Disassembling .Net Notes: Field Signatures Entries Index

Calling Conventions
Element Types
Vectors and Arrays

Field Signature Examples:

Example 1: Private field of a value type declared in same assembly
Example 2: Decoding a private field signature of a reference type declared in another assembly
Example 3: Decoding a field signature of a generic type declared in another assembly
Example 4: Decoding a field signature of a generic type that is a struct (value type)
Example 5: Decoding a field signature of a generic type with 2 generic arguments
Example 6: Decoding a field signature of a boolean type
Example 7: Decoding a field signature of a char type
Example 8: Decoding a field signature of a SByte type
Example 9: Decoding a field signature of a Byte type
Example 10: Decoding a field signature of a Int16 type
Example 11: Decoding a field signature of a UInt16 type
Example 12: Decoding a field signature of a Int32 type
Example 13: Decoding a field signature of a UInt32 type
Example 14: Decoding a field signature of a Int64 type
Example 15: Decoding a field signature of a UInt64 type
Example 16: Decoding a field signature of a Single type
Example 17: Decoding a field signature of a Double type
Example 18: Decoding a field signature of a IntPtr type
Example 19: Decoding a field signature of a UIntPtr type
Example 20: Decoding a field signature of a Object type
Example 21: Decoding a field signature of a String type
Example 22: Decoding a field signature of a string array (vector)
Example 23: Decoding a field signature of an int array (vector)
Example 24: Decoding a field signature of an array of objects declared in current assembly (vector)
Example 25: Decoding a field signature of an multi-dimensional array of strings
Example 26: Decoding a field signature of an multi-dimensional array of integers
Example 27: Decoding a field signature of an multi-dimensional array of an object declared in the same assembly

Disassembling .Net Notes: Method Signatures Entries Index

Method Signatures
Constraint Flags
Example 28: Decoding a method signature that is an instance method with no parameters and void return type
Example 29: Decoding a method signature with 1 parameter with a return type of int
Example 30: Decoding a method signature with 1 parameter with a return type of a class declared in current assembly
Example 31: Decoding a method signature with 1 Generic Parameter and return type of void
Example 32: Decoding a method signature with 1 Generic Parameter (with a constraint), 1 parameter and a return type of a type declared in the assembly
Example 33: Decoding a method signature with variable arguments and a void return type
Example 34: Decoding a method signature with a params string array parameter and a void return type
Example 35: Decoding a call site signature for a Generic method
Example 36: Decoding a call site signature for a Varargs method

Disassembling .Net Notes: Property Signatures Entries Index

Property Signatures
Example 37: Static Read-only string Property
Example 38: Instance Read/Write class property
Example 39: Instance Read/Write Indexer property
Example 40: Automatic Implemented Property

Resources

Blogs
http://blogs.msdn.com/joelpob/default.aspx
http://pzsolt.blogspot.com/
http://blogs.msdn.com/matt_pietrek/default.aspx

Websites
http://sourceforge.net/projects/dile/
http://vijaymukhi.com/documents/books/metadata/contents.htm
http://vijaymukhi.com/documents/books/ildasm/ildasm.htm
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/html/cpconInsideNETFramework.asp
http://www.ecma-international.org/publications/standards/Ecma-335.htm
http://www.mono-project.com/Cecil (added 1/29/06)

Articles
http://blogs.msdn.com/joelpob/archive/2004/09/22/233121.aspx
http://www.codeproject.com/dotnet/asmex.asp
http://bschwehn.de/ICeeFileGenPart1.html
http://msdn.microsoft.com/msdnmag/issues/1000/metadata/default.aspx
http://msdn.microsoft.com/msdnmag/issues/02/02/PE/default.aspx
http://www.blong.com/Conferences/DCon2003/ReverseEngineering/ReverseEngineering.htm
http://wiki.cs.uiuc.edu/cs427/.Net+CLR+Internals#CoReMet
http://www.zyloid.com/recomposer/files/diss.pdf

Newsgroups
http://www.gotdotnet.com/Community/MessageBoard/MessageBoard.aspx?id=2838 (added 1/29/06)- MSIL

Presentations
http://www.iunknown.com/Files/metadata_internals.pdf - Metadata Internals, by John Lam
http://www.clevelanddotnet.info/presentations/UnderstandingMSIL.ppt - Understanding MSIL, by Sam Nasr
http:/www.migang.org/LinkClick.aspx?link=obfuscation2.ppt&mid=354 - Creating a .Net Obfuscator: File Structure, IL, Obfuscation and Fingerprinting in .Net Executables, Godfrey Nolan
http://pllab.cs.nthu.edu.tw/cs3404/slides/MSIL_CLR_20050602.ppt - MSIL & CLI, by Kuen-Yuan Shieh
http:/www.msakademik.net/academicdays2005/Serge_Lidin.ppt - IL Assembler Today and Tomorrow, Serge Lidin

Books
Applied Microsoft .Net Framework - Jeffrey Richter
Inside Microsoft .Net IL Assembler - Serge Lidin
Shared Source CLI Essentials - David Stutz, Ted Neward, Geoff Shilling
CIL Programming: Under the Hood of .Net - Jason Bock (added 9/10/05)
Reversing: Secrets of Reverse Engineering - Eldad Eilam (added 9/10/05)
Decompiling Java (added 1/29/06)

Disassemblers/Decompilers/Explorers/Browsers (most found via - SharpTool Box and Proogram-Transformation.org)
http://sourceforge.net/projects/dile - DILE
http://www.aisto.com/roeder/dotnet/ - Reflector
http://www.strangelights.com/Fsharp/callgraph.aspx - Assembly Explorer
http://www.oaklandsoftware.com/product_1.html - .Net Component Inspector
http://www.remotesoft.com/dotexplorer/ - Remotesoft .Net Explorer
http://www.lesser-software.com/en/content/products/LSW%20DotNet-Tools/LSW_DotNet_Reflection_Browser.htm - LSW DotNet- Reflection - Browser
http://www.jbrowse.com/products/asmex/ - ASMEX
http://www.solishine.com/Home/Products/SoliNav/tabid/54/Default.aspx - SoliNav
http://www.codeproject.com/csharp/controlinspector.asp - ControlInspector
http://www.sliver.com/dotnet/statebrowser/ - Object State Browser
http://www.netdecompiler.com/ - Dis#
http://www.smidgeonsoft.prohosting.com/pebrowse-pro-interactive-debugger.html - PEBrowse Professional Interactive Debugger
Mono's IL disassembler - monodis - Has some nice command line parameters that allow you to only output specific metadata table contents
http://www.remotesoft.com/salamander/ - Remotesoft .Net Decompiler
http://www.saurik.com/net/exemplar/ - Anakrino (the original open source .Net Decompiler, which I don't believe is active right now ...)
http://www.9rays.net/cgi-bin/components.cgi?act=1&cid=86 - Spices.Net