Ildasm.exe(IL 反汇编程序)Ildasm.exe (IL Disassembler)

IL 反汇编程序是 IL 汇编程序 (Ilasm.exe) 的配套工具 。The IL Disassembler is a companion tool to the IL Assembler (Ilasm.exe). Ildasm.exe 可利用包含中间语言 (IL) 代码的可移植可执行 (PE) 文件,并创建适合输入到 Ilasm.exe 的文本文件 。Ildasm.exe takes a portable executable (PE) file that contains intermediate language (IL) code and creates a text file suitable as input to Ilasm.exe.

此工具会自动随 Visual Studio 一起安装。This tool is automatically installed with Visual Studio. 若要运行此工具,请使用 Visual Studio 开发人员命令提示(或 Windows 7 中的 Visual Studio 命令提示)。To run the tool, use the Developer Command Prompt for Visual Studio (or the Visual Studio Command Prompt in Windows 7). 有关详细信息,请参阅命令提示For more information, see Command Prompts.

在命令提示符处,键入以下内容:At the command prompt, type the following:

语法Syntax

ildasm [options] [PEfilename] [options]

参数Parameters

下列选项可用于 .exe、.dll、.obj、.lib 和 .winmd 文件 。The following options are available for .exe, .dll, .obj, .lib, and .winmd files.

选项Option 说明Description
/out= filename/out= filename 创建具有指定 filename 的输出文件,而不是在图形用户界面中显示结果。Creates an output file with the specified filename, rather than displaying the results in a graphical user interface.
/rtf /rtf 以 RTF 格式生成输出。Produces output in rich text format. 与 /text 选项一起使用时无效 。Invalid with the /text option.
/text /text 将结果显示到控制台窗口,而不是显示在图形用户界面中或显示为输出文件。Displays the results to the console window, rather than in a graphical user interface or as an output file.
/html /html 以 HTML 格式生成输出。Produces output in HTML format. 与 /output 选项一起使用时才有效 。Valid with the /output option only.
/?/? 显示此工具的命令语法和选项。Displays the command syntax and options for the tool.

下列附加选项可用于 .exe、.dll 和 .winmd 文件 。The following additional options are available for .exe, .dll, and .winmd files.

选项Option 说明Description
/bytes /bytes 以十六进制格式显示作为指令注释的实际字节。Shows actual bytes, in hexadecimal format, as instruction comments.
/caverbal /caverbal 以文字形式生成自定义特性 Blob。Produces custom attribute blobs in verbal form. 默认为二进制形式。The default is binary form.
/linenum /linenum 包含对原始源行的引用。Includes references to original source lines.
/nobar /nobar 禁止显示反汇编进度指示器弹出窗口。Suppresses the disassembly progress indicator pop-up window.
/noca /noca 禁止显示自定义特性的输出。Suppresses the output of custom attributes.
/project /project 以托管代码的方式显示元数据,而不是以本机 Windows 运行时的方式显示。Displays metadata the way it appears to managed code, instead of the way it appears in the native Windows Runtime. 如果 PEfilename 不是 Windows 元数据 (.winmd) 文件,此选项将不起任何作用 。If PEfilename is not a Windows metadata (.winmd) file, this option has no effect. 请参阅 Windows 应用商店应用和 Windows 运行时的 .NET Framework 支持See .NET Framework Support for Windows Store Apps and Windows Runtime.
/pubonly /pubonly 仅反汇编公共类型和公共成员。Disassembles only public types and members. 等效于 /visibility:PUB 。Equivalent to /visibility:PUB.
/quoteallnames /quoteallnames 在单引号中包含所有名称。Includes all names in single quotes.
/raweh /raweh 以原始格式显示异常处理子句。Shows exception handling clauses in raw form.
/source /source 以注释形式显示原始源行。Shows original source lines as comments.
/tokens /tokens 显示类和成员的元数据标记。Shows metadata tokens of classes and members.
/visibility: vis[+vis...]/visibility: vis[+vis...] 仅反汇编具有指定可见性的类型或成员。Disassembles only types or members with the specified visibility. 下面是 vis 的有效值:The following are valid values for vis:

PUB - 公共 PUB — Public

PRI - 私有 PRI — Private

FAM - 系列 FAM — Family

ASM - 程序集 ASM — Assembly

FAA - 系列和程序集 FAA — Family and Assembly

FOA - 系列或程序集 FOA — Family or Assembly

PSC - 私有范围 PSC — Private Scope

有关这些可见性修饰符的定义,请参见 MethodAttributesTypeAttributesFor definitions of these visibility modifiers, see MethodAttributes and TypeAttributes.

