730 likes | 1.06k Views
.NET. Matthew Conover May 2002. What is .NET?. .NET = dumb name .NET is a framework .NET is OS and platform independent .NET is language-insensitive .NET specs are publicly available. Topics of Discussion. Introduction to .NET Assemblies and Metadata Microsoft’s implementation of .NET
E N D
.NET Matthew Conover May 2002
What is .NET? • .NET = dumb name • .NET is a framework • .NET is OS and platform independent • .NET is language-insensitive • .NET specs are publicly available
Topics of Discussion • Introduction to .NET • Assemblies and Metadata • Microsoft’s implementation of .NET • .NET Hook Library (dotNetHookLibrary)
Introduction to .NET • .NET Specifications • Partition I – Architecture • Partition II – Metadata • Partition III – Common Intermediate Language • Partition IV – Library • Partition V – Annexes • Class Library (XML specification)
Introduction to .NET • Base Class Library (BCL) • Shared among all languages • Common Language Runtime (CLR) • Hosts managed code
Introduction to .NETBase Class Library • Similar to Java’s System namespace. • Used by all .NET applications • Has classes for IO, threading, database, text, graphics, console, sockets/web/mail, security, cryptography, COM, run-time type discovery/invocation, assembly generation
Introduction to .NET • Common Language Runtime (CLR) • Common Type System (CTS) • Execution Engine (EE)
Introduction to .NETCommon Language Runtime • Common Type System • Specifies certain types required to be hosted by CLR • Specifies rules for class, struct, enums, interface, delegate, etc. • Everything is actually an object
Introduction to .NETCommon Language Runtime • Execution Engine • Compiles Microsoft Intermediate Language (MSIL) into native code • Handles garbage collection • Handles exceptions • Enforces code access security (sandbox) • Handles verification • Managed v. Unmanaged
Introduction to .NET Assembly BCL Class Loader External Assembly JIT CLR Machine Code
Assemblies • .NET Library/Executable (PE file format) • Single-file or multi-file assemblies • Modular design • Eliminates DLL problems • Locations resolved at runtime • Components: • Metadata • MSIL (or native) code
AssembliesPhysical Layout Single-file Assembly MSDOS Header PE Header PE Section Headers Includes .NET Header Code section .text (includes Metadata) Data section .rsrc or .data Relocations section .reloc or .rdata
Assemblies • .NET Executable (PE file format) • Single-file or multi-file assemblies • Modular design • Components: • Metadata • MSIL (or native) code
AssembliesMetadata • Contains all .NET application data • Very revealing! • Needed for MSIL compilation • Assembly can be converted to native format • Streams or heaps (sections of related data)
AssembliesMetadata Signature, Version, Flags Stream count (n) Metadata Header Data offset Stream size Name (variable length) Stream Header 1 … Stream Header n … Stream bodies 1-n
AssembliesStreams • #Strings (a.k.a. strings heap) • Array of strings • #US (a.k.a. user strings heap) • Array of strings used by application at runtime • #GUID • Array of GUIDs (16 bytes each) • #Blob • Contains compressed binary data • #- or #~ • Contains tables of methods, fields, etc.
Assemblies#~ and #- Stream Version Heap sizes Valid tables (n) Tables Header Table row count Valid Table 1 … Valid Table n … Tables 1-n
AssembliesTables in #~/#- Stream • In a predefined order • MethodDef = table 6 • Param table = table 8 • Each table contains specific types • MethodDef = method definitions • TypeDef = type definitions • AssemblyRef = assemblies references • Tables interact with each other • Tables interact with certain heaps
AssembliesSample - MethodDef Table Relative Virtual Address (RVA) Offset to method Implementation flags Method flags Method name offset In #Strings Method signature offset In #Blob Parameters index In Param table
AssembliesSample - MethodDef Table Param Table Flags Sequence number Parameter name offset In #Strings Method Signature Blob Flags Parameter count Return type Parameter types
AssembliesSample - func(int arg) MethodDef Param func arg #Strings … … “func” “arg” … #Blob func method signature arg type signature …
Assemblies • .NET Executable (PE file format) • Single-file or multi-file assemblies • Components: • Metadata • MSIL (or native) code
AssembliesMSIL • Pseudo-assembly • Converted into native code • Object “aware” intermediate language • Examples: nop, break, ret, call, callvirt, newobj, newarr, add, mul, xor, arglist, sizeof, throw, catch, dup • Supports up to 512 opcodes • 0xFE = first byte of two byte opcodes • All calls are stack-based
