm.

--assembly

Dumps the contents of the assembly table

--assemblyref

Dumps the contents of the assemblyref table

--classlayout

Dumps the contents of the classlayout table

--constant

Dumps the contents of the constant table

--event

Dumps the contents of the event table

--exported

Dumps the contents of the ExportedTypes table

--fields

Dumps the contents of the fields table

--file

Dumps the contents of the file table

--interface

Dumps the contents of the interface table

--manifest

Dumps the contents of the manifest table.

--memberref

Dumps the contents of the memberref table

--method

Dumps the contents of the method table

--methodsem

Dumps the contents of the methodsem table

--module

Dumps the contents of the module table

--moduleref

Dumps the contents of the moduleref table

--mresources

Dumps embedded managed resources

--param

Dumps the contents of the param table

--property

Dumps the contents of the property table

--propertymap

Dumps the contents of the propertymap table

--typedef

Dumps the contents of the typedef table

--typeref

Dumps the contents of the typeref table If no flags are specified the program dumps the content of the image in a format that can be used to rountrip the code.