Understanding the .text section of a PE executable
I am trying to create a simple CIL code decompiler. I managed to load the headers and sections correctly, now I am struggling with the .text section.
Here's my test app:
using System;
namespace Sample2
{
class Program
{
static void Main(string[] args)
{
int localVarriableOne = 123;
int localVarriableTwo = 654;
Console.WriteLine(localVarriableOne + localVarriableTwo);
}
}
}
The .text section header tells me PointerToRawData = 0x0200
what I was expecting. Now when I try to skip this offset, I come across strange symbols (marked in red) that I did not expect. I thought that I should come across a method header, tiny or large, but it seems to me that I am wrong. The method header is assumed to have the second least significant bit, which is independent of the header type.
However, I managed to find my CIL code that I expected (marked in blue)! Using the CIL opcodes from my help, I saw that the code was what I expected:
ldc.i4.s 123
stloc.0
ldc.i4 456
stloc.1
...
Now I am confused. Of course there is something in front of the method declaration, but I can't find anything about the .text section. If someone can tell me I would be very pleased.
source to share
.NET assemblies do not use the traditional segment text
to store their .NET code - only the source compiled code goes there. Instead, they use special CLR structures within PE that only .NET assemblies have.
One of the "optional" headers in the PE file is the CLR Runtime Header, which contains all the key information about where .NET-specific structures are in PE.
For more information on this, download the latest PE ("Microsoft Executable and Common Object Format Specification") specification from msdn.com.
For a more detailed explanation of how many pieces of .NET executable code and associated data are organized in PE, check out Serge Lidin's book on .NET. assembler .
source to share