下列选项仅对用于文件或控制台输出的 .exe、.dll 和 .winmd 文件有效 。The following options are valid for .exe, .dll, and .winmd files for file or console output only.

选项Option 说明Description
/all/all 指定 /header、/bytes、/stats、/classlist 和 /tokens 选项的组合 。Specifies a combination of the /header, /bytes, /stats, /classlist, and /tokens options.
/classlist /classlist 包含模块中定义的类的列表。Includes a list of classes defined in the module.
/forward /forward 使用前向类声明。Uses forward class declaration.
/headers /headers 在输出中包含文件头信息。Includes file header information in the output.
/item: class[ :: member[(sig]]/item: class[:: member[(sig]] 根据所提供的自变量反汇编下列内容:Disassembles the following depending upon the argument supplied:

- 反汇编指定的 class- Disassembles the specified class.
- 反汇编类的指定 classmember- Disassembles the specified member of the class.
- 反汇编具有指定签名 sigclassmember- Disassembles the member of the class with the specified signature sig. sig 的格式如下:The format of sig is:
[instance] returnType(parameterType1, parameterType2, …, parameterTypeN)[instance] returnType(parameterType1, parameterType2, …, parameterTypeN)
请注意:在 .NET Framework 1.0 和 1.1 版中,sig 必须后跟右括号:(sig)Note In the .NET Framework versions 1.0 and 1.1, sig must be followed by a closing parenthesis: (sig). 自 .Net Framework 2.0 起,必须省略右括号:(sigStarting with the Net Framework 2.0 the closing parenthesis must be omitted: (sig.
/noil /noil 禁止显示 IL 程序集代码输出。Suppresses IL assembly code output.
/stats /stats 包含映像的统计信息。Includes statistics on the image.
/typelist /typelist 生成类型的完整列表,以便在往返过程中保留类型排序。Produces the full list of types, to preserve type ordering in a round trip.
/unicode /unicode 对输出使用 Unicode 编码。Uses Unicode encoding for the output.
/utf8 /utf8 对输出使用 UTF-8 编码。Uses UTF-8 encoding for the output. ANSI 为默认值。ANSI is the default.

下列选项仅对用于文件或控制台输出的 .exe、.dll、.obj、.lib 和 .winmd 文件有效 。The following options are valid for .exe, .dll, .obj, .lib, and .winmd files for file or console output only.

选项Option 说明Description
/metadata[=specifier] /metadata[=specifier] 显示元数据,其中 specifier 为:Shows metadata, where specifier is:

MDHEADER - 显示元数据头信息和大小 。MDHEADER — Show the metadata header information and sizes.

HEX - 以十六进制形式及文字形式显示信息 。HEX — Show information in hex as well as in words.

CSV - 显示记录计数和堆大小 。CSV — Show the record counts and heap sizes.

UNREX - 显示无法解析的外部对象 。UNREX — Show unresolved externals.

SCHEMA - 显示元数据头和架构信息 。SCHEMA — Show the metadata header and schema information.

RAW - 显示原始元数据表 。RAW — Show the raw metadata tables.

HEAPS - 显示原始堆 。HEAPS — Show the raw heaps.

VALIDATE - 验证元数据的一致性 。VALIDATE — Validate the consistency of the metadata.

可多次指定 /metadata,并为 specifier 指定不同的值 。You can specify /metadata multiple times, with different values for specifier.

下列选项仅对用于文件或控制台输出的 .lib 文件有效 。The following options are valid for .lib files for file or console output only.

选项Option 说明Description
/objectfile=filename /objectfile=filename 显示指定库中单个对象文件的元数据。Shows the metadata of a single object file in the specified library.

备注

Ildasm.exe 的所有选项都不区分大小写,并且根据前三个字母识别 。All options for Ildasm.exe are case-insensitive and recognized by the first three letters. 例如,/quo 等效于 /quoteallnames 。For example, /quo is equivalent to /quoteallnames. 指定参数的选项既可以用冒号 (:) 也可以用等号 (=) 作为选项和参数之间的分隔符。Options that specify arguments accept either a colon (:) or an equal sign (=) as the separator between the option and the argument. 例如,/output: filename 等效于 /output= filename 。For example, /output: filename is equivalent to /output= filename.

备注Remarks

Ildasm.exe 只对磁盘上的 PE 文件进行操作 。Ildasm.exe only operates on PE files on disk. 它不对安装在全局程序集缓存中的文件进行操作。It does not operate on files installed in the global assembly cache.

