Home All Groups Group Topic Archive Search About

Programmatically analyzing IL code

Author
9 Jun 2006 3:00 PM
robert_m_hooker
Hi All,

I'm attempting to write a very basic 'Assebmly standards & policies
checker' for in-house use. This tool would open an assembly, and scan
it for a handful of specific conformance issues we need to adhere too.
Essentially, I'd be scanning the assembly for specific groups of IL
codes and specific calls into other assemblies.

Looking at the many many 'decompiler' tools out there - I can see that
this sort of thing is possible, since they do it (plus far far more -
like actually decompiling, which I don't want or need).

Does anyone know of any sample source code, or reference materials that
will help get me started? Reflection.Emit looked promising, but that
seems to be for creating assemblies - rather than analyzing existing
ones...?

Sample sourcecode for a 'very basic decompiler' would be ideal, since
it would have exactly what I'm after probably...


Any help would be MUCH appreciated!
Rob

Author
9 Jun 2006 3:26 PM
Lou Zher
This is exactly what FxCop is designed to do and it is extensible.
http://www.gotdotnet.com/team/fxcop
-LZ

<robert_m_hoo***@bigfoot.com> wrote in message
Show quote
news:1149865210.065400.288560@f6g2000cwb.googlegroups.com...
> Hi All,
>
> I'm attempting to write a very basic 'Assebmly standards & policies
> checker' for in-house use. This tool would open an assembly, and scan
> it for a handful of specific conformance issues we need to adhere too.
> Essentially, I'd be scanning the assembly for specific groups of IL
> codes and specific calls into other assemblies.
>
> Looking at the many many 'decompiler' tools out there - I can see that
> this sort of thing is possible, since they do it (plus far far more -
> like actually decompiling, which I don't want or need).
>
> Does anyone know of any sample source code, or reference materials that
> will help get me started? Reflection.Emit looked promising, but that
> seems to be for creating assemblies - rather than analyzing existing
> ones...?
>
> Sample sourcecode for a 'very basic decompiler' would be ideal, since
> it would have exactly what I'm after probably...
>
>
> Any help would be MUCH appreciated!
> Rob
>
Author
11 Jun 2006 4:18 PM
Tomer Gabel
You might be trying to do the 'wrong thing.' Why are you trying to work an
actual IL? Wouldn't it be easier to work on the source level -- there are
terrific automatic tools to help you do just that (like FxCop which Lou
mentioned?)

If you're adamant about parsing IL, you might want to do some research into
..NET diassemblers (there might be an integrable diassembler package, or a
freely available IL parser) or just write your own parser. IL isn't all that
complex - certainly easier than parsing C# - but don't expect it to be a
piece of cake.

<robert_m_hoo***@bigfoot.com> wrote in message
Show quote
news:1149865210.065400.288560@f6g2000cwb.googlegroups.com...
> Hi All,
>
> I'm attempting to write a very basic 'Assebmly standards & policies
> checker' for in-house use. This tool would open an assembly, and scan
> it for a handful of specific conformance issues we need to adhere too.
> Essentially, I'd be scanning the assembly for specific groups of IL
> codes and specific calls into other assemblies.
>
> Looking at the many many 'decompiler' tools out there - I can see that
> this sort of thing is possible, since they do it (plus far far more -
> like actually decompiling, which I don't want or need).
>
> Does anyone know of any sample source code, or reference materials that
> will help get me started? Reflection.Emit looked promising, but that
> seems to be for creating assemblies - rather than analyzing existing
> ones...?
>
> Sample sourcecode for a 'very basic decompiler' would be ideal, since
> it would have exactly what I'm after probably...
>
>
> Any help would be MUCH appreciated!
> Rob
>
Author
12 Jun 2006 4:34 AM
Greg Young
There are a couple pre-done IL parsers. MS Research has one if you want to
use F#, the mono project also has a really nice one.

I would however think FxCop can be used for this.


