代码大全 MSIL语言程序设计

.NET平台的编译器会将高级语言(C#,VB.NET,F#)编译成MSIL(微软中间语言)格式。熟悉MSIL语言，可以读懂一些加密程序混淆过的算法，这些算法几乎不能还原成高级语言，但是可以还原成MSIL语言。也可以知道一些高级语言之外的关于CLR的特性，比如多模块程序集，全局静态方法等等。一些.NET保护加密程序也是运用MSIL平台的特性。

阅读本篇文章，假设您已经对这个语言有基本的了解，我会列举这个语言的基本语言应用例子，供参考。

1 Hello world

.method static void main()

{

    .entrypoint

    .maxstack 1

    ldstr "Hello world!"

    call void [mscorlib]System.Console::WriteLine(string)

    ret

}

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, "Courier New", courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }在控制台上打印Hello world字符串。MSIL以entrypoint表示入口方法，而不一定是C#中规定的Main方法。

2 使用局部变量

.locals init (int32 first,

              int32 second,

              int32 result)

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, "Courier New", courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }上面的语法，定义了三个局部变量，它的名称分别是first,sencond,result。

下面的代码读取用户在控制台上的输入值，并调用Parse方法，把结果保存在first局部变量中。

ldstr "First number: "

call void [mscorlib]System.Console::Write(string)

call string [mscorlib]System.Console::ReadLine()

call int32 [mscorlib]System.Int32::Parse(string)

stloc first

调用add方法，将frist和second的值加起来，保存到resutl局部变量中

ldloc first

ldloc second

add

stloc result

最后，在控制台上打印结果值

ldstr "{0} + {1} = {2}"

ldloc first

box int32

ldloc second

box int32

ldloc result

box int32

call void [mscorlib]System.Console::WriteLine(string, object, object, object).csharpcode, .csharpcode pre

{

	font-size: small;

	color: black;

	font-family: consolas, "Courier New", courier, monospace;

	background-color: #ffffff;

	/*white-space: pre;*/

}

.csharpcode pre { margin: 0em; }

.csharpcode .rem { color: #008000; }

.csharpcode .kwrd { color: #0000ff; }

.csharpcode .str { color: #006080; }

.csharpcode .op { color: #0000c0; }

.csharpcode .preproc { color: #cc6633; }

.csharpcode .asp { background-color: #ffff00; }

.csharpcode .html { color: #800000; }

.csharpcode .attr { color: #ff0000; }

.csharpcode .alt

{

	background-color: #f4f4f4;

	width: 100%;

	margin: 0em;

}

.csharpcode .lnum { color: #606060; }

因为三个局部变量是int32类型，调用WriteLine方法时要传入object类型，所以要装箱(box)。

3 定义类型

新建一个calss/enum/struct即为定义一种新的程序类型，扩展.NET本身已有的类型和功能。

.class Kerr.RealEstate.House

{

    .method public void .ctor()

    {

        .maxstack 1

        ldarg.0 // push "this" instance onto the stack

        call instance void [mscorlib]System.Object::.ctor()

        ret

    }

}

.class abstract sealed Kerr.RealEstate.MortgageCalculator

{

    /* members */

}

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, "Courier New", courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }注意下面的代码，它展示了MSIL命名空间的用法。可以直接把calss放在namespace里面，用大括号括起来，或是像本段的第一个代码所表达的，直接写完整的命名空间(C#中不支持这样的写法)。

.namespace Kerr.RealEstate

{

    .class abstract sealed MortgageCalculator

    {

        /* members */

    }

}

下面的代码演示新定义的类型继承于现有的类型，和Java的语法相似。

.class Kerr.RealEstate.RoomList

    extends [System.Windows.Forms]System.Windows.Forms.ListView

    implements Kerr.IView

{

    /* members */

}

定义一个接口，然后实现这个接口

.class interface Kerr.IView

{

    /* members */

}

.class Kerr.RealEstate.HouseData

    extends [mscorlib]System.ValueType

{

    /* members */

}

4 定义类型成员

我在学习C++时，C++把类型成员区分为数据成员和方法成员，前者表示字段，后者表示方法。标准的C++书籍中从来不会把方法称作函数，所以一直以来养成习惯，函数只用来指SQL Server脚本中的函数，.NET代码中只有方法。

假设，我们正在定义下面的类型，将要为它添加方法

.class abstract Kerr.Sample.Object

{

}

.method static void .cctor()

{

    .maxstack 1

    ldstr ".cctor"

    call void [mscorlib]System.Console::WriteLine(string)

    ret

}

.method public void .ctor()