AssembliesCall Stack MSIL C# ` ldc.i4.1 ldc.i4.2 call ClassType::func(Int32, Int32) ClassType a; a.func(1, 2) 1 2 this pointer Stack top Left-to-right ordering
Assemblies • Sample IL
AssembliesMSIL • Uses “tokens” instead of pointers MSIL Assembler 0x1f 0x09 0x28 0x06000006 ldc.i4.s 9 call Print(Int32) Method token
AssembliesTokens • A replacement for pointers • References a row in a table Token Table Number Row Index Upper 8 bits Lower 24 bits
AssembliesMSIL Samples • ld = load on stack, st = store from stack • stloc • Stores a value from the stack into local variable • ldarg • Puts an argument on the stack • ldelem • Puts the value of an element on the stack
Microsoft’s .NET Implementation • File locations • System libraries • .NET application flow
Microsoft’s .NET ImplementationFile Locations • Framework: %SystemRoot%\Microsoft.NET • Global Assembly Cache (GAC): %SystemRoot%\Assembly + • \GAC • \NativeImages*
Microsoft’s .NET Implementation • File locations • System libraries • .NET application flow
Microsoft’s .NET ImplementationSystem Libraries • mscoree.dll (execution engine) • mscorwks.dll (does most initialization) • mscorjit.dll (contains JIT) • mscorlib.dll (BCL) • fusion.dll (assembly binding)
Microsoft’s .NET ImplementationSystem Libraries mscoree.dll mscorwks.dll fusion.dll mscorlib.dll mscorjit.dll
Microsoft’s .NET Implementation • File locations • System libraries • .NET application flow
Microsoft’s .NET Implementation.NET Application Flow Application mscoree.dll Entry point _CorExeMain Main mscorwks.dll _CorExeMain CoInitializeEE
Microsoft’s .NET Implementation.NET Application Flow • Jumps to _CorExeMain (mscoree) • Calls _CorExeMain in mscorwks.dll • _CorExeMain calls CoInitializeEE • CoInitializeEE calls: • EEStartup • ExecuteEXE
EEStartup • GCHeap.Initialize • ECall.Init • SetupGenericPInvokeCalliStub • PInvokeCalliWorker • NDirect.Init • UMThunkInit.UMThunkInit • COMDelegate.Init • ExecutionManger.Init • COMNlsInfo.InitializeNLS
EEStartup (cont.) • Security::Start • SystemDomain.Init • SystemDomain.NotifyProfilerStartup (ICorProfiler) • SystemDomain.NotifyNewDomainLoads • SystemDomain.PublishAppDomainAndInformDebugger (ICorPublish/ICorDebug)
SystemDomain.Init • LoadBaseSystemClasses • SystemDomain.CreatePreallocatedExceptions
LoadBaseSystemClasses • SystemDomain.LoadSystemAssembly • Loads mscorlib.dll • Binder::StartupMscorlib • Binder::FetchClass(OBJECT) • MethodTable::InitForFinalization • InitJITHelpers2 • Binder::FetchClass(VALUE) • Binder::FetchClass(ARRAY)
LoadBaseSystemClasses • Binder.FetchType(OBJECT_ARRAY) • Binder.FetchClass(STRING) • Binder.FetchClass(ENUM) • Binder.FetchClass(ExceptionClass) • Binder.FetchClass(OutOfMemoryExceptionClass) • Binder.FetchClass(StackOverflowExceptionClass)
LoadBaseSystemClasses • Binder.FetchClass(ExecutionEngineExceptionClass) • Binder.FetchClass(DelegateClass) • Binder.FetchClass(MultiDelegateClass)
.NET Application Flow • Jumps to _CorExeMain (mscoree) • Calls _CorExeMain in mscorwks.dll • _CorExeMain calls CoInitializeEE • CoInitializeEE calls: • EEStartup • ExecuteEXE
ExecuteEXE • StrongNamesignatureVerification • In mscorsn.dll • PEFile::Create • Loads executable • ExecuteMainMethod • FusionBind.CreateFusionName • Assembly.ExecuteMainMethod
ExecuteMainMethod • Thread.EnterRestrictiedContext • PEFile::GetMDImport • SystemDomain.SetDefaultDomainAttributes • Sets entry point • SystemDomain.InitializeDefaultDomain • BaseDomain.LoadAssembly
ExecuteEXE • StrongNamesignatureVerification • In mscorsn.dll • PEFile::Create • Loads executable • ExecuteMainMethod • FusionBind.CreateFusionName • Assembly.ExecuteMainMethod
Assembly.ExecuteMainMethod • Assembly::GetEntryPoint • ClassLoader::ExecuteMainMethod • EEClass:FindMethod(entry point token)
EEClass.FindMethod • ValidateMainMethod • CorCommandLine.GetArgvW • MethodDesc.Call • MethodDesc.IsRemotingIntercepted • MethodDesc.CallDescr calls MethodDesc.CallDescrWorker • CallDescrWorker calls Main()
.NET Application • Main() needs to be compiled • Main() calls PreStubWorker (mscorwks) • PreStubWorker • Compiles all MSIL methods • Calls MethodDesc.DoPrestub
MethodDesc.DoPrestub • MethodDesc.GetSecurityFlags • MethodDesc.GetUnsafeAddrofCode • MethodDesc.GetILHeader • MethodDesc.GetRVA • COR_DECODE_METHOD • Decode tiny/fat format • Security._CanSkipVerification