Show quote
"Tomer Gabel" <tomer at tomergabel dot com> wrote in message
news:uYTM1KXjGHA.4056@TK2MSFTNGP02.phx.gbl...
> You might be trying to do the 'wrong thing.' Why are you trying to work an
> actual IL? Wouldn't it be easier to work on the source level -- there are
> terrific automatic tools to help you do just that (like FxCop which Lou
> mentioned?)
>
> If you're adamant about parsing IL, you might want to do some research
> into .NET diassemblers (there might be an integrable diassembler package,
> or a freely available IL parser) or just write your own parser. IL isn't
> all that complex - certainly easier than parsing C# - but don't expect it
> to be a piece of cake.
>
> <robert_m_hoo***@bigfoot.com> wrote in message
> news:1149865210.065400.288560@f6g2000cwb.googlegroups.com...
>> Hi All,
>>
>> I'm attempting to write a very basic 'Assebmly standards & policies
>> checker' for in-house use. This tool would open an assembly, and scan
>> it for a handful of specific conformance issues we need to adhere too.
>> Essentially, I'd be scanning the assembly for specific groups of IL
>> codes and specific calls into other assemblies.
>>
>> Looking at the many many 'decompiler' tools out there - I can see that
>> this sort of thing is possible, since they do it (plus far far more -
>> like actually decompiling, which I don't want or need).
>>
>> Does anyone know of any sample source code, or reference materials that
>> will help get me started? Reflection.Emit looked promising, but that
>> seems to be for creating assemblies - rather than analyzing existing
>> ones...?
>>
>> Sample sourcecode for a 'very basic decompiler' would be ideal, since
>> it would have exactly what I'm after probably...
>>
>>
>> Any help would be MUCH appreciated!
>> Rob
>>
>
>
Author
12 Jun 2006 1:44 PM
robert_m_hooker
Thanks all for your replies.

Unfortunately, we don't think we can use FxCop, or any other source
level tool, since the assemblies we need to analyze are not 'ours'.
They are written externally, to work with our system, but we need to
programmatically verify that they are - and are not - calling certain
methods of ours and in certain orders etc. We'll potentially need to do
this verfification "live" and "in the field" so to speak, on a end
users machine (rejecting the assembly if it 'fails').

I've searched for the 'pre-done' IL parsers - F# and the mono project
one. I'm not having any luck finding IL parsers though...

Does anyone have any explicit links handy?

Cheers
Rob

Greg Young wrote:
Show quote
> There are a couple pre-done IL parsers. MS Research has one if you want to
> use F#, the mono project also has a really nice one.
>
> I would however think FxCop can be used for this.
>
>
> "Tomer Gabel" <tomer at tomergabel dot com> wrote in message
> news:uYTM1KXjGHA.4056@TK2MSFTNGP02.phx.gbl...
> > You might be trying to do the 'wrong thing.' Why are you trying to work an
> > actual IL? Wouldn't it be easier to work on the source level -- there are
> > terrific automatic tools to help you do just that (like FxCop which Lou
> > mentioned?)
> >
> > If you're adamant about parsing IL, you might want to do some research
> > into .NET diassemblers (there might be an integrable diassembler package,
> > or a freely available IL parser) or just write your own parser. IL isn't
> > all that complex - certainly easier than parsing C# - but don't expect it
> > to be a piece of cake.
> >
> > <robert_m_hoo***@bigfoot.com> wrote in message
> > news:1149865210.065400.288560@f6g2000cwb.googlegroups.com...
> >> Hi All,
> >>
> >> I'm attempting to write a very basic 'Assebmly standards & policies
> >> checker' for in-house use. This tool would open an assembly, and scan
> >> it for a handful of specific conformance issues we need to adhere too.
> >> Essentially, I'd be scanning the assembly for specific groups of IL
> >> codes and specific calls into other assemblies.
> >>
> >> Looking at the many many 'decompiler' tools out there - I can see that
> >> this sort of thing is possible, since they do it (plus far far more -
> >> like actually decompiling, which I don't want or need).
> >>
> >> Does anyone know of any sample source code, or reference materials that
> >> will help get me started? Reflection.Emit looked promising, but that
> >> seems to be for creating assemblies - rather than analyzing existing
> >> ones...?
> >>
> >> Sample sourcecode for a 'very basic decompiler' would be ideal, since
> >> it would have exactly what I'm after probably...
> >>
> >>
> >> Any help would be MUCH appreciated!
> >> Rob
> >>
> >
> >
Author
12 Jun 2006 3:02 PM
Lou Zher
BTW: FxCop is an object-code level tool and works without source code. MSIL
is a lot easier to work with than source code.

