.NET Day 2019 - Abusing the C# compiler by Filip Wojcieszyn

.NET Day 2019 - Abusing the C# compiler by Filip Wojcieszyn

E6cffbf3b7a5fbfee4707033ef1636f5?s=128

dotnetday

May 28, 2019
Tweet

Transcript

  1. 1.
  2. 2.

    Filip W Filip W a random guy from the internet

    • • strathweb.com @ lip_woj github.com/ lipw
  3. 3.
  4. 6.
  5. 8.
  6. 11.

    High level C# building blocks High level C# building blocks

    C# Languague Speci cation ECMA Standard, ~500 pages ⚙ Roslyn Compiler compiles C# code to Common Intermediate Language Tooling powered by the C# Compiler CLR / CoreCLR compiles CIL to machine code
  7. 13.

    - Mads Torgersen, C# Lead Designer “ Customers will depend

    on the new compiler behaving exactly the same way as the old one. Writing a new compiler for C# means trying to match the old compiler bug-for-bug.
  8. 14.

    Invalid C#, compiler error Invalid C#, compiler error static class

    Foo {} class Bar { // error CS0722: 'Foo': static types cannot be used as return types Foo GetFoo() => null; }
  9. 15.

    Invalid C#, no compiler error Invalid C#, no compiler error

    static class Foo {} interface IBar { // compiles fine Foo GetFoo(); }
  10. 21.

    - Eric Lippert “ A common technique (...) is to

    have the compiler “lower” from high-level language features to low-level language features in the same language.
  11. 23.

    Emitted IL Emitted IL IL_0000: nop IL_0001: newobj instance void

    C::.ctor() IL_0006: stloc.0 .try { IL_0007: nop IL_0008: nop IL_0009: leave.s IL_0016 } // end .try finally { // sequence point: hidden IL_000b: ldloc.0 IL_000c: brfalse.s IL_0015 IL_000e: ldloc.0 IL_000f: callvirt instance void [mscorlib]System.IDisposable::Dispose() IL_0014: nop // sequence point: hidden IL_0015: endfinally } // end handler
  12. 24.

    “ This method terminates a process without running any active

    try/ nally blocks or nalizers. - Environment.FailFast(...)
  13. 25.

    So far we have managed to So far we have

    managed to ✅ Create an instance without calling a constructor ✅ Bypass a ' nally' clause ✅ Create an instance of an open generic