220 likes | 318 Views
Practical Disassembling. Jason Haley. Who is this guy?. Certifiable (MCSD.net certified that is) Blog – http://jasonhaley.com/blog Leader of Beantown.Net User Group Member of Boston Area Code Brew NerdDinners.com for Boston area TA for Programming .Net at Harvard
E N D
Practical Disassembling Jason Haley
Who is this guy? • Certifiable (MCSD.net certified that is) • Blog – http://jasonhaley.com/blog • Leader of Beantown.Net User Group • Member of Boston Area Code Brew • NerdDinners.com for Boston area • TA for Programming .Net at Harvard • Sr. Software Engineer - Cheshire Software
Disassembling is useful • View all pieces of an assembly file • View compiled code • Translate IL to a higher level language • See how efficient your code is • Edit IL code to fine tune
Example of disassembling • Is disassembling complicated? • Demo: Reflector or ILDasm
Agenda • Define disassembling • Introduce three disassemblers • Dive into disassembling
What is disassembling? • Disassembling is not reflection • Disassemble or decompile? • Demos: ILDasm, Reflector
What is an assembly file? • PE/COFF Information • Metadata • IL code • Demo: ILDasm
Agenda • Define disassembling • Introduce three disassemblers • Dive into disassembling
ILDasm • MSIL Disassembler – Comes with the .Net Framework SDK • Disassembles to IL • Designed to create valid input for ILasm • Demo: Look at the application
Reflector for .Net • Lutz Roeder – http://www.aisto.com/roeder/dotnet • Great code browsing tool • Add-ins created by community - http://www.aisto.com/incoming/Reflector/AddIns/ • Demo: Reflector and its add-ins
DILE – Dotnet IL Editor • Open source (Zsolt Petreny) – http://sourceforge.net/projects/dile • Disassembles to IL • Quick search for name and tokens • Debugger functionality • Debug IL • Attach to running process • Demo: Look at the application
Agenda • Define disassembling • Introduce three disassemblers • Dive into Disassmbling
Taking assemblies apart • Unmanaged parts • Managed parts • Demos: Reflector, ILDasm
Round tripping assemblies • What is it? • Why would you want to do it? • Demos: ILDasm, Reflector, AL
Stepping through assemblies • Debugging third party assemblies • VS.Net – the Assembler experience • DILE – the IL experience • Demo: VS.Net, DILE
Should you protect your code? • Managed resources • Disassemble or decompile not necessary • Strong name signing • Demo: RFE, ILDasm
Some protection options • Server side • Sell source • Encryption • Fingerprint or watermark • Obfuscation • Demo: Dotfuscator
Summary • What is disassembling and decompiling? • Is disassembling hard? • What is a disassembler and what can it do for you? • What are some options to protect your code? • Why do you care?
Resources • .Net SDK (especially ILDasm) • Reflector - http://www.aisto.com/roeder/dotnet/ • DILE - http://sourceforge.net/projects/dile • Standard ECMA-335 – CLI – http://ecma-international.org/publications/standards/Ecma-335.htm • CIL Programming by Jason Bock
Disassemblers/Decompilers • ILDasm • Reflector for .Net • DILE – Dotnet IL Editor • Monodis • Asmex – Free source .Net Assembly Examiner • Dis# - .Net decompiler • .Net Explorer • Spices.Net
Code protection • Dotfuscator • Salamander .Net Obfuscator and Protector • Demeanor for .Net • CodeVeil • LSW-IL Obfuscator • SecureLM Code Protector • Spices.Net • Decompiler.Net • {smartassembly}