If your looking for a disassembler/decompiler, check out Reflector.
http://www.aisto.com/roeder/dotnet/

If you want to verify live calling order, why not create a logging shim
interface on your code?
-LZ

<robert_m_hoo***@bigfoot.com> wrote in message
Show quote
news:1150119872.175834.168890@i40g2000cwc.googlegroups.com...
> Thanks all for your replies.
>
> Unfortunately, we don't think we can use FxCop, or any other source
> level tool, since the assemblies we need to analyze are not 'ours'.
> They are written externally, to work with our system, but we need to
> programmatically verify that they are - and are not - calling certain
> methods of ours and in certain orders etc. We'll potentially need to do
> this verfification "live" and "in the field" so to speak, on a end
> users machine (rejecting the assembly if it 'fails').
>
> I've searched for the 'pre-done' IL parsers - F# and the mono project
> one. I'm not having any luck finding IL parsers though...
>
> Does anyone have any explicit links handy?
>
> Cheers
> Rob
>
> Greg Young wrote:
>> There are a couple pre-done IL parsers. MS Research has one if you want
>> to
>> use F#, the mono project also has a really nice one.
>>
>> I would however think FxCop can be used for this.
>>
>>
>> "Tomer Gabel" <tomer at tomergabel dot com> wrote in message
>> news:uYTM1KXjGHA.4056@TK2MSFTNGP02.phx.gbl...
>> > You might be trying to do the 'wrong thing.' Why are you trying to work
>> > an
>> > actual IL? Wouldn't it be easier to work on the source level -- there
>> > are
>> > terrific automatic tools to help you do just that (like FxCop which Lou
>> > mentioned?)
>> >
>> > If you're adamant about parsing IL, you might want to do some research
>> > into .NET diassemblers (there might be an integrable diassembler
>> > package,
>> > or a freely available IL parser) or just write your own parser. IL
>> > isn't
>> > all that complex - certainly easier than parsing C# - but don't expect
>> > it
>> > to be a piece of cake.
>> >
>> > <robert_m_hoo***@bigfoot.com> wrote in message
>> > news:1149865210.065400.288560@f6g2000cwb.googlegroups.com...
>> >> Hi All,
>> >>
>> >> I'm attempting to write a very basic 'Assebmly standards & policies
>> >> checker' for in-house use. This tool would open an assembly, and scan
>> >> it for a handful of specific conformance issues we need to adhere too.
>> >> Essentially, I'd be scanning the assembly for specific groups of IL
>> >> codes and specific calls into other assemblies.
>> >>
>> >> Looking at the many many 'decompiler' tools out there - I can see that
>> >> this sort of thing is possible, since they do it (plus far far more -
>> >> like actually decompiling, which I don't want or need).
>> >>
>> >> Does anyone know of any sample source code, or reference materials
>> >> that
>> >> will help get me started? Reflection.Emit looked promising, but that
>> >> seems to be for creating assemblies - rather than analyzing existing
>> >> ones...?
>> >>
>> >> Sample sourcecode for a 'very basic decompiler' would be ideal, since
>> >> it would have exactly what I'm after probably...
>> >>
>> >>
>> >> Any help would be MUCH appreciated!
>> >> Rob
>> >>
>> >
>> >
>
Author
20 Jun 2006 9:57 PM
john conwell
Hey Robert,
FxCop doesnt analyze the source files, it parses out the IL and does IL
analysis.

I've done a lot of work in the area your talking about, and IL anaysis is
the way to go.  Otherwise you'd have to write an analysis tool (or parser)
for each language.  Since all langs compile to IL, thats your lowest common
denominator.

FxCop allows you to write custom rules, and you can get at the IL level,
which sounds like what your after.  If you need more control over how you
read the IL, you can cut to the chase and use the Microsoft Common Compiler
Infrastrucure dll (Microsoft.Cci.DLL), which ironically is what FxCop uses
behind the scenes (it ships with FxCop).

A sample piece of code that will get your started is :
string fileName = "DotNetThing.dll";
AssemblyNode assembly = AssemblyNode.GetAssembly(fileName);
foreach (TypeNode type in assembly.Types)
{
    Console.WriteLine(type.FullName);
    foreach (Member member in type.Members)
    {
        Method method = member as Method;
        if (method != null)
        {
            Console.WriteLine(method.FullName);
            foreach (Instruction inst in method.Instructions)
            {
                Console.WriteLine(inst.OpCode.ToString() + " " + inst.Value);
            }                           
        }
    }
}

This will load an assembly, dump out the type name, the method name, and
each opcode and corresponding value of the opcode.

If you want to go the opensource and mono route, then you can use a library
called Cecil (http://www.mono-project.com/Cecil).  I've used Cecil, but I
ended up switching back to CCI instead.  Cecil still has a few bugs and
doesnt play well with all VS2005 assemblies.  Its written specifically for
the Mono compiler.

