1. Bruno Cabral http://www.dei.uc.pt/~bcabral “Reflection, Code Generation and Instrumentation in the.NET platform” University of Coimbra

2. 21 Jan 2004 2/33 Summary PE File Metadata Introspection Assembly and Code generation Using RAIL

3. 21 Jan 2004 3/33 PE File PE = Portable Executable Marked as Code and Execute Read for the OS loader and the CLR _CorExeMain (mscoree.dll)

4. 21 Jan 2004 4/33 PE File PE = Portable Executable Marked as Code and Execute Read for the OS loader and the CLR _CorExeMain (mscoree.dll)

5. 21 Jan 2004 5/33 PE File Multiple Modules Module = file

6. 21 Jan 2004 6/33 PE File - Metadata "data about data" Describes types Member fields, methods, properties, events Describes signatures Fields, properties, methods, delegates, local vars Describes types and references Describes miscellaneous entities Files, modules, assemblies

7. 21 Jan 2004 7/33 PE File - Metadata CIL instructions reference metadata via TOKENS First byte of token indicates type Last three bytes of token are either row # (tables) or offsets (heaps) Tokens are stored compressed in signatures (binary file viewers not very useful)

8. 21 Jan 2004 8/33 PE File - Metadata Tokens (and types) in listing MethodDef : (0x06000001) User string: (0x70000001) AssemblyRef : (0x23000001) TypeRef : (0x01000003) MemberRef : (0x0A000002) Only two are directly referenced by CIL in this example: example: String (by ldstr instruction) MemberRef (by call instruction)

9. 21 Jan 2004 9/33 PE File - Metadata

10. 21 Jan 2004 10/33 PE File - Metadata

11. 21 Jan 2004 11/33 Introspection Two major metadata APIs available Managed: System.Reflection Unmanaged: IMetaDataImport Both are limited in different ways System.Reflection does not permit access to CIL System.Reflection does not reveal token values IMetaDataImport cannot resolve *Ref tokens

12. 21 Jan 2004 12/33 Introspection What can we do with System.Reflection? See loaded assemblies See referenced assemblies See the types defined in the assembly See the methods defined in a type See attributes …

13. 21 Jan 2004 13/33 Introspection See loaded assemblies Assembly [] assemblies = AppDomain.CurrentDomain.GetAssemblies(); foreach( Assembly assembly in assemblies ) Console.WriteLine( assembly.FullName );

14. 21 Jan 2004 14/33 Introspection See referenced assemblies AssemblyName[] referencedAssemblies = assembly.GetReferencedAssemblies(); foreach( AssemblyName assemblyName in referencedAssemblies ) Console.WriteLine( "--> {0}", assemblyName.FullName );

15. 21 Jan 2004 15/33 Introspection See the types defined in the assembly Assembly a = Assembly.LoadFrom("Teste.exe"); Module[] m = a.GetModules( ); Console.WriteLine("\n" + a.FullName ); Type[] types = m[0].GetTypes( ); foreach( Type type in types ) Console.WriteLine( "==> {0}", type.FullName );

16. 21 Jan 2004 16/33 Introspection See the methods defined in a type Assembly a = Assembly.LoadFrom("HelloWorld.exe"); Module[] m = a.GetModules( ); Type[] types = m[0].GetTypes( ); Type type = types[0]; MethodInfo[] mInfo = type.GetMethods( ); foreach ( MethodInfo mi in mInfo ) Console.WriteLine(" {0}", mi);

17. 21 Jan 2004 17/33 Assembly and Code Generation How to use System.Reflection.Emit to generate assemblies in run-time? AssemblyBuilder, ModuleBuilder, TypeBuilder, MethodBuilder, … ILGenerator

18. 21 Jan 2004 18/33 Assembly and Code Generation AssemblyName myAssemblyName = new AssemblyName(); myAssemblyName.Name = "MyAssembly"; myAssemblyName.Version = new Version("1.0.0.2004");

19. 21 Jan 2004 19/33 Assembly and Code Generation AssemblyBuilder myAssemblyBuilder = Thread.GetDomain().DefineDynamicAssembly(myAssemblyName, AssemblyBuilderAccess.RunAndSave); ModuleBuilder myModuleBuilder = myAssemblyBuilder.DefineDynamicModule("MyModule", fileName); TypeBuilder myTypeBuilder = myModuleBuilder.DefineType("MyType");

20. 21 Jan 2004 20/33 Assembly and Code Generation MethodBuilder myMethodBuilder = myTypeBuilder.DefineMethod("Main", MethodAttributes.Public | MethodAttributes.HideBySig |MethodAttributes.Static, typeof(void), null); ILGenerator myILGenerator = myMethodBuilder.GetILGenerator(); myILGenerator.EmitWriteLine("Hello World!"); myILGenerator.Emit(OpCodes.Ret);

21. 21 Jan 2004 21/33 Assembly and Code Generation myTypeBuilder.CreateType(); myAssemblyBuilder.SetEntryPoint(myMethodBuilder); myAssemblyBuilder.Save(fileName);

22. 21 Jan 2004 22/33 What is missing? Reflection Generation …

23. 21 Jan 2004 23/33 What is missing? Reflection Generation INTRUMENTATION… Structural Reflection Behavioural Reflection HOW TO DO IT?

24. 21 Jan 2004 24/33 …use RAIL http://rail.dei.uc.pt

25. 21 Jan 2004 25/33 Vision Statement “Create an API that allows CLR assemblies to be manipulated and instrumented before they are loaded and executed“ The reflection capabilities of the CLR are extremely powerful. Query the existing types at runtime Define new assemblies in memory and use Reflection.Emit to generate MSIL on-the-fly. Our plan is to fill the gap between these two concepts.

26. 21 Jan 2004 26/33 Process and Methodology Operating System program program.exe/dll PE Header MetadataIL ILx86 Source Code Compile Assembly JIT-compile RAIL

27. 21 Jan 2004 27/33 Process and Methodology

28. 21 Jan 2004 28/33 Key features ‘Rapid’ assembly instrumentation library High level of abstraction, no need for handling all the internal details Convenient object model for representation of all assembly modules Flexible MSIL instruction handling Use of design patterns

29. 21 Jan 2004 29/33 Application scenarios Runtime analysis tools Security verification MSIL optimization Application invisible proxy substitution Software fault injection Aspect Oriented Programming Others!

30. 21 Jan 2004 30/33 What can we really do with RAIL? Replace References Add epilogues and prologues to methods Redirect methods access/call Redirect field access Redirect field access to property Redirect field read and write access to methods Redirect property access Replace create new instructions with a static method Create, Run and Save assemblies

31. 21 Jan 2004 31/33 What can we really do with RAIL? private void Replace(MSIL.Code code, int pos) { MSIL.ILMethod ilm = new MSIL.ILMethod(OpCodes.Call, this.newMethod); code.Remove(pos); code.Insert(pos,ilm); } Play with MSIL code!!

32. 21 Jan 2004 32/33 Assembly Loading Interception ResolveEventHandler currentDomain.AssemblyResolve += new ResolveEventHandler(MyResolveEventHandler); Load the assembly ourselves Modify the CLR (SSCLI)??? Others??

33. 21 Jan 2004 33/33 Conclusion Code instrumentation is not a simple task With RAIL it’s easy to develop high level functionalities Assembly creation mechanisms can be very slow The design patterns are very useful