Ildasm.exe 生成的文本文件可以用作 IL 汇编程序 (Ilasm.exe) 的输入 。The text file produced by Ildasm.exe can be used as input to the IL Assembler (Ilasm.exe). 这很有用,例如在编译用并非支持所有运行时元数据特性的编程语言编写的代码时。This is useful, for example, when compiling code in a programming language that does not support all the runtime metadata attributes. 通过 Ildasm.exe 编译代码并运行其输出后,可以手动编辑生成的 IL 文本文件以添加缺少的属性 。After compiling the code and running its output through Ildasm.exe, the resulting IL text file can be hand-edited to add the missing attributes. 然后可以通过 IL 汇编程序运行此文本文件以生成最终可执行文件。You can then run this text file through the IL Assembler to produce a final executable file.

备注

目前,无法对包含嵌入的本机代码的 PE 文件(例如,由 Visual C++ 生成的 PE 文件)使用此技术。Currently, you cannot use this technique with PE files that contain embedded native code (for example, PE files produced by Visual C++).

你可以使用 IL 反汇编程序中的默认 GUI 在分层树视图中查看任何现有 PE 文件的元数据和反汇编代码。You can use the default GUI in the IL Disassembler to view the metadata and disassembled code of any existing PE file in a hierarchical tree view. 若要使用此 GUI,请在命令行中键入 ildasm,无需提供 PEfilename 参数或任何选项 。To use the GUI, type ildasm at the command line without supplying the PEfilename argument or any options. 可从“文件”菜单导航到要加载到 Ildasm.exe 中的 PE 文件 。From the File menu, you can navigate to the PE file that you want to load into Ildasm.exe. 若要保存为选定 PE 显示的元数据和反汇编代码,请从“文件”菜单中选择“转储”命令 。To save the metadata and disassembled code displayed for the selected PE, select the Dump command from the File menu. 若要仅保存分层树视图,请从“文件”菜单中选择“转储树视图”命令 。To save the hierarchical tree view only, select the Dump Treeview command from the File menu. 有关将文件加载到 Ildasm.exe 中和解释输出的详细指南,请参见 Windows SDK 附带的 Samples 文件夹中的 Ildasm.exe 教程 。For a detailed guide to loading a file into Ildasm.exe and interpreting the output, see the Ildasm.exe Tutorial, located in the Samples folder that ships with the Windows SDK.

如果为 Ildasm.exe 提供一个包含嵌入资源的 PEfilename 参数,则此工具生成多个输出文件:一个包含 IL 代码的文本文件,以及与每个嵌入的托管资源对应的 .resources 文件(使用该资源在元数据中的名称生成) 。If you provide Ildasm.exe with a PEfilename argument that contains embedded resources, the tool produces multiple output files: a text file that contains IL code and, for each embedded managed resource, a .resources file produced using the resource's name from metadata. 如果 PEfilename 中嵌入了非托管资源,则通过 /output 选项使用 IL 输出指定的文件名生成 .res 文件 。If an unmanaged resource is embedded in PEfilename, a .res file is produced using the filename specified for IL output by the /output option.

备注

Ildasm.exe 仅显示 .obj 和 .lib 输入文件的元数据说明 。Ildasm.exe shows only metadata descriptions for .obj and .lib input files. 不反汇编这些文件类型的 IL 代码。IL code for these file types is not disassembled.

可对 .exe 或 .dll 文件运行 Ildasm.exe 来确定该文件是否是托管的 。You can run Ildasm.exe over an.exe or .dll file to determine whether the file is managed. 如果该文件不是托管的,则此工具将显示一条信息,说明该文件没有有效的公共语言运行时标头,并且无法反汇编。If the file is not managed, the tool displays a message stating that the file has no valid common language runtime header and cannot be disassembled. 如果该文件是托管的,则此工具将成功运行。If the file is managed, the tool runs successfully.

