220 likes | 335 Views
Disassembling for Fun. Jason Haley. Who is this guy?. Certifiable (MCSD.net certified that is) Blog – http://jasonhaley.com/blog Co-leader of Beantown .Net User Group Member of Boston Area Code Brew A nerd dinner organizer for Boston area Sr. Software Engineer - Cheshire Software.
E N D
Disassembling for Fun Jason Haley New England Code Camp IV: “Developer’s Gone Wild”
Who is this guy? • Certifiable (MCSD.net certified that is) • Blog – http://jasonhaley.com/blog • Co-leader of Beantown .Net User Group • Member of Boston Area Code Brew • A nerd dinner organizer for Boston area • Sr. Software Engineer - Cheshire Software New England Code Camp IV: “Developer’s Gone Wild”
Disassembling is useful • See how efficient a compiler is • Translate IL to a higher level language • View all pieces of an assembly • Extract resources • Edit source code to recompile New England Code Camp IV: “Developer’s Gone Wild”
Example of disassembling • What is Round-tripping? • Demos: ILDasm, Reflector New England Code Camp IV: “Developer’s Gone Wild”
Agenda • Define disassembling • Applied disassembling • Writing a disassembler New England Code Camp IV: “Developer’s Gone Wild”
What is disassembling? • Disassembling is not reflection Demos: WinCV, Asmex • Disassemble or decompile Demos: ILDasm, Reflector New England Code Camp IV: “Developer’s Gone Wild”
Agenda • Define disassembling • Applied disassembling • Writing a disassembler New England Code Camp IV: “Developer’s Gone Wild”
What is in an assembly file? • PE/COFF File • CLR Header • Metadata • IL code New England Code Camp IV: “Developer’s Gone Wild”
PE File • Portable Executable File Format PE/COFF headers Data directories Sections • Demos: Dumpbin, .Net Explorer New England Code Camp IV: “Developer’s Gone Wild”
CLR Header • Contains CLR specific information “Required runtime” version Metadata location Managed resources location Strong name signature location • Demo: .Net Explorer New England Code Camp IV: “Developer’s Gone Wild”
Metadata • Assembly metadata Metadata header Metadata streams (tables and heaps) • Demos: Monodis, Asmex New England Code Camp IV: “Developer’s Gone Wild”
IL Code • Recognizing the pieces Metadata table contents Metadata heap contents IL code • Demos: ILDasm, Spices.Net, Dis# New England Code Camp IV: “Developer’s Gone Wild”
Agenda • Define disassembling • Applied disassembling • Writing a disassembler New England Code Camp IV: “Developer’s Gone Wild”
Writing a disassembler • PE/COFF File • CLR Header • Metadata • IL Code New England Code Camp IV: “Developer’s Gone Wild”
PE File • Finding the PE header Signatures (MS-DOS, PE) Necessary structures • Demos: Vijay New England Code Camp IV: “Developer’s Gone Wild”
CLR Header • Finding the CLR Header Need information from PE Header Calculate the offset in file • Demos: Vijay New England Code Camp IV: “Developer’s Gone Wild”
Metadata • Tables are a “normalized database” • Heaps String – zero-terminated character GUID – 16 byte binary objects Blob – binary object, preceded by its length • Manifest • Demos: metainfo, Vijay New England Code Camp IV: “Developer’s Gone Wild”
IL Code • Getting to the IL code Signatures RVA Method format (tiny or fat) Method data section Exception handling clause (small or fat) • Demos: Dile, Vijay New England Code Camp IV: “Developer’s Gone Wild”
Summary • What is disassembling? • What is a disassembler and what can it do for you? • What are some of the things you need to know to write your own disassembler? • Why do you care? New England Code Camp IV: “Developer’s Gone Wild”
Resources • Inside Microsoft .Net IL Assembler – Serge Lidin • Standard ECMA-335 – CLI – http://ecma-international.org/publications/standards/Ecma-335.htm • Metadata diagram - Chris King • .Net SDK (especially ILDasm) New England Code Camp IV: “Developer’s Gone Wild”
Questions ? New England Code Camp IV: “Developer’s Gone Wild”