Programmatically analyzing IL code

[robert_m_hooker]

Hi All,

I'm attempting to write a very basic 'Assebmly standards & policies
checker' for in-house use. This tool would open an assembly, and scan
it for a handful of specific conformance issues we need to adhere too.
Essentially, I'd be scanning the assembly for specific groups of IL
codes and specific calls into other assemblies.

Looking at the many many 'decompiler' tools out there - I can see that
this sort of thing is possible, since they do it (plus far far more -
like actually decompiling, which I don't want or need).

Does anyone know of any sample source code, or reference materials that
will help get me started? Reflection.Emit looked promising, but that
seems to be for creating assemblies - rather than analyzing existing
ones...?

Sample sourcecode for a 'very basic decompiler' would be ideal, since
it would have exactly what I'm after probably...


Any help would be MUCH appreciated!
Rob

 

[Lou Zher]

This is exactly what FxCop is designed to do and it is extensible.
http://www.gotdotnet.com/team/fxcop
-LZ

 

[Tomer Gabel]

You might be trying to do the 'wrong thing.' Why are you trying to work an
actual IL? Wouldn't it be easier to work on the source level -- there are
terrific automatic tools to help you do just that (like FxCop which Lou
mentioned?)

If you're adamant about parsing IL, you might want to do some research into
..NET diassemblers (there might be an integrable diassembler package, or a
freely available IL parser) or just write your own parser. IL isn't all that
complex - certainly easier than parsing C# - but don't expect it to be a
piece of cake.

 

[Greg Young]

There are a couple pre-done IL parsers. MS Research has one if you want to
use F#, the mono project also has a really nice one.

I would however think FxCop can be used for this.

 

[robert_m_hooker]

Thanks all for your replies.

Unfortunately, we don't think we can use FxCop, or any other source
level tool, since the assemblies we need to analyze are not 'ours'.
They are written externally, to work with our system, but we need to
programmatically verify that they are - and are not - calling certain
methods of ours and in certain orders etc. We'll potentially need to do
this verfification "live" and "in the field" so to speak, on a end
users machine (rejecting the assembly if it 'fails').

I've searched for the 'pre-done' IL parsers - F# and the mono project
one. I'm not having any luck finding IL parsers though...

Does anyone have any explicit links handy?

Cheers
Rob

 

[Lou Zher]

BTW: FxCop is an object-code level tool and works without source code. MSIL
is a lot easier to work with than source code.

If your looking for a disassembler/decompiler, check out Reflector.
http://www.aisto.com/roeder/dotnet/

If you want to verify live calling order, why not create a logging shim
interface on your code?
-LZ

 

[Guest]

Hey Robert,
FxCop doesnt analyze the source files, it parses out the IL and does IL
analysis.

I've done a lot of work in the area your talking about, and IL anaysis is
the way to go. Otherwise you'd have to write an analysis tool (or parser)
for each language. Since all langs compile to IL, thats your lowest common
denominator.

FxCop allows you to write custom rules, and you can get at the IL level,
which sounds like what your after. If you need more control over how you
read the IL, you can cut to the chase and use the Microsoft Common Compiler
Infrastrucure dll (Microsoft.Cci.DLL), which ironically is what FxCop uses
behind the scenes (it ships with FxCop).

A sample piece of code that will get your started is :
string fileName = "DotNetThing.dll";
AssemblyNode assembly = AssemblyNode.GetAssembly(fileName);
foreach (TypeNode type in assembly.Types)
{
Console.WriteLine(type.FullName);
foreach (Member member in type.Members)
{
Method method = member as Method;
if (method != null)
{
Console.WriteLine(method.FullName);
foreach (Instruction inst in method.Instructions)
{
Console.WriteLine(inst.OpCode.ToString() + " " + inst.Value);
}
}
}
}

This will load an assembly, dump out the type name, the method name, and
each opcode and corresponding value of the opcode.

If you want to go the opensource and mono route, then you can use a library
called Cecil (http://www.mono-project.com/Cecil). I've used Cecil, but I
ended up switching back to CCI instead. Cecil still has a few bugs and
doesnt play well with all VS2005 assemblies. Its written specifically for
the Mono compiler.

The last option (that i know of) os a library called the Phoenix Framework,
written by Microsoft Research (http://research.microsoft.com/phoenix/).
Gives you some crazy control over the assembly, its IL, debug symbols, and
all sorts of other stuff. For what i needed it was overkill.

Those are your four best options

 

[Michael Cummings]

Another tool you may want to consider as it complements FxCop is NDepend. It
has a very slick query language you can use to analyze assemblies with.

http://www.ndepend.com/