|
|
|---|---|
|
|
 难免有误,,大家请批评,附件:a1.rar
|
|
|
学习
|
|
|
第二篇.IL汇编,,
在第一篇(是凑数的..  )有了对il汇编的了解,,偶只是简单的说一下il汇编结构,,不是讲解.net 大家记得.NET 反编译工具ildasm,,大家可以反编译,熟悉熟悉il汇编虚拟指令 详细的il汇编虚拟指令说明在: 522K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3#2K6k6r3&6Q4x3X3g2E0K9h3y4J5L8%4y4G2k6Y4c8Q4x3X3g2U0L8$3#2Q4x3V1k6D9K9h3u0J5j5i4u0&6i4K6u0r3j5$3S2K6i4K6u0r3k6r3g2X3j5i4g2D9N6q4)9J5k6h3q4K6M7q4)9K6c8Y4g2J5L8q4)9K6c8q4)9J5c8X3I4A6j5Y4u0S2M7Y4W2Q4x3V1k6o6d9q4y4Q4x3V1k6U0M7s2u0W2k6W2)9J5c8X3S2@1L8h3I4Q4x3V1k6X3M7X3I4J5k6Y4y4&6M7%4c8W2L8i4u0W2k6X3I4W2j5%4c8A6L8$3&6W2L8h3W2@1L8%4m8U0L8$3c8W2M7$3y4D9j5i4y4K6j5Y4u0X3j5h3I4K6k6g2)9#2k6Y4y4@1L8%4m8A6j5#2)9J5k6h3q4K6M7l9`.`. 下面 Win Form il 汇编如下(有些特性,偶也是用ildasm反编译,加ilasm正向编译得到的): .assembly extern System.Windows.Forms { .publickeytoken = (B7 7A 5C 56 19 34 E0 89 ) .ver 1:0:5000:0 } .assembly extern System { .publickeytoken = (B7 7A 5C 56 19 34 E0 89 ) .ver 1:0:5000:0 } .assembly extern mscorlib { .publickeytoken = (B7 7A 5C 56 19 34 E0 89 ) .ver 1:0:5000:0 } .assembly extern System.Drawing { .publickeytoken = (B0 3F 5F 7F 11 D5 0A 3A ) .ver 1:0:5000:0 } .assembly HelloIL { .custom instance void [mscorlib]System.Reflection.AssemblyCopyrightAttribute::.ctor(string) = ( 01 00 00 00 00 ) .custom instance void [mscorlib]System.Reflection.AssemblyKeyNameAttribute::.ctor(string) = ( 01 00 00 00 00 ) .custom instance void [mscorlib]System.Reflection.AssemblyKeyFileAttribute::.ctor(string) = ( 01 00 00 00 00 ) .custom instance void [mscorlib]System.Reflection.AssemblyDelaySignAttribute::.ctor(bool) = ( 01 00 00 00 00 ) .custom instance void [mscorlib]System.Reflection.AssemblyTrademarkAttribute::.ctor(string) = ( 01 00 00 00 00 ) .custom instance void [mscorlib]System.Reflection.AssemblyConfigurationAttribute::.ctor(string) = ( 01 00 00 00 00 ) .custom instance void [mscorlib]System.Reflection.AssemblyCompanyAttribute::.ctor(string) = ( 01 00 00 00 00 ) .custom instance void [mscorlib]System.Reflection.AssemblyProductAttribute::.ctor(string) = ( 01 00 00 00 00 ) .custom instance void [mscorlib]System.Reflection.AssemblyDescriptionAttribute::.ctor(string) = ( 01 00 00 00 00 ) .custom instance void [mscorlib]System.Reflection.AssemblyTitleAttribute::.ctor(string) = ( 01 00 00 00 00 ) .hash algorithm 0x00008004 .ver 1:0:2078:25277 } .mresource public HelloIL.Form1.resources{} .module HelloIL.exe .imagebase 0x00400000 .subsystem 0x00000002 .file alignment 4096 .corflags 0x00000001 .namespace HelloIL { .class public auto ansi beforefieldinit Form1 extends [System.Windows.Forms]System.Windows.Forms.Form { .field private class [System]System.ComponentModel.Container components .method public hidebysig specialname rtspecialname instance void .ctor() cil managed { .maxstack 2 ldarg.0 