When disassembling .NET code dealing with objects and instance calls, I've found that there are a few things I don't quite get:
Here is my test code:
class Foo
{
public void Bar()
{
Console.WriteLine("hello");
}
}
...
var foo = new Foo();
foo.Bar();
And here is the disassembled result (optimized)
15: var foo = new Foo();
00000019 mov ecx,403880h //ecx = address of Foo type ?
0000001e call FFF71FB0 //call ctor ?
00000023 mov esi,eax //esi = result ?
16: foo.Bar();
00000025 call 63377060 //this seems to be console.writeline inlined (from bar)
0000002a mov ecx,eax
0000002c mov edx,dword ptr ds:[03612034h]
00000032 mov eax,dword ptr [ecx]
00000034 mov eax,dword ptr [eax+3Ch]
00000037 call dword ptr [eax+10h] // esi.Bar() ?
I'm guessing that the first part is about loading the Foo type and then calling the constructor on it?
But what about the rest?
Another weird thing is that the code generates the following IL :
L_0017: callvirt instance void CSApp.Foo::Bar()
Why does it do a callvirt on a non virtual method? Is that what is going on in the native code? a vtable lookup?