Dis/Assembling CIL Code

IL Code

.NET compilers like mcs or mbas do not compile to native code, but to the Common Intermediate Language (CIL). IL code looks like this:

// hello world dissassembled with monodis

.assembly extern mscorlib
{
  .ver 0:0:0:0
}
.assembly 'hello'
{
  .hash algorithm 0x00008004
  .ver  0:0:0:0
}
  .class private auto ansi beforefieldinit Hello
        extends [mscorlib]System.Object
  {

    // method line 1
    .method public hidebysig  specialname  rtspecialname
           instance default void .ctor()  cil managed
    {
        // Method begins at RVA 0x20ec
        // Code size 7 (0x7)
        .maxstack 8
        IL_0000: ldarg.0
        IL_0001: call instance void valuetype [corlib]System.Object::.ctor()
        IL_0006: ret
    } // end of method instance default void .ctor()

    // method line 2
    .method public static
           default void Main()  cil managed
    {
        // Method begins at RVA 0x20f4
        .entrypoint
        // Code size 11 (0xb)
        .maxstack 8
        IL_0000: ldstr "Hello Mono World!"
        IL_0005: call void class [corlib]System.Console::WriteLine(string)
        IL_000a: ret
    } // end of method default void Main()

  } // end of type Hello

There are two Mono tools for using IL code:

ilasm
The Mono Assembler can be given disassembled text, and it creates an assembly file. This is very important, because many compilers don’t create the assembly themselves, and depend on this tool. Of course it can be also seen as a form of a compiler.

monodis
The Mono Disassembler extracts code like shown above from an assembly.

The Mono Disassembler

The monodis program is used to dump the contents of an ECMA CIL image. You can execute it by typing:

monodis FILE.exe

The following options are supported:

--output=FILENAME
Write output into FILENAME.

--mscorlib
For non-corlib assemblies, use “mscorlib” as the assembly name. This is useful for round-tripping the IL with ilasm.

--assembly
Dumps the contents of the assembly table

--assemblyref
Dumps the contents of the assemblyref table

--classlayout
Dumps the contents of the classlayout table

--constant
Dumps the contents of the constant table

--event
Dumps the contents of the event table

--exported
Dumps the contents of the ExportedTypes table

--fields
Dumps the contents of the fields table

--file
Dumps the contents of the file table

--interface
Dumps the contents of the interface table

--manifest
Dumps the contents of the manifest table.

--memberref
Dumps the contents of the memberref table

--method
Dumps the contents of the method table

--methodsem
Dumps the contents of the methodsem table

--module
Dumps the contents of the module table

--moduleref
Dumps the contents of the moduleref table

--mresources
Dumps embedded managed resources

--param
Dumps the contents of the param table

--property
Dumps the contents of the property table

--propertymap
Dumps the contents of the propertymap table

--typedef
Dumps the contents of the typedef table

--typeref
Dumps the contents of the typeref table If no flags are specified the program dumps the content of the image in a format that can be used to rountrip the code.