Transcript
1
.NET
Matthew ConoverMay 2002
2
What is .NET?• .NET = dumb name• .NET is a framework• .NET is OS and platform
independent• .NET is language-insensitive• .NET specs are publicly available
3
Topics of Discussion• Introduction to .NET• Assemblies and Metadata• Microsoft’s implementation of .NET• .NET Hook Library
(dotNetHookLibrary)
4
Introduction to .NET• .NET Specifications
– Partition I – Architecture– Partition II – Metadata– Partition III – Common Intermediate Language– Partition IV – Library– Partition V – Annexes– Class Library (XML specification)
5
Introduction to .NET• Base Class Library (BCL)
– Shared among all languages• Common Language Runtime (CLR)
– Hosts managed code
6
Introduction to .NETBase Class Library
• Similar to Java’s System namespace.
• Used by all .NET applications• Has classes for IO, threading,
database, text, graphics, console, sockets/web/mail, security, cryptography, COM, run-time type discovery/invocation, assembly generation
7
Introduction to .NET• Common Language Runtime (CLR)
– Common Type System (CTS)– Execution Engine (EE)
8
Introduction to .NETCommon Language
Runtime• Common Type System
– Specifies certain types required to be hosted by CLR
– Specifies rules for class, struct, enums, interface, delegate, etc.
– Everything is actually an object
9
Introduction to .NETCommon Language
Runtime• Execution Engine
– Compiles Microsoft Intermediate Language (MSIL) into native code
– Handles garbage collection– Handles exceptions– Enforces code access security (sandbox)– Handles verification
• Managed v. Unmanaged
10
Introduction to .NET
BCL
Assembly
Class Loader
JIT
Machine Code
External Assembly
CLR
11
Assemblies• .NET Library/Executable (PE file
format)• Single-file or multi-file assemblies• Modular design
– Eliminates DLL problems– Locations resolved at runtime
• Components:– Metadata– MSIL (or native) code
12
AssembliesPhysical Layout
MSDOS Header
PE Section Headers
PE Header
Includes .NET Header
Code section
Data section
Relocations section
.text (includes Metadata)
.rsrc or .data
.reloc or .rdata
Single-file Assembly
13
Assemblies• .NET Executable (PE file format)• Single-file or multi-file assemblies• Modular design• Components:
– Metadata– MSIL (or native) code
14
AssembliesMetadata
• Contains all .NET application data• Very revealing!
– Needed for MSIL compilation– Assembly can be converted to native format
• Streams or heaps (sections of related data)
15
AssembliesMetadata
Signature, Version, Flags
Stream count (n)Metadata Header
Data offset
Stream size
Name (variable length)
Stream Header 1
Stream bodies 1-n
Stream Header n…
…
16
Assemblies Streams
• #Strings (a.k.a. strings heap)– Array of strings
• #US (a.k.a. user strings heap)– Array of strings used by application at runtime
• #GUID– Array of GUIDs (16 bytes each)
• #Blob– Contains compressed binary data
• #- or #~– Contains tables of methods, fields, etc.
17
Assemblies#~ and #- Stream
Version
Heap sizes
Valid tables (n)
…
Tables Header
Table row count Valid Table 1
Valid Table n
… Tables 1-n
18
AssembliesTables in #~/#- Stream
• In a predefined order– MethodDef = table 6– Param table = table 8
• Each table contains specific types– MethodDef = method definitions– TypeDef = type definitions– AssemblyRef = assemblies references
• Tables interact with each other• Tables interact with certain heaps
19
AssembliesSample - MethodDef Table
Relative Virtual Address (RVA)
Implementation flags
Method flags
Method name offset In #Strings
Method signature offset
Parameters index
In #Blob
In Param table
Offset to method
20
AssembliesSample - MethodDef Table
Flags
Sequence number
Parameter name offset In #Strings
Flags
Parameter count
Return type
Parameter types
Method Signature Blob
Param Table
21
AssembliesSample - func(int arg)
funcMethodDef
…
Paramarg
#Strings
#Blob
“func”“arg”
func method signature
arg type signature
…
…
…
22
Assemblies• .NET Executable (PE file format)• Single-file or multi-file assemblies• Components:
– Metadata– MSIL (or native) code
23
AssembliesMSIL
• Pseudo-assembly– Converted into native code– Object “aware” intermediate language– Examples: nop, break, ret, call, callvirt,
newobj, newarr, add, mul, xor, arglist, sizeof, throw, catch, dup
• Supports up to 512 opcodes– 0xFE = first byte of two byte opcodes
• All calls are stack-based
24
AssembliesCall Stack