{

    .maxstack 1

    ldarg.0

    call instance void [mscorlib]System.Object::.ctor()

    ldstr ".ctor"

    call void [mscorlib]System.Console::WriteLine(string)

    ret

}

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, "Courier New", courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }静态构造方法的调用时机时，当该类型的成员第一次被调用之前，先调用静态构造方法。

创建类型的实例，并存储在局部变量obj中

.locals (class TypeName obj)

newobj void TypeName::.ctor()

stloc obj

定义静态方法

.method static void StaticMethod() { /* impl */ }

.method void InstanceMethod() { /* impl */ }

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, "Courier New", courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }下面的代码演示如何调用静态方法和实例方法

call void TypeName::StaticMethod()

ldloc obj

call instance void TypeName::InstanceMethod()

定义虚拟方法，这种情况主要用在继承层次中，动态调用继承层次中重写的方法

.class House

{

    .method public virtual void Buy()

    {

        .maxstack 1

        ldstr "House::Buy"

        call void [mscorlib]System.Console::WriteLine(string)

        ret

    }

    /* etc */

}

.class TownHouse

    extends House

{

    .method public virtual void Buy()

    {

        .maxstack 1

        ldstr "TownHouse::Buy"

        call void [mscorlib]System.Console::WriteLine(string)

        ret

    }

    /* etc */

}

下面的代码演示了多态的应用，MSIL版本，请参考下面代码

newobj instance void House::.ctor()

stloc house

newobj instance void TownHouse::.ctor()

stloc townHouse

ldloc house

call instance void House::Buy()

ldloc townHouse

call instance void TownHouse::Buy()

ldloc townHouse

call instance void House::Buy()

ldloc townHouse

callvirt instance void House::Buy()

House::Buy

TownHouse::Buy

House::Buy

TownHouse::Buy

5 异常处理

MSIL是一种面向对象的语言，它的异常处理的基本指令格式

.try

{

    /* protected code */

    leave.s _CONTINUE

}

<exception handler>

_CONTINUE:

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, "Courier New", courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }来看一个例子，它读取字符串值，调用Int32.Parse分析字符串，返回字符串代表的整型值

.try

{

    ldstr "I'm not a number"

    // ldnull

    // ldstr "123"

    call int32 [mscorlib]System.Int32::Parse(string)

    leave.s _CONTINUE

}

catch [mscorlib]System.ArgumentNullException

{

    callvirt instance string [mscorlib]System.Exception::get_Message()

    call void [mscorlib]System.Console::WriteLine(string)

    leave.s _CONTINUE

}

catch [mscorlib]System.FormatException

{

    callvirt instance string [mscorlib]System.Exception::get_Message()

    call void [mscorlib]System.Console::WriteLine(string)

    leave.s _CONTINUE

}

上面的代码会抛出格式异常，异常会被FormaException截获，它会在控制台上打印异常信息。

异常过滤器

.try

{

    // ldstr "I'm not a number"

    ldnull

    // ldstr "123"

    call int32 [mscorlib]System.Int32::Parse(string)

    leave.s _CONTINUE

}

filter

{

    ldstr "filter evaluation\n\t"

    call void [mscorlib]System.Console::Write(string)

    callvirt instance string [mscorlib]System.Exception::get_Message()

    call void [mscorlib]System.Console::WriteLine(string)

    ldc.i4.1

    endfilter

}

{

    ldstr "filter handler\n\t"

    call void [mscorlib]System.Console::Write(string)

    callvirt instance string [mscorlib]System.Exception::get_Message()

    call void [mscorlib]System.Console::WriteLine(string)

    leave.s _CONTINUE

}

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, "Courier New", courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }try 语句中的代码会抛出null异常，过滤器拦截此异常，并把true压入堆栈，表示已经处理此异常，方法返回。

finally语句用最终都会被执行，比如要释放非托管资源，数据库连接等等

.try

{

    /* protected code */

    leave.s _CONTINUE

}

finally

{

    /* cleanup code */

    endfinally

}

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, "Courier New", courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }fault处理语句，try语句执行完毕后，进入fault语句，只能与try语句块一起使用。与C#中的using(using(Object i=new Ojbect()); )用法相似，保证Dispose方法一定会被调用。

.try

{

    /* protected code */

    leave.s _CONTINUE

}

fault

{

    /* cleanup code */

    endfault

}

6 控制流程

IF-ELSE语句

C#方法定义如下

void Send(string message)

{

    if (null == message)

    {

        throw new ArgumentNullException("message");

    }

    /* impl */

}

翻译成MSIL语言，代码如下

.method void Send(string message)

{

    .maxstack 2

    ldnull

    ldarg message

    ceq

    ldc.i4.0

    ceq

    brtrue.s _CONTINUE

    ldstr "message"

    newobj instance void [mscorlib]System.ArgumentNullException::.ctor(string)

    throw

    _CONTINUE: 

