Advertisement
1 / 25

Disassembling for Fun


Who is this guy?. Certifiable (MCSD.net certified that is)Blog

Download Presentation

Disassembling for Fun

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use only and may not be sold or licensed nor shared on other sites. SlideServe reserves the right to change this policy at anytime.While downloading, If for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.











- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -




Presentation Transcript


Disassembling for fun l.jpg

Disassembling for Fun

Jason Haley


Who is this guy l.jpg

Who is this guy?

  • Certifiable (MCSD.net certified that is)

  • Blog – http://jasonhaley.com/blog

  • Co-leader of Beantown .Net User Group

  • Member of Boston Area Code Brew

  • A nerd dinner organizer for Boston area

  • TA for Programming .Net at Harvard

  • Sr. Software Engineer - Cheshire Software


Disassembling is useful l.jpg

Disassembling is useful

  • See how efficient a compiler is

  • Translate IL to a higher level language

  • View all pieces of an assembly

  • Extract resources

  • Edit source code to recompile


Example of disassembling l.jpg

Example of disassembling

  • What is Round-tripping?

  • Demos: ILDasm, Reflector


Agenda l.jpg

Agenda

  • Define disassembling

  • Applied disassembling

  • Writing a disassembler


What is disassembling l.jpg

What is disassembling?

  • Disassembling is not reflection

    Demos: WinCV, Asmex

  • Disassemble or decompile

    Demos: ILDasm, Reflector


Agenda7 l.jpg

Agenda

  • Define disassembling

  • Applied disassembling

  • Writing a disassembler


What is in an assembly file l.jpg

What is in an assembly file?

  • PE/COFF File

  • CLR Header

  • Metadata

  • IL code


Pe file l.jpg

PE File

  • Portable Executable File Format

    PE/COFF headers

    Data directories

    Sections

  • Demos: Dumpbin, .Net Explorer


Clr header l.jpg

CLR Header

  • Contains CLR specific information

    “Required runtime” version

    Metadata location

    Managed resources location

    Strong name signature location

  • Demo: .Net Explorer


Metadata l.jpg

Metadata

  • Assembly metadata

    Metadata header

    Metadata streams (tables and heaps)

  • Demos: Monodis, Asmex, Spices.Net


Il code l.jpg

IL Code

  • Recognizing the pieces

    Metadata table contents

    Metadata heap contents

    IL code

  • Demos: Metadata diagram, ILDasm, Dis#


Disassemblers decompilers l.jpg

Disassemblers/Decompilers

  • ILDasm

  • Monodis

  • DILE – Dotnet IL Editor

  • Reflector for .Net

  • Asmex – Free source .Net Assembly Examiner

  • Dis# - .Net decompiler

  • .Net Explorer

  • Spices.Net


Dile dotnet il editor l.jpg

DILE – Dotnet IL Editor

  • Open source (Zsolt Petreny) – http://sourceforge.net/projects/dile

  • Disassembles to IL

  • Quick search for name and tokens

  • Debugger functionality – can debug IL!

  • Demo: Debugging IL vs. Assembler


Reflector for net l.jpg

Reflector for .Net

  • Lutz Roeder – http://www.aisto.com/roeder/dotnet

  • Great code browsing tool

  • Add-ins created by community - http://csharp21.tripod.com/ReflectorAddIns

  • Demo: Reflector and its add-ins


Asmex assembly examiner l.jpg

Asmex – Assembly Examiner

  • Free source (Ben Peterson) - http://www.jbrowse.com/products/asmex/

  • Graphical representation

  • Most pieces of an assembly

  • Demo: Look at the code


Agenda17 l.jpg

Agenda

  • Define disassembling

  • Applied disassembling

  • Writing a disassembler


Writing a disassembler l.jpg

Writing a disassembler

  • PE/COFF File

  • CLR Header

  • Metadata

  • IL Code


Pe file19 l.jpg

PE File

  • Finding the PE header

    Signatures (MS-DOS, PE)

    Necessary structures

  • Demos: Vijay


Clr header20 l.jpg

CLR Header

  • Finding the CLR Header

    Need information from PE Header

    Calculate the offset in file

  • Demos: Vijay


Metadata21 l.jpg

Metadata

  • Tables are a “normalized database”

  • Heaps

    String – zero-terminated character

    GUID – 16 byte binary objects

    Blob – binary object, preceded by its length

  • Manifest

  • Demos: metainfo, Vijay


Il code22 l.jpg

IL Code

  • Getting to the IL code

    Signatures

    RVA

    Method format (tiny or fat)

    Method data section

    Exception handling clause (small or fat)

  • Demos: Dile, Vijay


Summary l.jpg

Summary

  • What is disassembling?

  • What is a disassembler and what can it do for you?

  • Where can I find a disassembler?

  • What are some of the things you need to know to write your own disassembler?

  • Why do you care?


Resources l.jpg

Resources

  • Inside Microsoft .Net IL Assembler – Serge Lidin

  • Standard ECMA-335 – CLI – http://ecma-international.org/publications/standards/Ecma-335.htm

  • Metadata diagram - Chris King

  • .Net SDK (especially ILDasm)


Questions l.jpg

Questions

?