Download

Disassembling for Fun






Advertisement
/ 25 []
Download Presentation
Comments
mare
From:
|  
(1161) |   (0) |   (0)
Views: 97 | Added:
Rate Presentation: 0 0
Description:
Disassembling for Fun. Jason Haley . Who is this guy?. Certifiable (MCSD.net certified that is) Blog – http://jasonhaley.com/blog Co-leader of Beantown .Net User Group Member of Boston Area Code Brew A nerd dinner organizer for Boston area TA for Programming .Net at Harvard
Disassembling for Fun

An Image/Link below is provided (as is) to

Download Policy: Content on the Website is provided to you AS IS for your information and personal use only and may not be sold or licensed nor shared on other sites. SlideServe reserves the right to change this policy at anytime. While downloading, If for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.











- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -




Disassembling for fun l.jpgSlide 1

Disassembling for Fun

Jason Haley

Who is this guy l.jpgSlide 2

Who is this guy?

  • Certifiable (MCSD.net certified that is)

  • Blog – http://jasonhaley.com/blog

  • Co-leader of Beantown .Net User Group

  • Member of Boston Area Code Brew

  • A nerd dinner organizer for Boston area

  • TA for Programming .Net at Harvard

  • Sr. Software Engineer - Cheshire Software

Disassembling is useful l.jpgSlide 3

Disassembling is useful

  • See how efficient a compiler is

  • Translate IL to a higher level language

  • View all pieces of an assembly

  • Extract resources

  • Edit source code to recompile

Example of disassembling l.jpgSlide 4

Example of disassembling

  • What is Round-tripping?

  • Demos: ILDasm, Reflector

Agenda l.jpgSlide 5

Agenda

  • Define disassembling

  • Applied disassembling

  • Writing a disassembler

What is disassembling l.jpgSlide 6

What is disassembling?

  • Disassembling is not reflection

    Demos: WinCV, Asmex

  • Disassemble or decompile

    Demos: ILDasm, Reflector

Agenda7 l.jpgSlide 7

Agenda

  • Define disassembling

  • Applied disassembling

  • Writing a disassembler

What is in an assembly file l.jpgSlide 8

What is in an assembly file?

  • PE/COFF File

  • CLR Header

  • Metadata

  • IL code

Pe file l.jpgSlide 9

PE File

  • Portable Executable File Format

    PE/COFF headers

    Data directories

    Sections

  • Demos: Dumpbin, .Net Explorer

Clr header l.jpgSlide 10

CLR Header

  • Contains CLR specific information

    “Required runtime” version

    Metadata location

    Managed resources location

    Strong name signature location

  • Demo: .Net Explorer

Metadata l.jpgSlide 11

Metadata

  • Assembly metadata

    Metadata header

    Metadata streams (tables and heaps)

  • Demos: Monodis, Asmex, Spices.Net

Il code l.jpgSlide 12

IL Code

  • Recognizing the pieces

    Metadata table contents

    Metadata heap contents

    IL code

  • Demos: Metadata diagram, ILDasm, Dis#

Disassemblers decompilers l.jpgSlide 13

Disassemblers/Decompilers

  • ILDasm

  • Monodis

  • DILE – Dotnet IL Editor

  • Reflector for .Net

  • Asmex – Free source .Net Assembly Examiner

  • Dis# - .Net decompiler

  • .Net Explorer

  • Spices.Net

Dile dotnet il editor l.jpgSlide 14

DILE – Dotnet IL Editor

  • Open source (Zsolt Petreny) – http://sourceforge.net/projects/dile

  • Disassembles to IL

  • Quick search for name and tokens

  • Debugger functionality – can debug IL!

  • Demo: Debugging IL vs. Assembler

Reflector for net l.jpgSlide 15

Reflector for .Net

  • Lutz Roeder – http://www.aisto.com/roeder/dotnet

  • Great code browsing tool

  • Add-ins created by community - http://csharp21.tripod.com/ReflectorAddIns

  • Demo: Reflector and its add-ins

Asmex assembly examiner l.jpgSlide 16

Asmex – Assembly Examiner

  • Free source (Ben Peterson) - http://www.jbrowse.com/products/asmex/

  • Graphical representation

  • Most pieces of an assembly

  • Demo: Look at the code

Agenda17 l.jpgSlide 17

Agenda

  • Define disassembling

  • Applied disassembling

  • Writing a disassembler

Writing a disassembler l.jpgSlide 18

Writing a disassembler

  • PE/COFF File

  • CLR Header

  • Metadata

  • IL Code

Pe file19 l.jpgSlide 19

PE File

  • Finding the PE header

    Signatures (MS-DOS, PE)

    Necessary structures

  • Demos: Vijay

Clr header20 l.jpgSlide 20

CLR Header

  • Finding the CLR Header

    Need information from PE Header

    Calculate the offset in file

  • Demos: Vijay

Metadata21 l.jpgSlide 21

Metadata

  • Tables are a “normalized database”

  • Heaps

    String – zero-terminated character

    GUID – 16 byte binary objects

    Blob – binary object, preceded by its length

  • Manifest

  • Demos: metainfo, Vijay

Il code22 l.jpgSlide 22

IL Code

  • Getting to the IL code

    Signatures

    RVA

    Method format (tiny or fat)

    Method data section

    Exception handling clause (small or fat)

  • Demos: Dile, Vijay

Summary l.jpgSlide 23

Summary

  • What is disassembling?

  • What is a disassembler and what can it do for you?

  • Where can I find a disassembler?

  • What are some of the things you need to know to write your own disassembler?

  • Why do you care?

Resources l.jpgSlide 24

Resources

  • Inside Microsoft .Net IL Assembler – Serge Lidin

  • Standard ECMA-335 – CLI – http://ecma-international.org/publications/standards/Ecma-335.htm

  • Metadata diagram - Chris King

  • .Net SDK (especially ILDasm)

Questions l.jpgSlide 25

Questions

?


Copyright © 2014 SlideServe. All rights reserved | Powered By DigitalOfficePro