如何以编程方式在 .Net 可执行文件/dll 中查找字节码 (CIL)？
我想打开一个 PE 文件（我知道它是一个 .Net 程序集）并查找 .Net 字节码所在的位置（最好从入口点开始）。我知道 PE 头数据（入口点 RVA）将我带到一个从 mscoree.dll 调用 CorExeMain 的存根。
但这不是我要找的。我想找到由 mscorlib 运行的字节码。我如何使用 C++ 来做到这一点，并且没有像 ildasm、dumpbin 等外部工具？我已经可以解析 PE 标头并知道图像基/RVA 的含义。我只是不知道在哪里可以找到有关 IL 字节码位置的足够信息。
I would like to open a PE file (which i know is a .Net assembly) and find where the .Net bytecode is (ideally starting at the entrypoint). I know that the PE header data (entrypoint RVA) take me just to a stub which calls CorExeMain from mscoree.dll.
This is not what i'm looking for though. I would like to find the bytecode that gets run by mscorlib. How can i do that using C++ and no external tools like ildasm, dumpbin etc. ? I can already parse the PE header and know what image base/RVA means. I just cannot figure out where to find sufficient info about the location of the IL bytecode.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
查看 ECMA-335 - 的详细信息文件格式位于分区 II 的 22-25 部分。我似乎记得不久前我尝试编写解析器时发现了一些错误，但只要有一点毅力，这一切都是可行的。
Have a look at ECMA-335 - the details of the file format are in there, in partition II section 22-25. I seem to remember finding a few bugs in it when I tried to write a parser a while ago, but with a bit of perseverance it's all doable.
我可能会从 mono (cil_coff.h, pedump.c）而不是从头开始编写一个。
I would probably grab the code from mono (cil_coff.h, pedump.c) rather than writing one from scratch.
在 Windows 上，有一个 COM API，IMetaDataImport（由 IMetaDataImport2 扩展）支持泛型）。但其使用示例却相当缺乏。看似不太维护但开源的 IL 调试器/编辑器 dile （仅支持.NET 4（每周构建中）使用它，因此您可以查看它的代码。 Dile 的作者也写了一篇关于使用该 API 的博客文章，但内容相当冗长。由于垃圾邮件规则，未提供链接。谷歌搜索“从程序集中读取类型”。
.NET SDK 附带的微软 mdbg 也使用它。不幸的是，mdbg 源代码仅针对 .NET 2.0 版本发布。谷歌搜索 mdbgSample21.EXE。
On Windows, there's a COM API for it, IMetaDataImport (extended by IMetaDataImport2 with support for generics). Examples of its use are rather lacking though. The seemingly not-so-maintained but open source IL debugger/editor dile (only supports .NET 4 so-so in weekly builds) uses it, so you could check out its code. Dile's author also wrote a blog post on using that API as well, but it's rather winded. Link not given because of spam rules. Google for "Reading types from assembly".
Microsoft's mdbg, which comes with .NET SDK also uses it. Unfortunately, the mdbg sources have been released only for the .NET 2.0 version. Google for mdbgSample21.EXE.