0

When I compile a c# code, it compiles into a .NET executable, that only imports _CorExeMain from mscoree.dll, now my questions are :

  1. Is _CorExeMain the interpreter that fetches ILs and executes their corresponding x86 code just like VMprotect?

  2. Where are the IL bytes actually stored? they seem to be stored in the .text section, but I couldn't find any tool that can find the location that they are stored. Where are they stored?

Connell.O'Donnell
  • 3,603
  • 11
  • 27
  • 61
Notoriouss
  • 82
  • 9
  • See [How can I view MSIL / CIL generated by C# compiler? ...](https://stackoverflow.com/questions/3326571/how-can-i-view-msil-cil-generated-by-c-sharp-compiler-why-is-it-called-assemb) and the many links under it. – dxiv Feb 14 '21 at 05:50
  • @dxiv thanks but that doesn't answer my questions, specially where can i find the IL bytes exactly? i know its probably in text section, but how can i find the location? – Notoriouss Feb 14 '21 at 08:26
  • You have [ilspy](https://github.com/icsharpcode/ILSpy) mentioned there, which is an open source decompiler. Then [other](https://www.ntcore.com/files/dotnetformat.htm) [info](https://www.red-gate.com/simple-talk/blogs/anatomy-of-a-net-assembly-pe-headers/) and [tools](https://ntcore.com/?page_id=388). Also, you should clarify the "where" in the question, whether you mean the offset of the .NET section in .text or something else. – dxiv Feb 14 '21 at 08:45
  • @dxiv yes i have worked with DNspy and ilspy, again i want to know how can i find it myself, meaning when i write a tool that dumps the IL bytes, how can i find them? – Notoriouss Feb 14 '21 at 08:52
  • Still not clear what you mean by "IL bytes", whether code alone, or metadata, or anything IL related. Whichever one, you should be able to locate ready-made code for it in the ilspy sources. – dxiv Feb 14 '21 at 09:13
  • [ILSpy](https://github.com/icsharpcode/ILSpy) is open source. Presumably this tool can navigate a managed assembly and locate the IL code. If you want to do the same you could copy that code. If instead you'd much rather understand the platform, get a book like *"CLR via C#"*. – IInspectable Feb 14 '21 at 11:15
  • @dxiv if you open the .NET exe with IDA, it dissambles the "IL bytes", meaning they are just a bunch of bytes that represents ILs that are used in the executable, where can i find them? – Notoriouss Feb 14 '21 at 12:07
  • [ECMA-335](https://www.ecma-international.org/publications-and-standards/standards/ecma-335/) probably covers that. – IInspectable Feb 14 '21 at 16:22

0 Answers0