    /* impl */

    ret

}

FOR语句

C#语句的写法

for (int index = 0; 10 != index; ++index)

{

    Debug.WriteLine(index);

}

    int index = 0;

    goto _CONDITION;

_LOOP:

    ++index;

_CONDITION:

    if (10 != index)

    {

        // for statements

        Debug.WriteLine(index);

        goto _LOOP;

    }

再来看一个FOR语句的例子

    .locals init (int32 index)

    br.s _CONDITION

_LOOP:

    ldc.i4.1

    ldloc index

    add

    stloc index 

_CONDITION:

    ldc.i4.s 10

    ldloc index

    beq _CONTINUE

    // for statements

    ldloc index

    box int32

    call void [System]System.Diagnostics.Debug::WriteLine(object)

    br.s _LOOP

_CONTINUE:

7 类型转换

MSIL代码例子，请看下面的代码

.locals init (int32 small,

              int64 big)

// Int32 small = 123;

ldc.i4.s 123

stloc small

// Int64 big = small;

ldloc small

conv.i8

stloc big

// small = static_cast<Int32>(big);

ldloc big

conv.i4

stloc small

Int32 small = 123;

Int64 big = small;

small = static_cast<Int32>(big);

.locals init (int32 small,

              int64 big)

// Int32 small = 123;

ldc.i4.s 123

stloc small

// Int64 big = small;

ldloc small

conv.i8

stloc big

// small = static_cast<Int32>(big);

ldloc big

conv.i4

stloc small

8 FOREACH语句

FOREACH语句应该是C#发明的，未见其它语言有此语言，以安全快速的方法遍历一个集合。

来看下面的这个例子，C++语言的例子

array<int>^ numbers = gcnew array<int> { 1, 2, 3 };

for each (int element in numbers)

{

    Console::WriteLine(element);

}

   .locals init (int32[] numbers,

                  int32 index)

// Create the array

    ldc.i4.3

    newarr int32

    stloc numbers

// Populate the array

    ldloc numbers

    ldc.i4.0 // index

    ldc.i4.1 // value

    stelem.i4

    ldloc numbers

    ldc.i4.1 // index

    ldc.i4.2 // value

    stelem.i4

    ldloc numbers

    ldc.i4.2 // index

    ldc.i4.3 // value

    stelem.i4

    br.s _CONDITION

_LOOP:

    ldc.i4.1

    ldloc index

    add

    stloc index 

_CONDITION:

    ldloc numbers

    ldlen

    ldloc index

    beq _CONTINUE

// for each statements

    ldloc numbers

    ldloc index

    ldelem.i4

    call void [mscorlib]System.Console::WriteLine(int32)

    br.s _LOOP

_CONTINUE:

再来看稍微复杂一点的例子

Collections::ArrayList numbers(3);

numbers.Add(1);

numbers.Add(2);

numbers.Add(3);

for each (int element in %numbers)

{

    Console::WriteLine(element);

}

翻译成MSIL语言的代码如下面所示

   .locals init (class [mscorlib]System.Collections.ArrayList numbers,

                  class [mscorlib]System.Collections.IEnumerator enumerator)

// Create the array

    ldc.i4.3

    newobj instance void [mscorlib]System.Collections.ArrayList::.ctor(int32)

    stloc numbers

// Populate the array

    ldloc numbers

    ldc.i4.1

    box int32

    callvirt instance int32 [mscorlib]System.Collections.ArrayList::Add(object)

    pop

    ldloc numbers

    ldc.i4.2

    box int32

    callvirt instance int32 [mscorlib]System.Collections.ArrayList::Add(object)

    pop

    ldloc numbers

    ldc.i4.2

    box int32

    callvirt instance int32 [mscorlib]System.Collections.ArrayList::Add(object)

    pop

// Get the enumerator

    ldloc numbers

    callvirt instance class [mscorlib]System.Collections.IEnumerator

        [mscorlib]System.Collections.IEnumerable::GetEnumerator()

    stloc enumerator

    br.s _CONDITION

_CONDITION:

    ldloc enumerator

    callvirt instance bool [mscorlib]System.Collections.IEnumerator::MoveNext()

    brfalse.s _CONTINUE

// for each statements

    ldloc enumerator

    callvirt instance object [mscorlib]System.Collections.IEnumerator::get_Current()

    call void [mscorlib]System.Console::WriteLine(object)

    br.s _CONDITION

_CONTINUE:

Visual Studio不支持MSIL格式的源代码文件语法高亮，推荐用Visual Microsoft Intermediate Language编辑器来阅读IL代码，工程化的管理方式，还可生成目标文件，比记事本方便好用。