版本信息Version Information

从 .NET Framework 4.5 开始,Ildasm.exe 将通过显示原始二进制内容来处理无法识别的封送 BLOB(二进制大型对象) 。Starting with the .NET Framework 4.5, Ildasm.exe handles an unrecognized marshal BLOB (binary large object) by displaying the raw binary content. 例如,下面的代码演示 C# 程序生成的封送 BLOB 如何显示:For example, the following code shows how a marshal BLOB generated by a C# program is displayed:

public void Test([MarshalAs((short)70)] int test) { }
// IL from Ildasm.exe output
.method public hidebysig instance void Test(int32  marshal({ 46 }) test) cil managed

从 .NET Framework 4.5 开始,Ildasm.exe 将显示应用于接口实现的属性,如下方 Ildasm.exe 输出摘录所示 :Starting with the .NET Framework 4.5, Ildasm.exe displays attributes that are applied to interface implementations, as shown in the following excerpt from Ildasm.exe output:

.class public auto ansi beforefieldinit MyClass
  extends [mscorlib]System.Object
  implements IMyInterface
  {
    .interfaceimpl type IMyInterface
    .custom instance void
      [mscorlib]System.Diagnostics.DebuggerNonUserCodeAttribute::.ctor() = ( 01 00 00 00 )
      …

示例Examples

下面的命令使 PE 文件 MyHello.exe 的元数据和反汇编代码显示在 Ildasm.exe 的默认 GUI 中 。The following command causes the metadata and disassembled code for the PE file MyHello.exe to display in the Ildasm.exe default GUI.

ildasm myHello.exe

下面的命令对 MyFile.exe 文件进行反汇编,并将生成的 IL 汇编程序文本存储在 MyFile.il 文件中 。The following command disassembles the file MyFile.exe and stores the resulting IL Assembler text in the file MyFile.il.

ildasm MyFile.exe /output:MyFile.il

下面的命令对 MyFile.exe 文件进行反汇编,并将结果 IL 汇编程序文本显示到控制台窗口中。The following command disassembles the file MyFile.exe and displays the resulting IL Assembler text to the console window.

ildasm MyFile.exe /text

如果文件 MyApp.exe 包含嵌入的托管和非托管资源,则下面的命令将生成 4 个文件:MyApp.il、MyApp.res、Icons.resources 和 Message.resources: If the file MyApp.exe contains embedded managed and unmanaged resources, the following command produces four files: MyApp.il, MyApp.res, Icons.resources, and Message.resources:

ildasm MyApp.exe /output:MyApp.il

下面的命令对 MyFile.exeMyClass 类中的 MyMethod 方法进行反汇编,并将输出显示到控制台窗口中。The following command disassembles the method MyMethod within the class MyClass in MyFile.exe and displays the output to the console window.

ildasm /item:MyClass::MyMethod MyFile.exe /text

在上面的示例中,可能有几个具有不同签名的名为 MyMethod 的方法。In the previous example, there could be several methods named MyMethod with different signatures. 下面的命令对返回类型为 void 且参数类型为 int32 和 string 的 MyMethod 实例方法进行反汇编 。The following command disassembles the instance method MyMethod with the return type of void and the parameter types int32 and string.

ildasm /item:"MyClass::MyMethod(instance void(int32,string)" MyFile.exe /text

备注

在 .NET Framework 1.0 和 1.1 版中,方法名称之后的左括号必须在签名后面匹配一个右括号:MyMethod(instance void(int32))In the .NET Framework versions 1.0 and 1.1, the left parenthesis that follows the method name must be balanced by a right parenthesis after the signature: MyMethod(instance void(int32)). 从 .NET Framework 2.0 开始,必须省略右括号:(MyMethod(instance void(int32)Starting with the .NET Framework 2.0 the closing parenthesis must be omitted: MyMethod(instance void(int32).

若要检索 static 方法(在 Visual Basic 中为 Shared 方法),则省略关键字 instanceTo retrieve a static method (Shared method in Visual Basic), omit the keyword instance. 不属于基元类型(例如 int32string)的类类型必须包括命名空间并且必须在前面加上关键字 classClass types that are not primitive types like int32 and string must include the namespace and must be preceded by the keyword class. 外部类型的前面必须是用方括号括起来的库名称。External types must be preceded by the library name in square brackets. 下面的命令对名为 MyMethod 的静态方法进行反汇编,该方法具有一个 AppDomain 类型的参数且其返回类型为 AppDomainThe following command disassembles a static method named MyMethod that has one parameter of type AppDomain and has a return type of AppDomain.

ildasm /item:"MyClass::MyMethod(class [mscorlib]System.AppDomain(class [mscorlib]System.AppDomain)" MyFile.exe /text

嵌套类型的前面必须是包含它的类,并用正斜杠进行分隔。A nested type must be preceded by its containing class, delimited by a forward slash. 例如,如果 MyNamespace.MyClass 类包含名为 NestedClass 的嵌套类,则按如下方式标识该嵌套类:class MyNamespace.MyClass/NestedClassFor example, if the MyNamespace.MyClass class contains a nested class named NestedClass, the nested class is identified as follows: class MyNamespace.MyClass/NestedClass.

请参阅See also