ldnull stfld class [System]System.ComponentModel.Container HelloIL.Form1::components ldarg.0 call instance void [System.Windows.Forms]System.Windows.Forms.Form::.ctor() ldarg.0 call instance void HelloIL.Form1::InitializeComponent() ret } .method family hidebysig virtual instance void Dispose(bool disposing) cil managed { .maxstack 2 ldarg.1 brfalse.s IL_jmp1 ldarg.0 ldfld class [System]System.ComponentModel.Container HelloIL.Form1::components brfalse.s IL_jmp1 ldarg.0 ldfld class [System]System.ComponentModel.Container HelloIL.Form1::components callvirt instance void [System]System.ComponentModel.Container::Dispose() IL_jmp1: ldarg.0 ldarg.1 call instance void [System.Windows.Forms]System.Windows.Forms.Form::Dispose(bool) ret } .method private hidebysig instance void InitializeComponent() cil managed { .maxstack 4 ldarg.0 ldc.i4.6 ldc.i4.s 14 newobj instance void [System.Drawing]System.Drawing.Size::.ctor(int32,int32) callvirt instance void [System.Windows.Forms]System.Windows.Forms.Form::set_AutoScaleBaseSize(valuetype [System.Drawing]System.Drawing.Size) ldarg.0 ldc.i4 0x108 ldc.i4 0xa6 newobj instance void [System.Drawing]System.Drawing.Size::.ctor(int32,int32) call instance void [System.Windows.Forms]System.Windows.Forms.Form::set_ClientSize(valuetype [System.Drawing]System.Drawing.Size) ldarg.0 ldstr "Form1" call instance void [System.Windows.Forms]System.Windows.Forms.Control::set_Name(string) ldarg.0 ldstr "HelloIL" callvirt instance void [System.Windows.Forms]System.Windows.Forms.Control::set_Text(string) ret } .method private hidebysig static void Main() cil managed { .entrypoint .custom instance void [mscorlib]System.STAThreadAttribute::.ctor() = ( 01 00 00 00 ) .maxstack 1 newobj instance void HelloIL.Form1::.ctor() call void [System.Windows.Forms]System.Windows.Forms.Application::Run(class [System.Windows.Forms]System.Windows.Forms.Form) ret } } } il虚拟汇编指令偶不想注释了...大家可以到 7d5K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3#2K6k6r3&6Q4x3X3g2E0K9h3y4J5L8%4y4G2k6Y4c8Q4x3X3g2U0L8$3#2Q4x3V1k6D9K9h3u0J5j5i4u0&6i4K6u0r3j5$3S2K6i4K6u0r3k6r3g2X3j5i4g2D9N6q4)9J5k6h3q4K6M7q4)9K6c8Y4g2J5L8q4)9K6c8q4)9J5c8X3I4A6j5Y4u0S2M7Y4W2Q4x3V1k6o6d9q4y4Q4x3V1k6U0M7s2u0W2k6W2)9J5c8X3S2@1L8h3I4Q4x3V1k6X3M7X3I4J5k6Y4y4&6M7%4c8W2L8i4u0W2k6X3I4W2j5%4c8A6L8$3&6W2L8h3W2@1L8%4m8U0L8$3c8W2M7$3y4D9j5i4y4K6j5Y4u0X3j5h3I4K6k6g2)9#2k6Y4y4@1L8%4m8A6j5#2)9J5k6h3q4K6M7l9`.`. 在msdn中 il opcode 说明很详细,,大家可以慢慢翻译.... 用 ilasm 编译 它成功之后,,就出出现一个win form 窗口程序,,很幼稚, 错误很多,大家请指正哈..
|
|
|
|
|
|
支持wei哥
学习一下。
|
|
|
|
|
|
最初由 qiweixue 发布 文章不错，为了以后阅读方便，将2篇主题合并。这样也能提高这帖的人气。 
|
|
|
学习...
|
|
|
|
|
|
学习学习~
|
|
|
|
|
|
支持
|
|
|
老7越来越猛烈了。
.net的IL早就出来了，不过用心研究的人不多阿。以后可以顺便研究反编译或者花指令之类。哈哈
|
|
|
|
|
|
|
|
|
支持校友！！
|
|
|
看不懂 但是支持7哥！！！！
|
|
|
|