The last option (that i know of) os a library called the Phoenix Framework,
written by Microsoft Research (http://research.microsoft.com/phoenix/). 
Gives you some crazy control over the assembly, its IL, debug symbols, and
all sorts of other stuff.  For what i needed it was overkill.

Those are your four best options


Show quote
"robert_m_hoo***@bigfoot.com" wrote:

> Thanks all for your replies.
>
> Unfortunately, we don't think we can use FxCop, or any other source
> level tool, since the assemblies we need to analyze are not 'ours'.
> They are written externally, to work with our system, but we need to
> programmatically verify that they are - and are not - calling certain
> methods of ours and in certain orders etc. We'll potentially need to do
> this verfification "live" and "in the field" so to speak, on a end
> users machine (rejecting the assembly if it 'fails').
>
> I've searched for the 'pre-done' IL parsers - F# and the mono project
> one. I'm not having any luck finding IL parsers though...
>
> Does anyone have any explicit links handy?
>
> Cheers
> Rob
>
> Greg Young wrote:
> > There are a couple pre-done IL parsers. MS Research has one if you want to
> > use F#, the mono project also has a really nice one.
> >
> > I would however think FxCop can be used for this.
> >
> >
> > "Tomer Gabel" <tomer at tomergabel dot com> wrote in message
> > news:uYTM1KXjGHA.4056@TK2MSFTNGP02.phx.gbl...
> > > You might be trying to do the 'wrong thing.' Why are you trying to work an
> > > actual IL? Wouldn't it be easier to work on the source level -- there are
> > > terrific automatic tools to help you do just that (like FxCop which Lou
> > > mentioned?)
> > >
> > > If you're adamant about parsing IL, you might want to do some research
> > > into .NET diassemblers (there might be an integrable diassembler package,
> > > or a freely available IL parser) or just write your own parser. IL isn't
> > > all that complex - certainly easier than parsing C# - but don't expect it
> > > to be a piece of cake.
> > >
> > > <robert_m_hoo***@bigfoot.com> wrote in message
> > > news:1149865210.065400.288560@f6g2000cwb.googlegroups.com...
> > >> Hi All,
> > >>
> > >> I'm attempting to write a very basic 'Assebmly standards & policies
> > >> checker' for in-house use. This tool would open an assembly, and scan
> > >> it for a handful of specific conformance issues we need to adhere too.
> > >> Essentially, I'd be scanning the assembly for specific groups of IL
> > >> codes and specific calls into other assemblies.
> > >>
> > >> Looking at the many many 'decompiler' tools out there - I can see that
> > >> this sort of thing is possible, since they do it (plus far far more -
> > >> like actually decompiling, which I don't want or need).
> > >>
> > >> Does anyone know of any sample source code, or reference materials that
> > >> will help get me started? Reflection.Emit looked promising, but that
> > >> seems to be for creating assemblies - rather than analyzing existing
> > >> ones...?
> > >>
> > >> Sample sourcecode for a 'very basic decompiler' would be ideal, since
> > >> it would have exactly what I'm after probably...
> > >>
> > >>
> > >> Any help would be MUCH appreciated!
> > >> Rob
> > >>
> > >
> > >
>
>
Author
21 Jun 2006 1:38 AM
Michael Cummings
Another tool you may want to consider as it complements FxCop is NDepend. It
has a very slick query language you can use to analyze assemblies with.

