MSIL Disassembler (Ildasm.exe)

MSIL Disassembler (Ildasm.exe)

The MSIL Disassembler is a companion tool to the MSIL Assembler (Ilasm.exe). Ildasm.exe takes a portable executable (PE) file that contains Microsoft intermediate language (MSIL) code and creates a text file suitable as input to Ilasm.exe.

ildasm [options] [PEfilename] [options]

The following options are available for .exe, .dll, .obj, and .lib files.

Option	Description
/output:filename	Creates an output file with the specified filename, rather than displaying the results in a dialog box.
/text	Displays the results to the console window, rather than in a dialog box or as an output file.
/?	Displays the command syntax and options for the tool.

The following additional options are available for .exe and .dll files.

Option	Description
/bytes	Shows actual bytes, in hexadecimal format, as instruction comments.
/linenum	Includes references to original source lines.
/nobar	Suppresses the disassembly progress indicator pop-up window.
/pubonly	Disassembles only public types and members. Equivalent to /visibility:PUB.
/quoteallnames	Includes all names in single quotes.
/raweh	Shows exception handling clauses in raw form.
/source	Shows original source lines as comments.
/tokens	Shows metadata tokens of classes and members.
/visibility:vis [+vis ...]	Disassembles only types or members with the specified visibility. The following are valid values for vis. PUB Public PRI Private FAM Family ASM Assembly FAA Family and Assembly FOA Family or Assembly PSC Private Scope For a definition of these visibility modifiers, see the MethodAttributes Enumeration.

The following options are valid for .exe and .dll files for file or console output only.

Option	Description
/all	Specifies a combination of the /header, /bytes, and /tokens options.
/header	Includes file header information in the output.
/noil	Suppresses MSIL assembly code output.
/unicode	Uses Unicode encoding for the output.
/utf8	Uses UTF-8 encoding for the output. ANSI is the default.

The following options are valid for .exe, .dll, .obj, and .lib files for file or console output only.

Option	Description
/item:class[::method [(sig)]]	Disassembles the following depending upon the argument supplied: Disassembles the specified class. Disassembles the specified method of the class. Disassembles the method of the class with the specified signature sig. Specify the signature with a return type and as many parameters as required. For example, returntype (param1, param2,..paramn).

Note   All options for Ildasm.exe are case-insensitive and recognized by the first three letters. For example, /quo is equivalent to /quoteallnames. Options that specify arguments accept either a colon (:) or an equal sign (=) as the separator between the option and the argument. For example, /output: filename is equivalent to /output= filename.

Remarks

Ildasm.exe only operates on PE files on disk. It does not operate on files installed in the global assembly cache.

The text file produced by Ildasm.exe can be used as input to the MSIL Assembler (Ilasm.exe). This is useful, for example, when compiling code in a programming language that does not support all the runtime metadata attributes. After compiling the code and running its output through Ildasm.exe, the resulting MSIL text file can be hand-edited to add the missing attributes. You can then run this text file through the MSIL Assembler to produce a final executable file.

Note   Currently, you cannot use this technique with PE files that contain embedded native code (for example, PE files produced by Visual C++ .NET).

You can use the default GUI in the MSIL Disassembler to view the metadata and disassembled code of any existing PE file in a hierarchical tree view. To use the GUI, type ildasm at the command line without supplying the PEfilename argument or any options. From the File menu, you can navigate to the PE file that you want to load into Ildasm.exe. To save the metadata and disassembled code displayed for the selected PE, select the Dump command from the File menu. To save the hierarchical tree view only, select the Dump Treeview command from the File menu. For a detailed guide to loading a file into Ildasm.exe and interpreting the output, see the Ildasm.exe Tutorial, located in the Samples folder that ships with the .NET Framework SDK.

If you provide Ildasm.exe with a PEfilename argument that contains embedded resources, the tool produces multiple output files: a text file that contains MSIL code and, for each embedded managed resource, a .resources file produced using the resource's name from metadata. If an unmanaged resource is embedded in PEfilename, a .res file is produced using the filename specified for MSIL output by the /output option.

Note   Ildasm.exe shows only metadata descriptions for .obj and .lib input files. MSIL code for these file types is not disassembled.

You can run Ildasm.exe over an.exe or .dll file to determine whether the file is managed. If the file is not managed, the tool displays a message stating that the file has no valid common language runtime header and cannot be disassembled. If the file is managed, the tool runs successfully.

Examples

The following command causes the metadata and disassembled code for the PE file MyHello.exe to display in the Ildasm.exe default GUI.

Copy Code

ildasm myHello.exe

The following command disassembles the file MyFile.exe and stores the resulting MSIL Assembler text in the file MyFile.il.

Copy Code

ildasm MyFile.exe /output:MyFile.il

The following command disassembles the file MyFile.exe and displays the resulting MSIL Assembler text to the console window.

Copy Code

ildasm MyFile.exe /text

If the file MyApp.exe contains embedded managed and unmanaged resources, the following command produces four files: MyApp.il, MyApp.res, Icons.resources, and Message.resources:

Copy Code

ildasm MyApp.exe /output:MyApp.il

The following command disassembles the method MyMethod within the class MyClass in MyFile.exe and displays the output to the console window.

Copy Code

ildasm /item:MyClass::MyMethod MyFile.exe /text

In the previous example, there could be several MyMethod methods with different signatures. The following command disassembles the method MyMethod with the return type of void and the parameters int32 and System.string.

Copy Code

ildasm /item:"MyClass::MyMethod(void(int32,class System.String))" MyFile.exe /text