IL Disassembler

IL Disassembler

The command-line structure of IL Disassembler is as follows:

ildasm [<options>] [<in_filename>] [<options>]

If no filename is specified, the disassembler starts in graphical mode. You can then open a specific file by using the File Open menu command or by dragging the file to the disassembler’s tree view window.

All options are recognized by the first three characters following the option key, and all are case-insensitive. The option key can be a forward slash (/) or a hyphen (-). In options that specify parameters, the equality character (=) is interchangeable with the colon character (:).

The /ADVANCED (/ADV) option sets the advanced mode of the disassembler, which offers additional viewing and dumping options. The /ADV option must be specified before any of the advanced-only options. I recommend that you place the /ADV option ahead of all other options.

Options for Output Redirection

• /OUT=<out_filename>  Direct the output to a file rather than to a GUI.

• /OUT=CON  Direct the output to a console window rather than to a GUI.

• /TEXT  A shortcut for /OUT=CON.

If the /OUT option or the /TEXT option is specified, the <in_filename> must be specified as well.

ILAsm Code Formatting Options (PE Files Only)

• /BYTES  Show the actual IL stream bytes (in hexadecimal notation) as instruction comments.

• /RAWEH  Show structured exception handling clauses in canonical (label) form.

• /TOKENS  Show metadata token values as comments.

• /SOURCE  Show original source lines as comments. This requires the presence of the PDB file accompanying the PE file being disassembled and the original source files. If the original source files cannot be found at the location specified in the PDB file, the disassembler tries to find them in the current directory.

• /LINENUM  Include references to original source lines (.line directives). This requires the presence of the PDB file accompanying the PE file being disassembled.

• /VISIBILITY=<vis>[+<vis>...]  Disassemble only the items with specified visibility. Visibility suboptions (<vis>) include the following:

  • PUB   Public

  • PRI   Private

  • FAM   Family

  • ASM   Assembly

  • FAA   Family and assembly

  • FOA   Family or assembly

  • PSC   Private scope

• /PUBONLY  A shortcut for /VIS=PUB.

• /QUOTEALLNAMES  Enclose all names in single quotation marks. By default, only names that don’t match the ILAsm definition of a simple name are quoted.

• /NOBAR  Suppress the pop-up window showing the disassembly progress bar.

Options for File Output (PE Files Only)

• /UTF8  Use UTF-8 encoding for output. The default is ANSI.

• /UNICODE  Use Unicode encoding for output.

Options for File or Console Output (PE Files Only)

• /NOIL  Suppress ILAsm code output.

• /HEADER  Include PE header information and runtime header information in the output.

• /ITEM=<class>[::<method>[(<sig>)]  Disassemble the specified item only. If <sig> is not specified, all methods named <method> of <class> are disassembled. If <method> is not specified, all members of <class> are disassembled. For example, /ITEM="Foo" produces the full disassembly of the Foo class and all its members; /ITEM="Foo::Bar" produces the disassembly of all methods named Bar in the Foo class; /ITEM="Foo::Bar(void(int32,string))" produces the disassembly of a single method, void Foo::Bar(int32,string).

• /STATS  Include statistics of the image file; an advanced option.

• /CLASSLIST  Include the list of classes defined in the module; an advanced option.

• /ALL  Combine the /HEADER, /BYTES, and /TOKENS options and, in advanced mode, the /CLASSLIST and /STATS options.

Metadata Summary Option

The metadata summary option is available in advanced mode only. It is suitable for file or console output, and it is the only option that works for both PE and COFF managed files. If an object file or an object library file is specified as an input file, the IL Disassembler in advanced mode automatically invokes the metadata summary, ignoring all other options. In nonadvanced mode, the disassembler does nothing.

• /METAINFO[=<specifier>]  Show the metadata summary. The optional <specifier> is one of the following:

  • MDH   Show the metadata header information and sizes.

  • HEX   Show the hexadecimal representation of the signatures.

  • CSV   Show the sizes of the #Strings, #Blob, #US, and #GUID streams and the sizes of the metadata tables and their records.

  • UNR   Show the list of unresolved method references and unimplemented method definitions.

  • VAL   Invoke the metadata validator and show its output.

• /OBJECTFILE=<obj_file_name>  Show the metadata summary of a single object file in the object library. This option is valid for managed LIB files only.