Disassembling.Net - Appendix A

by Jason Haley 5. April 2007 16:17

During Code Camp last weekend, I didn't get to cover everything I wanted to ... so I'm going to try and finish up the content using blog posts instead.

In this entry I want to walk through how to hook a debugger up to some code that you don't have the source code to by using ildasm/ilasm.

For this example, I'll use a little sample application I have called WinJournal.  This application is made up of the following files (download zip):

WinJournal.exe
WinJournal.exe.config
WinJournal.Register.dll

Since our goal is to hook a debugger up to the application, in order to make it easier, let's first put the exe and dll into one file using ILMerge.

Merge Exe and Dll

I won't get into the specifics of ILMerge in this entry, I just wanted to show you how easy it can be to use.

After you have ILMerge installed (and added to your path to make it easier), all you need to do to combine the exe and dll into one file is the following:

  1. Go to the command line and the directory the WinJournal files are stored in
  2. Type the following command:

ILMerge WinJournal.exe WinJournal.Register.dll /out:WinJournal2.exe

Copy or rename the config file to WinJournal2.exe.config (copy WinJournal.exe.config WinJournal2.exe.config)

Now the exe contains all the .Net code we want to debug.

Create a PDB file

Now that we have a single assembly to generate debug symbols, all we need to do is round trip the code with a few extra switches telling ilasm and ildasm to do their part.

First step is to disassemble the exe to an il file using the following command:

ildasm WinJournal2.exe /source /out:WinJournal2.il

Then reassemble the exe with the following command (I'm leaving out the inclusion of the .resources files for simplicity):

ilasm WinJournal2.il /debug /out:WinJournal21.exe

During the assembling process, the WinJournal21.pdb file will be created. 

Hook up a debugger

Last step is to hook up a debugger (in this case VS.Net 2005).

  1. Start WinJournal21.exe in order to attach to it.
  2. Open VS.Net and Choose Attach to Process (Ctrl + Alt + P) - if it does not show on your Tools Menu add it by right clicking on he Tool bar and choose customize.  On the Commands tab, choose the Tools category and it should be in the list to the left.  Just drag the "Attach to Process..." item to your Tools menu.
     
  3. Scroll down in the process list and choose WinJournal21.exe
  4. Once the debugger is attached, click the debugger Break All (pause) button and the IL should load and allow you to debug the process like normal.

Comments (0) | Post RSSRSS comment feed |

Categories:
Tags:

Comments are closed