http://www.ndepend.com/

Show quote
"john conwell" <johnconw***@discussions.microsoft.com> wrote in message
news:D1FDE024-A149-406D-A09E-4FA9241AF4C4@microsoft.com...
> Hey Robert,
> FxCop doesnt analyze the source files, it parses out the IL and does IL
> analysis.
>
> I've done a lot of work in the area your talking about, and IL anaysis is
> the way to go.  Otherwise you'd have to write an analysis tool (or parser)
> for each language.  Since all langs compile to IL, thats your lowest
> common
> denominator.
>
> FxCop allows you to write custom rules, and you can get at the IL level,
> which sounds like what your after.  If you need more control over how you
> read the IL, you can cut to the chase and use the Microsoft Common
> Compiler
> Infrastrucure dll (Microsoft.Cci.DLL), which ironically is what FxCop uses
> behind the scenes (it ships with FxCop).
>
> A sample piece of code that will get your started is :
> string fileName = "DotNetThing.dll";
> AssemblyNode assembly = AssemblyNode.GetAssembly(fileName);
> foreach (TypeNode type in assembly.Types)
> {
> Console.WriteLine(type.FullName);
> foreach (Member member in type.Members)
> {
> Method method = member as Method;
> if (method != null)
> {
> Console.WriteLine(method.FullName);
> foreach (Instruction inst in method.Instructions)
> {
> Console.WriteLine(inst.OpCode.ToString() + " " + inst.Value);
> }
> }
> }
> }
>
> This will load an assembly, dump out the type name, the method name, and
> each opcode and corresponding value of the opcode.
>
> If you want to go the opensource and mono route, then you can use a
> library
> called Cecil (http://www.mono-project.com/Cecil).  I've used Cecil, but I
> ended up switching back to CCI instead.  Cecil still has a few bugs and
> doesnt play well with all VS2005 assemblies.  Its written specifically for
> the Mono compiler.
>
> The last option (that i know of) os a library called the Phoenix
> Framework,
> written by Microsoft Research (http://research.microsoft.com/phoenix/).
> Gives you some crazy control over the assembly, its IL, debug symbols, and
> all sorts of other stuff.  For what i needed it was overkill.
>
> Those are your four best options
>
>
> "robert_m_hoo***@bigfoot.com" wrote:
>
>> Thanks all for your replies.
>>
>> Unfortunately, we don't think we can use FxCop, or any other source
>> level tool, since the assemblies we need to analyze are not 'ours'.
>> They are written externally, to work with our system, but we need to
>> programmatically verify that they are - and are not - calling certain
>> methods of ours and in certain orders etc. We'll potentially need to do
>> this verfification "live" and "in the field" so to speak, on a end
>> users machine (rejecting the assembly if it 'fails').
>>
>> I've searched for the 'pre-done' IL parsers - F# and the mono project
>> one. I'm not having any luck finding IL parsers though...
>>
>> Does anyone have any explicit links handy?
>>
>> Cheers
>> Rob
>>
>> Greg Young wrote:
>> > There are a couple pre-done IL parsers. MS Research has one if you want
>> > to
>> > use F#, the mono project also has a really nice one.
>> >
>> > I would however think FxCop can be used for this.
>> >
>> >
>> > "Tomer Gabel" <tomer at tomergabel dot com> wrote in message
>> > news:uYTM1KXjGHA.4056@TK2MSFTNGP02.phx.gbl...
>> > > You might be trying to do the 'wrong thing.' Why are you trying to
>> > > work an
>> > > actual IL? Wouldn't it be easier to work on the source level -- there
>> > > are
>> > > terrific automatic tools to help you do just that (like FxCop which
>> > > Lou
>> > > mentioned?)
>> > >
>> > > If you're adamant about parsing IL, you might want to do some
>> > > research
>> > > into .NET diassemblers (there might be an integrable diassembler
>> > > package,
>> > > or a freely available IL parser) or just write your own parser. IL
>> > > isn't
>> > > all that complex - certainly easier than parsing C# - but don't
>> > > expect it
>> > > to be a piece of cake.
>> > >
>> > > <robert_m_hoo***@bigfoot.com> wrote in message
>> > > news:1149865210.065400.288560@f6g2000cwb.googlegroups.com...
>> > >> Hi All,
>> > >>
>> > >> I'm attempting to write a very basic 'Assebmly standards & policies
>> > >> checker' for in-house use. This tool would open an assembly, and
>> > >> scan
>> > >> it for a handful of specific conformance issues we need to adhere
>> > >> too.
>> > >> Essentially, I'd be scanning the assembly for specific groups of IL
>> > >> codes and specific calls into other assemblies.
>> > >>
>> > >> Looking at the many many 'decompiler' tools out there - I can see
>> > >> that
>> > >> this sort of thing is possible, since they do it (plus far far
>> > >> more -
>> > >> like actually decompiling, which I don't want or need).
>> > >>
>> > >> Does anyone know of any sample source code, or reference materials
>> > >> that
>> > >> will help get me started? Reflection.Emit looked promising, but that
>> > >> seems to be for creating assemblies - rather than analyzing existing
>> > >> ones...?
>> > >>
>> > >> Sample sourcecode for a 'very basic decompiler' would be ideal,
>> > >> since
>> > >> it would have exactly what I'm after probably...
>> > >>
>> > >>
>> > >> Any help would be MUCH appreciated!
>> > >> Rob
>> > >>
>> > >
>> > >
>>
>>

AddThis Social Bookmark Button