1
Stack topthis pointer
2
ldc.i4.1
ldc.i4.2
call ClassType::func(Int32, Int32)
`
Left-to-right ordering
ClassType a;
a.func(1, 2)
C# MSIL
25
Assemblies• Sample IL
26
AssembliesMSIL
ldc.i4.s 9
call Print(Int32)MSIL
Assembler0x1f 0x09
0x28 0x06000006
Method token
• Uses “tokens” instead of pointers
27
AssembliesTokens
• A replacement for pointers • References a row in a table
Token
Table Number Row Index
Upper 8 bits Lower 24 bits
28
AssembliesMSIL Samples
• ld = load on stack, st = store from stack• stloc
– Stores a value from the stack into local variable
• ldarg– Puts an argument on the stack
• ldelem– Puts the value of an element on the stack
29
Microsoft’s .NET Implementation
• File locations• System libraries• .NET application flow
30
Microsoft’s .NET ImplementationFile Locations
• Framework: %SystemRoot%\Microsoft.NET
• Global Assembly Cache (GAC): %SystemRoot%\Assembly +– \GAC– \NativeImages*
31
Microsoft’s .NET Implementation
• File locations• System libraries• .NET application flow
32
Microsoft’s .NET Implementation System Libraries
• mscoree.dll (execution engine)• mscorwks.dll (does most
initialization)• mscorjit.dll (contains JIT)• mscorlib.dll (BCL)• fusion.dll (assembly binding)
33
Microsoft’s .NET Implementation System Libraries
mscoree.dll
mscorwks.dll
mscorlib.dllfusion.dll mscorjit.dll
34
Microsoft’s .NET Implementation
• File locations• System libraries• .NET application flow
35
Microsoft’s .NET Implementation.NET Application Flow
Application mscoree.dll
mscorwks.dll
Main
_CorExeMain
_CorExeMain
CoInitializeEE
Entry point
36
Microsoft’s .NET Implementation.NET Application Flow
• Jumps to _CorExeMain (mscoree)• Calls _CorExeMain in mscorwks.dll• _CorExeMain calls CoInitializeEE• CoInitializeEE calls:
– EEStartup– ExecuteEXE
37
EEStartup• GCHeap.Initialize• ECall.Init
– SetupGenericPInvokeCalliStub– PInvokeCalliWorker
• NDirect.Init• UMThunkInit.UMThunkInit• COMDelegate.Init• ExecutionManger.Init• COMNlsInfo.InitializeNLS
38
EEStartup (cont.)• Security::Start• SystemDomain.Init• SystemDomain.NotifyProfilerStartup (ICorProfiler)• SystemDomain.NotifyNewDomainLoads• SystemDomain.PublishAppDomainAndInformDebug
ger (ICorPublish/ICorDebug)
39
SystemDomain.Init• LoadBaseSystemClasses• SystemDomain.CreatePreallocatedExceptions
40
LoadBaseSystemClasses• SystemDomain.LoadSystemAssembly
– Loads mscorlib.dll• Binder::StartupMscorlib• Binder::FetchClass(OBJECT)• MethodTable::InitForFinalization• InitJITHelpers2• Binder::FetchClass(VALUE)• Binder::FetchClass(ARRAY)
41
LoadBaseSystemClasses• Binder.FetchType(OBJECT_ARRAY)• Binder.FetchClass(STRING)• Binder.FetchClass(ENUM)• Binder.FetchClass(ExceptionClass)• Binder.FetchClass(OutOfMemoryExceptionClas
s)• Binder.FetchClass(StackOverflowExceptionClas
s)
42
LoadBaseSystemClasses• Binder.FetchClass(ExecutionEngineExceptionClass)• Binder.FetchClass(DelegateClass)• Binder.FetchClass(MultiDelegateClass)
43
.NET Application Flow• Jumps to _CorExeMain (mscoree)• Calls _CorExeMain in mscorwks.dll• _CorExeMain calls CoInitializeEE• CoInitializeEE calls:
– EEStartup– ExecuteEXE
44
ExecuteEXE• StrongNamesignatureVerification
– In mscorsn.dll• PEFile::Create
– Loads executable• ExecuteMainMethod• FusionBind.CreateFusionName• Assembly.ExecuteMainMethod
45
ExecuteMainMethod• Thread.EnterRestrictiedContext• PEFile::GetMDImport• SystemDomain.SetDefaultDomainAttrib
utes– Sets entry point
• SystemDomain.InitializeDefaultDomain• BaseDomain.LoadAssembly
46
ExecuteEXE• StrongNamesignatureVerification
– In mscorsn.dll• PEFile::Create
– Loads executable• ExecuteMainMethod• FusionBind.CreateFusionName• Assembly.ExecuteMainMethod
47
Assembly.ExecuteMainMethod
• Assembly::GetEntryPoint• ClassLoader::ExecuteMainMethod
– EEClass:FindMethod(entry point token)
48
EEClass.FindMethod• ValidateMainMethod• CorCommandLine.GetArgvW• MethodDesc.Call
– MethodDesc.IsRemotingIntercepted– MethodDesc.CallDescr calls
MethodDesc.CallDescrWorker– CallDescrWorker calls Main()
49
.NET Application• Main() needs to be compiled• Main() calls PreStubWorker (mscorwks)• PreStubWorker
– Compiles all MSIL methods– Calls MethodDesc.DoPrestub
50
MethodDesc.DoPrestub• MethodDesc.GetSecurityFlags• MethodDesc.GetUnsafeAddrofCode• MethodDesc.GetILHeader• MethodDesc.GetRVA• COR_DECODE_METHOD
– Decode tiny/fat format• Security._CanSkipVerification
51
MethodDesc.DoPrestub (cont.)
