1

When disassembling .NET code dealing with objects and instance calls, I've found that there are a few things I don't quite get:

Here is my test code:

class Foo
{
   public void Bar()
   {
       Console.WriteLine("hello");
   }
}

...

var foo = new Foo();
foo.Bar();

And here is the disassembled result (optimized)

15:             var foo = new Foo();
00000019  mov         ecx,403880h           //ecx = address of Foo type ?
0000001e  call        FFF71FB0              //call ctor ?
00000023  mov         esi,eax               //esi = result ?

16:             foo.Bar();
00000025  call        63377060  //this seems to be console.writeline inlined (from bar)
0000002a  mov         ecx,eax 
0000002c  mov         edx,dword ptr ds:[03612034h] 
00000032  mov         eax,dword ptr [ecx] 
00000034  mov         eax,dword ptr [eax+3Ch] 
00000037  call        dword ptr [eax+10h] // esi.Bar() ?

I'm guessing that the first part is about loading the Foo type and then calling the constructor on it?

But what about the rest?

Another weird thing is that the code generates the following IL :

L_0017: callvirt instance void CSApp.Foo::Bar()

Why does it do a callvirt on a non virtual method? Is that what is going on in the native code? a vtable lookup?

Roger Johansson
  • 22,764
  • 18
  • 97
  • 193

0 Answers0