This week I finally submitted my Code Camp 4 topic, which Thom already has out on his site (http://www.thomscontent.com/cc4/default.htm). I titled it “Writing an IL disassembler for fun” ... now I just have to finish it ;)
This weekend's project is decoding Signatures and decompressing (Field, Method, Property, MemberRef, StandAloneSig and TypeSpec tables can all have signatures). A signature is roughly: calling conventions, return types, parameter count and parameter type information all in a byte encoded representation that is sometimes also compressed. I am currently showing the bytes from the blob ... but there is one catch that I'm not currently taking into account in that display -> compression. Right now it isn't a problem with the output because the exe is so small (counts less than 127 are stored as a full byte, which is what I am currently showing). The spec has the following to say about the compression algorithm:
If the first one byte of the 'blob' is 0 bs, then the rest of the 'blob' contains the (bs) bytes of actual data.
If the first two bytes of the 'blob' are 10 bs and x, then the rest of the 'blob' contains the (bs << 8 + x) bytes of actual data.
If the first four bytes of the 'blob' are 110 bs, x, y, and z, then the rest of the 'blob' contains the (bs << 24 + x << 16 + y << 8 + z) bytes of actual data.
For those of you who are curious, you can look at the CorSigUncompressXxx methods in the cor.h file (the code is inlined) to get an understanding of how the spec translates to code ...