Lets create simple console application to test recompilation:

using System;

namespace Hello
{
    class Program
    {
        static void Main()
        {
            Console.WriteLine("Hello");
        }
    }
}
After compilation we get standard files:

image

To decompile we will need ildasm (intermediate language disassembler), which is installed with Microsoft Windows SDK. Note that depending on versions file location might differ, use this guide if you can’t find it.

C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.6 Tools\ildasm.exe

Open ConsoleApplication1.exe in ildasm and double click on MANIFEST. At the top we have metadata version which tells version of assembler we will need.

image

 

To decompile, press File > Dump, you can experiment which options to use, I checked these:

image

Two new files got created, sometimes it can be more files, but we need only .il and .res files.

image

HelloWorld.il file contains all source, this is just a small excerpt that contains Main function with “Hello” (line 16) message which we can change to “Hello World”. Note that we selected all checkboxes, that’s why we got a lot of metadata near instructions.

.method /*06000001*/ private hidebysig static 
      void  Main() cil managed
// SIG: 00 00 01
{
.entrypoint
// Method begins at RVA 0x2050
// Code size       13 (0xd)
.maxstack  8
.language '{3F5162F8-07C6-11D3-9053-00C04FA302A1}', '{994B45C4-E6E9-11D2-903F-00C04FA302A1}', '{5A869D0B-6611-11D3-BD2A-0000F80849BD}'
// Source File 'c:\Users\sarun_000\Documents\Visual Studio 2013\Projects\ConsoleApplication1\ConsoleApplication1\Program.cs' 
.line 8,8 : 9,10 'c:\\Users\\sarun_000\\Documents\\Visual Studio 2013\\Projects\\ConsoleApplication1\\ConsoleApplication1\\Program.cs'
//000008:         {
IL_0000:  /* 00   |                  */ nop
.line 9,9 : 13,40 ''
//000009:             Console.WriteLine("Hello");
IL_0001:  /* 72   | (70)000001       */ ldstr      "Hello" /* 70000001 */
IL_0006:  /* 28   | (0A)000011       */ call       void [mscorlib/*23000001*/]System.Console/*01000013*/::WriteLine(string) /* 0A000011 */
IL_000b:  /* 00   |                  */ nop
.line 10,10 : 9,10 ''
//000010:         }
IL_000c:  /* 2A   |                  */ ret
} // end of method Program::Main

 

Depending what version of .NET was used to compile it, we need to use appropriate intermediate language assembler:

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe
C:\Windows\Microsoft.NET\Framework64\v3.0\ilasm.exe
C:\Windows\Microsoft.NET\Framework64\v3.5\ilasm.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe

Now all we need is to run this command from cmd to compile il code:

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe HelloWorld.il /res:HelloWorld.res /out:HelloWorld.exe

 

This simple recompilation also removes strong-name from assembly.

Comments


Comments are closed