ILDasm

ILDasm
Name	ILDasm
Developer	Microsoft Corporation
Released	2000
Latest release	2015
Programming language	C++
Operating system	Microsoft Windows
Genre	Disassembler

ILDasm ILDasm is a Microsoft-developed disassembler for the Common Intermediate Language used in the .NET ecosystem. It provides developers a textual representation of assemblies produced by compilers such as those from Microsoft and third parties, enabling inspection and analysis of binaries created for platforms supported by Windows, Visual Studio, and Azure. The tool is commonly used alongside other Microsoft utilities and integrated development tools for debugging, learning, and reverse engineering tasks.

Overview

ILDasm was created to expose the internal structure of assemblies produced by compilers like those in Visual Studio and Mono Project toolchains such as Roslyn and Mono C# compiler. It targets the Common Intermediate Language specified by the ECMA-335 standard and reads Portable Executable files produced on platforms including Windows 10, Windows Server 2016, and earlier releases such as Windows XP and Windows Vista. The disassembler interacts with metadata formats defined by Microsoft and influenced by work from organizations such as ECMA International and implementations including Dotfuscator and ILRepack.

ILDasm is distributed with packages such as the .NET Framework SDK and tools distributed via Visual Studio SDKs and integrates with services like Azure DevOps for build and release pipelines. It complements utilities like ILDASM.exe alternatives and third-party projects such as dnSpy, ILSpy, Reflector, JustDecompile, and dotPeek in analyses of assemblies compiled by compilers like C# Compiler and VB.NET Compiler.

Features and Functionality

ILDasm exposes metadata tables and method bodies by parsing structures defined in ECMA-335 and presenting them in human-readable forms similar to the syntax used by compilers like Roslyn and tools such as csc.exe. It supports viewing manifest resources embedded by projects authored in environments like Visual Studio Code and build systems such as MSBuild and Team Foundation Server. The tool can display Intermediate Language instructions, metadata tokens, and assembly references produced by compilers including Visual C++/CLI and managed languages supported by projects from organizations such as Xamarin and Mono Project.

Key capabilities include showing type definitions and method signatures used by frameworks like .NET Core and .NET Framework, enumerating custom attributes used by libraries from vendors like Microsoft and JetBrains, and dumping resources compatible with runtimes such as CoreCLR and Mono Runtime. It is useful when combined with debugging symbols generated by tools like PDB format producers and analyzers such as WinDbg, dotnet-trace, and PerfView.

Command-Line and GUI Usage

ILDasm ships with both a graphical user interface and command-line options usable in environments like Windows Command Prompt, PowerShell, and automated CI runners in Azure DevOps or Jenkins. The GUI permits interactive exploration of assemblies created by projects from GitHub repositories and samples from Microsoft Docs, while command-line flags enable scripted extraction of IL and metadata for consumption by tools like sed, awk, and grep on systems orchestrated by Ansible or Chef.

Common usage patterns integrate ILDasm into debugging workflows with tools such as Visual Studio Debugger, WinDbg, and decompilers like ILSpy and dnSpy to correlate IL with source code produced in C#, Visual Basic .NET, and third-party languages supported by the Common Language Infrastructure. Developers often invoke ILDasm to produce IL listings for inspection during code reviews in platforms like GitHub, GitLab, and Bitbucket.

File Format and Output

ILDasm reads Portable Executable files conforming to the PE/COFF specifications used by Windows NT-based operating systems and parses metadata organized as per the ECMA-335 partitioning for assemblies. Output options include textual IL listings and separate Resource and Manifest dumps similar to artifacts created by packaging tools in the NuGet ecosystem and installers authored for platforms such as Windows Installer and MSIX.

The disassembler renders method bodies as opcode sequences, token references to types and methods found in assemblies such as mscorlib and System.Private.CoreLib, and attribute declarations comparable to syntax produced by compilers in Roslyn outputs. It can emit manifests used to inspect strong names and signatures applied by authorities like Microsoft and third-party publishers distributing binaries through channels such as Microsoft Store or enterprise deployment tools like System Center Configuration Manager.

Development History and Versions

ILDasm originated as part of tooling for the early .NET releases during the era of products such as Visual Studio .NET 2002 and has evolved alongside major platform milestones including .NET Framework 2.0, .NET Framework 4.0, and the later unification effort leading to .NET 5. Distribution methods have shifted from boxed SDKs sold by Microsoft to downloadable SDK and runtime bundles available via Microsoft Download Center and package managers such as Chocolatey and Winget.

Over time, ILDasm’s codebase and feature set were influenced by community projects like Mono ILDASM implementations and alternative disassemblers from organizations including JetBrains and open-source efforts hosted on platforms such as GitHub and SourceForge. Major milestones correspond to releases of runtimes like CoreCLR and toolchain changes introduced with Roslyn and .NET Core SDK distributions, affecting behavior for assemblies targeting different runtime versions and metadata schemas.

Reception and Use Cases

ILDasm has been widely cited in developer documentation and training resources provided by institutions such as Microsoft Learn, Pluralsight, and universities offering courses on platforms like Coursera and edX. It is recommended in scenarios ranging from debugging compiler output in Visual Studio to security analysis workflows used by teams at companies like Google, Amazon, Facebook, and consultancies offering software audits.

Typical use cases include educational exploration of IL by authors of books published by houses such as O'Reilly Media and Manning Publications, troubleshooting interoperability issues in projects deployed to environments like Azure and AWS, and forensic analysis in incident response teams using toolchains that include WinDbg and Sysinternals utilities. ILDasm remains a foundational tool for engineers, researchers, and instructors working with managed code on Windows platforms.

Category:Microsoft software