Disassembling Intermediate Language Bytecode

This section provides a tutorial example on how to use the .NET Intermediate Language disassembler to disassemble IL bytecode stored in a PE file back to IL source code.

Of course, the .NET IL Disassembler can be used to disassemble the IL bytecode stored in a PE file to IL source code:

1. Open HelloCLR.exe in .NET IL Disassembler.

2. Click "Dump" > "File" in the menu. You will see the "Dump Options" dialog box showing up.

3. Take all default options and click "OK". You will see the "Save As" dialog box showing up.

4. Enter "HelloCLR_dis" as the file name and click "Save". Two files will be generated: "HelloCLR_dis.il" and "HelloCLR_dis.res".

5. Open "HelloCLR_dis.il" in NotePad, you will see the IL source code:

// Microsoft (R) .NET Framework IL Disassembler. Version 2.0.50727.42
// Copyright (c) Microsoft Corporation.  All rights reserved.

// Metadata version: v2.0.50727
.assembly extern mscorlib
{
  .publickeytoken = (B7 7A 5C 56 19 34 E0 89 )            // .z\V.4..
  .ver 2:0:0:0
}
.assembly HelloCLR
{
  .custom instance void [mscorlib]System.Runtime.CompilerServices...
  .custom instance void [mscorlib]System.Runtime.CompilerServices...

  .hash algorithm 0x00008004
  .ver 0:0:0:0
}
.module HelloCLR.exe
// MVID: {14AAFB90-AC8E-4A34-84CB-1B9D2888C6E2}
.imagebase 0x00400000
.file alignment 0x00000200
.stackreserve 0x00100000
.subsystem 0x0003       // WINDOWS_CUI
.corflags 0x00000001    //  ILONLY
// Image base: 0x032C0000


// =============== CLASS MEMBERS DECLARATION ===================

.class private auto ansi beforefieldinit HelloCLR
       extends [mscorlib]System.Object
{
 .method public hidebysig static void  Main() cil managed
 {
  .entrypoint
  // Code size       23 (0x17)
  .maxstack  8
  IL_0000:  nop
  IL_0001:  ldstr      "Hello CLR {0}!"
  IL_0006:  call       class [mscorlib]System.Version 
                          [mscorlib]System.Environment::get_Version()
  IL_000b:  callvirt   instance string 
                          [mscorlib]System.Object::ToString()
  IL_0010:  call       void [mscorlib]System.Console::WriteLine(
                          string, object)
  IL_0015:  nop
  IL_0016:  ret
 } // end of method HelloCLR::Main

 .method public hidebysig specialname rtspecialname 
         instance void  .ctor() cil managed
 {
  // Code size       7 (0x7)
  .maxstack  8
  IL_0000:  ldarg.0
  IL_0001:  call       instance void [mscorlib]System.Object::.ctor()
  IL_0006:  ret
 } // end of method HelloCLR::.ctor

} // end of class HelloCLR

// =============================================================
// *********** DISASSEMBLY COMPLETE ***********************
// WARNING: Created Win32 resource file C:\herong\HelloCLR_dis.res

Very cool. You can learn some basics of IL (Intermediate Language) now by looking at this source code.

Last update: 2010.

Table of Contents

 About This Book

 Introduction of C# (C Sharp)

 Data Type and Variables

 Logical Expressions and Conditional Statements

 Arrays and Loop Statements

 Data Type Features

 Floating-Point Data Types

 Passing Parameters to Methods

 Execution Environment Class

 Visual C# 2010 Express Edition

 Class Features

C# Compiler and Intermediate Language

 Compiling and Running C# Programs

 Compilation - Converting Source Code to Bytecode

 .NET Intermediate Language Disassembler

 CLR Based PE (Portable Executable) Files

Disassembling Intermediate Language Bytecode

 Assembling Intermediate Language Source Code

 Compiling C# Source Code Files

 MSBuild - Microsoft Build Engine

 Memory Usages of Processes

 Multithreading in C#

 Async Feature from C# 5

 System.IO.FileInfo Class

 System.Diagnostics.FileVersionInfo Class

 WPF - Windows Presentation Foundation

 Partial Classes and Partial Methods

 Outdated Tutorials

 References

 PDF Printing Version