• EEConfig.ShouldJitMethod• MakeJitWorker
– JITFunction
52
JITFunction• ExecutionManager::GetJitForType
– EEJitManager::LoadJIT– Loads mscorjit.dll (in LoadJIT)– Calls getJit in mscorjit (in LoadJIT)
• CallCompileMethodWithSEHWrapper– Debugger.JitBeginning– CILJit.compileMethod– Debugger.JitComplete
53
CILJit.compileMethod• Calls jitNativeCode • jitNativeCode
– Compiler.compInit– Compiler.compCompile
54
Compiler.compCompile• Compiler.eeGetMethodClass• Compiler.eeGetClassAttribs• emitter.emitBegCG• Compiler.eeGetMethodAttribs• Compiler.comptInitDebuggingInfo• Compiler.genGenerateCode• emitter.emitEndCG
55
Compiler.genGenerateCode
• emitter.emitBegFN• Compiler.genCodeForBBlist• Compiler.genFnProlog• Compiler.genFnEpilog• emitter.emitEndCodeGen• Compiler.gcInfoBlocKHdrSave• emitter.emitEndFN
56
.NET Hook – What It Is• An API for hooking .NET assemblies• Includes a sample application that
will insert a NOP into all “interesting” methods
57
.NET Hook – What It Does• Reads through method table• Reads method
– Parses header, code, EH data• Hooks interesting functions
– Inserts hooked code at front of method– Stored at the end of the .text section
• Updates PE and section headers• Changes function RVAs in Metadata
58
.NET Hook - API• Load(string AssemblyName)• Hook(HookedFunction Function)• Save()
59
.NET Hook - Hook• Specifies a callback function• Callback function receives a
HookedFunction
60
.NET Hook - HookedFunction
• Name (I.e., “Main”)• FullName (I.e., “void Class1::Main(string[]
args”)• DeclaringTypeName (I.e., “Class1”)• ReturnType (I.e., “void”)• Parameters[] (includes name and type)• Header[] and HeaderSize• Code[] and CodeSize• EHData[] and EHSize
61
.NET Hook Hooked Assembly
Metadata
Functions
Import Address Table End of old .text section
.text section
Hooked FunctionsEnd of
new .text section
References both
62
AssembliesHooked Method
RVA
Implementation flags
Method flags
Method name offset
Signature offset
Parameters index
Hooked method
Original methodMethodDef table entry
63
.NET Hook Tiny Method Body
• Header size = 1 byte• Used when:
– Code size < 64 bytes– Maximum stack size is less than 8– The method has no local variables– No exceptions
Header (flags and code size)
Method body (MSIL)
64
.NET Hook Hooked Tiny MethodHeader (flags and code size)
Hooking code (MSIL)
Method body (MSIL)
Updated
Inserted
65
.NET Hook Fat Method
Header size = 12 bytesFlags
Header size
Max. stack sizeCode sizeLocal var. signature Describes local variablesMethod body (MSIL)
Extra data sections Currently only used for exceptions
66
.NET HookHooked Fat Method
Flags
Header size
Max. stack sizeCode sizeLocal var. signature
Method body (MSIL)Extra data sections
Hooking code (MSIL) Inserted
Updated
Updated
67
.NET Hook Demo
68
.NET Hook - Next Steps• Better type handling• Don’t break exception handling• More developers needed
69
Summary• .NET Framework is made up of BCL & CLR• .NET applications stored in assemblies• .NET Hook manipulates assemblies• Assemblies contain Metadata & MSIL code• Metadata contains streams• The #~/#- stream contains tables• Tables contain the important stuff
70
More Information• .NET Specifications:
– http://msdn.microsoft.com/net/ecma• SSCLI and .NET Framework SDK
– http://msdn.microsoft.com/netframework/
• .NET Hook– http://dotnethook.sourceforge.net
71
Acknowledgements• Entercept’s Ricochet Team
– http://www.entercept.com/ricochet• w00w00
– http://www.w00w00.org
top related