DisasMSIL and CFF Explorer

[Daniel Pistelli]

Today I wrote a free/open disasm engine for Microsoft's Intermediate Language (MSIL).

http://ntcore.com/Files/disasmsil.htm

You can use it any context you wish. There are no license restrictions. The only thing I ask you to do is to send me your bug fixes (if any).

I also added the MSIL disasm engine to the CFF Explorer which is now able to disassemble the methods' code directly from the MetaData tables.

http://ntoskrnl.pmode.net/img/cffmsil2008.jpg

I hope you aren't already fed up with me and my updates =)

[rendari]

Yay

[soft123123]

yeah, of coz everyone like it. thx

[Daniel Pistelli]

Thanks! Good to know =)

[GEEK]

Nice work Daniel
how many hours do you code a day?

[dELTA]

Leet as ever Daniel, you da man.

CRCETL:
http://www.woodmann.com/collaborative/tools/index.php/DisasMSIL

[Daniel Pistelli]

Thanks! Well, it depends on what I have to do. I can go from regular 3 hours up to 16-17. When I do that, I only eat one time a day, otherwise it couldn't be done. But you shouldn't think that DisasMSIL took me so long. Writing the library, the article and implementing all that into the CFF Explorer took me about ten hours. I also lost an hour or more of time because I didn't know that the VC++ doesn't accept spaces after \ characters in macros:

#define ciao(s) MessageBox(0, _T("hello"), \
_T("hi"), MB_ICONINFORMATION)


This, for instance, is not a valid macro because, even if you can't see it, there's a space after the backslash. The VC++ will tell you that there's an illegal escape sequence. I really didn't know this as I usually don't use complex macros.

EDIT: Thanks dELTA! Sorry, we posted together, just saw your post. =)
Oh and while I'm at it, I wanted to thank dELTA for his effort to keep the CRCETL up-to-date and also the other admins who keep this place "clean" and high-level.

[dELTA]

Thanks. All of us (including you) each do our own kind of work to forward the world of reversing the best way possible.

[FaTaL_PrIdE]

Thanks Daniel - top work. And thank you for sharing your excellent contributions with us