Advertisement
1 / 25

Disassembling for Fun


Disassembling for Fun. Jason Haley . Who is this guy?. Certifiable (MCSD.net certified that is) Blog – http://jasonhaley.com/blog Co-leader of Beantown .Net User Group Member of Boston Area Code Brew A nerd dinner organizer for Boston area TA for Programming .Net at Harvard

Presentation posted in : General

Download Presentation

Disassembling for Fun

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other sites. SlideServe reserves the right to change this policy at anytime.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.











- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -




Presentation Transcript


Disassembling for fun l.jpg

Disassembling for Fun

Jason Haley


Who is this guy l.jpg

Who is this guy?

  • Certifiable (MCSD.net certified that is)

  • Blog – http://jasonhaley.com/blog

  • Co-leader of Beantown .Net User Group

  • Member of Boston Area Code Brew

  • A nerd dinner organizer for Boston area

  • TA for Programming .Net at Harvard

  • Sr. Software Engineer - Cheshire Software


Disassembling is useful l.jpg

Disassembling is useful

  • See how efficient a compiler is

  • Translate IL to a higher level language

  • View all pieces of an assembly

  • Extract resources

  • Edit source code to recompile


Example of disassembling l.jpg

Example of disassembling

  • What is Round-tripping?

  • Demos: ILDasm, Reflector


Agenda l.jpg

Agenda

  • Define disassembling

  • Applied disassembling

  • Writing a disassembler


What is disassembling l.jpg

What is disassembling?

  • Disassembling is not reflection

    Demos: WinCV, Asmex

  • Disassemble or decompile

    Demos: ILDasm, Reflector


Agenda7 l.jpg

Agenda

  • Define disassembling

  • Applied disassembling

  • Writing a disassembler


What is in an assembly file l.jpg

What is in an assembly file?

  • PE/COFF File

  • CLR Header

  • Metadata

  • IL code


Pe file l.jpg

PE File

  • Portable Executable File Format

    PE/COFF headers

    Data directories

    Sections

  • Demos: Dumpbin, .Net Explorer


Clr header l.jpg

CLR Header

  • Contains CLR specific information

    “Required runtime” version

    Metadata location

    Managed resources location

    Strong name signature location

  • Demo: .Net Explorer


Metadata l.jpg

Metadata

  • Assembly metadata

    Metadata header

    Metadata streams (tables and heaps)

  • Demos: Monodis, Asmex, Spices.Net


Il code l.jpg

IL Code

  • Recognizing the pieces

    Metadata table contents

    Metadata heap contents

    IL code

  • Demos: Metadata diagram, ILDasm, Dis#


Disassemblers decompilers l.jpg

Disassemblers/Decompilers

  • ILDasm

  • Monodis

  • DILE – Dotnet IL Editor

  • Reflector for .Net

  • Asmex – Free source .Net Assembly Examiner

  • Dis# - .Net decompiler

  • .Net Explorer

  • Spices.Net


Dile dotnet il editor l.jpg

DILE – Dotnet IL Editor

  • Open source (Zsolt Petreny) – http://sourceforge.net/projects/dile

  • Disassembles to IL

  • Quick search for name and tokens

  • Debugger functionality – can debug IL!

  • Demo: Debugging IL vs. Assembler


Reflector for net l.jpg

Reflector for .Net

  • Lutz Roeder – http://www.aisto.com/roeder/dotnet

  • Great code browsing tool

  • Add-ins created by community - http://csharp21.tripod.com/ReflectorAddIns

  • Demo: Reflector and its add-ins


Asmex assembly examiner l.jpg

Asmex – Assembly Examiner

  • Free source (Ben Peterson) - http://www.jbrowse.com/products/asmex/

  • Graphical representation

  • Most pieces of an assembly

  • Demo: Look at the code


Agenda17 l.jpg

Agenda

  • Define disassembling

  • Applied disassembling

  • Writing a disassembler


Writing a disassembler l.jpg

Writing a disassembler

  • PE/COFF File

  • CLR Header

  • Metadata

  • IL Code


Pe file19 l.jpg

PE File

  • Finding the PE header

    Signatures (MS-DOS, PE)

    Necessary structures

  • Demos: Vijay


Clr header20 l.jpg

CLR Header

  • Finding the CLR Header

    Need information from PE Header

    Calculate the offset in file

  • Demos: Vijay


Metadata21 l.jpg

Metadata

  • Tables are a “normalized database”

  • Heaps

    String – zero-terminated character

    GUID – 16 byte binary objects

    Blob – binary object, preceded by its length

  • Manifest

  • Demos: metainfo, Vijay


Il code22 l.jpg

IL Code

  • Getting to the IL code

    Signatures

    RVA

    Method format (tiny or fat)

    Method data section

    Exception handling clause (small or fat)

  • Demos: Dile, Vijay


Summary l.jpg

Summary

  • What is disassembling?

  • What is a disassembler and what can it do for you?

  • Where can I find a disassembler?

  • What are some of the things you need to know to write your own disassembler?

  • Why do you care?


Resources l.jpg

Resources

  • Inside Microsoft .Net IL Assembler – Serge Lidin

  • Standard ECMA-335 – CLI – http://ecma-international.org/publications/standards/Ecma-335.htm

  • Metadata diagram - Chris King

  • .Net SDK (especially ILDasm)


Questions l.jpg

Questions

?