1

I understand the difference between a decompiler and a dissassembler (A .net disassembler/decompiler) i.e. a dissassembler allows you to convert machine code to assembly language (which you can see in the Dissassembly window in Visual Studio) and the decompiler converts assembly language to a high level language e.g. C#.

Is it possible to see the assembly code (from the Dissassembly window) generated by the Jitter in a text file? I suspect not because of the fact that it is optimized to be Just In Time.

Also, is MSIL an assembly language or a high level language in the context of my first question? i.e. in .NET there appear to be two assembly languages i.e. MSIL and the assembly language generated by the JITTER, though I suspect the answer is that JITTER generates machine code, which is formatted as assembly language in the Dissassembly window.

I have spent time reading other questions on here, but I have not found an answer.

Community
  • 1
  • 1
w0051977
  • 15,099
  • 32
  • 152
  • 329
  • This isn't very useful, in particular because the Disassembly window has a bug that displays the CALL addresses wrong. If you want to study machine code then use a C compiler. It isn't very different from the machine code generated by the jitter. – Hans Passant Aug 31 '13 at 13:21
  • @HansPassant, thanks. I will use the -S switch with the CyGwin compiler. I want to understand how managed code differs to native code (e.g. C or C++) at the lower level. I realise that managed code has a garbage collector, but I am unsure how this makes the code different at a lower level (assembly language or lower). – w0051977 Aug 31 '13 at 15:00
  • As mentioned by HansPassant, generally, this would be useless for all but academic purposes. So, if you're just trying to learn something, go for it! If it's part of an expedition to hunt down a bug or something, you've probably gone too far. Happy hunting! – fourpastmidnight Aug 31 '13 at 18:24

2 Answers2

7

I think it's important to understand definitions here (it looks like you mostly do, this is just to make sure).

First, assembly language: that's simply any human-readable language where each statement is compiled directly to an instruction in some machine code (which could be for example x86 machine code or .Net bytecode).

Based on this, disassembler is a program that reverses that compilation: it converts machine code to the corresponding assembly language.

And decompiler converts machine code to another language.

Maybe an image of all the options (including de-/compiling C/C++ and assuming x86 computer) would help:

compiling and decompiling graph

Now, to your specific questions:

Is it possible to see the assembly code (from the Dissassembly window) generated by the Jitter in a text file?

Theoretically, there is no reason why that shouldn't be possible (especially considering NGEN). Practically, I don't know about any such tool.

Is MSIL an assembly language or a high level language in the context of my first question?

I would say that it's a high-level assembly language. It's certainly an assembly language and it's also higher-level than normal assembly languages.

svick
  • 236,525
  • 50
  • 385
  • 514
  • Thanks. +1 for the diagram. – w0051977 Aug 31 '13 at 15:01
  • 1
    Yeah, I think the "misnomer" here is "assembly" language. To be more accurate, one should say "machine code" as you show in your diagram. That dispels all confusion, because clearly, MSIL is not physical machine code (it's considered virtual machine code, hence things like the Java JVM, or the .NET mscoree.dll, which are "virtual machines to JIT compile and exucute the generated bytecode) even though (arguably) it could be considered an "assembly" language. Good answer. – fourpastmidnight Aug 31 '13 at 18:15
  • @fourpastmidnight Well, it's not physical machine code right now, but that could change in the future. For example, [there are CPUs that can execute Java bytecode](http://stackoverflow.com/a/4007621/41071) and the same could be done for .Net bytecode. – svick Aug 31 '13 at 18:37
  • @svick: Ah, that's really interesting. Thanks for that information. But, for the discussion at hand, I guess what I said is "fairly on the mark". Again, thanks for the links!! – fourpastmidnight Sep 01 '13 at 00:03
3

IL/MSIL is an assembly language targeted to the .NET virtual machine :-) The Disassembly window shows the assembly language of the program after it's jitted, so the assembly language of the "real" CPU (normally an Intel).

By using ngen you can compile your .NET app to "native" machine code. From there you can probably use a "standard" disassembler to watch inside it.

Community
  • 1
  • 1
xanatos
  • 109,618
  • 12
  • 197
  • 280
  • Do you have any details about disassembling ngened code? I'm not sure it's as simple as you make it sound. – svick Aug 31 '13 at 11:49
  • @svick Probably idapro has an option to export to txt file, or at least you can select, copy, paste on your notepad... Try http://www.developingthefuture.net/disassembling-decompiling-and-modifying-executables/ and http://stackoverflow.com/questions/4565796/how-to-decompile-an-exe-or-a-dll-to-assembly – xanatos Aug 31 '13 at 11:53
  • I would think you'd need to load up your ngen'd assembly into the debugger/disassembler, as well as mscoree.dll (which is the .NET Core Runtime Execution Engine, e.g. JITter). From what I've heard, this isn't nearly as difficult as was the monster VB6!! (but I'm sure it's still not easy). Also, be aware that depending on the machine on which the .NET code is run, the bytes output via ngen may not always be exactly the same. .NET has non-deterministic MSIL -> machine code compilation. – fourpastmidnight Aug 31 '13 at 18:21