[转载]MSIL Instruction Table

原文地址：http://safari.oreilly.com/0735616485/IDABH1W

Throughout this text, I've often employed the ILDASM utility to illustrate the Microsoft intermediate language (MSIL) that the C# compiler generates. I used ILDASM to give you a more complete understanding of the lower-level workings of the C# compiler. Although I briefly explain what each MSIL instruction does in the context of the chapter in which the instruction is used, I thought it would be nice to have a central listing of all the instructions. In the following table, I list each MSIL instruction, its opcode, the parameters that are passed to the instruction, and the resulting stack transition.

Here are a few notes that should help you when reading the table:

• Because pushing means to place something on the stack, I use the phrase pushing a value rather than the more verbose pushing the value onto the stack.

• Because popping is widely understood to mean taking something off the stack, I use the phrase popping the value instead of the more verbose popping the value off the stack.

• When I use the word indirect, I'm referring to retrieving a value through its address. Therefore, the phrase pushes (indirect) value should be understood to mean pushes the value pointed at by an address onto the stack.

• The term native int represents a 32-bit integer on all 32-bit versions of Microsoft Windows.

• The letter F represents the native floating point.

• The state transition column is intended to illustrate a before-and-after picture of the stack. For example, the stack transition: "…, value1, value2-> …, result" indicates that before the instruction is executed, the stack must contain two values (value1,value2), and that after the instruction is executed, these values will be replaced with one value (result). Note that the ellipsis character simply indicates unknown values on the stack that have nothing to do with this instruction.

Table A-1. MSIL Instructions

Instruction (Opcode) Description Stack Transition add (0x58) Adds two values, pushing result ...,val1,val2->...,result add.ovf (0xD6) Adds integer values, pushing result; throws exception on overflow ...,val1,val2->...,result add.ovf.un (0xD7) Adds unsigned integer values, pushing result; throws exception on overflow ...,val1,val2->...,result and (0x5F) Bitwise AND of two integral values, pushing an integral value ...val1,val2->...,result arglist (0xFE 0x00) Pushes argument list handle for current method ...->...,argListHandle beq int32 (0x3B) Branches to specified offset if two top stack values are equal ...,value,value->... beq.s int8 (0x2E) Branches to specified offset if two top stack values are equal ...,value,value->... bge int32 (0x3C) Branches to specified offset if value1 is greater than or equal to value2 ...,value1,value2->... bge.s int8 (0x2F) Branches to specified offset if value1 is greater than or equal to value2 ...,value1,value2->... bge.un int32 (0x41) Branches to specified offset if value1 is greater than or equal to value2 (unsigned or unordered) ...,value1,value2->... bge.un.s int8 (0x34) Branches to specified offset if value1 is greater than or equal to value2 (unsigned or unordered) ...,value1,value2->... bgt int32 (0x3D) Branches to specified offset if value1 is greater than value2 ...,value1,value2->... bgt.s int8 (0x30) Branches to specified offset if value1 is greater than value2 ...,value1,value2->... bgt.un int32 (0x42) Branches to specified offset if value1 is greater than value2 (unsigned or unordered) ...,value1,value2->... bgt.un.s int8 (0x35) Branches to specified offset if value1 is greater than value2 (unsigned or unordered) ...,value1,value2->... ble int32 (0x3E) Branches to specified offset if value1 is less than or equal to value2 ...,value1,value2->... ble.s int8 (0x31) Branches to specified offset if value1 is less than or equal to value2 ...,value1,value2->... ble.un int32 (0x43) Branches to specified offset if value1 is less than or equal to value2 (unsigned or unordered) ...,value1,value2->... ble.un.s int8 (0x36) Branches to specified offset if value1 is less than or equal to value2 (unsigned or unordered) ...,value1,value2->... blt.un int32 (0x44) Branches to specified offset if value1 is less than value2 (unsigned or unordered) ...,value1,value2->... blt.un.s int8 (0x37) Branches to specified offset if value1 is less than value2 (unsigned or unordered) ...,value1,value2->... bne.un.s int8 (0x33) Branches to specified offset if value1 isn't equal to value2 (unsigned or unordered) ...,value1,value2->... blt int32 (0x3F) Branches to specified offset if value1 is less than value2 ...,value1,value2->... blt.s int8 (0x32) Branches to specified offset if value1 is less than value2 ...,value1,value2->... bne.un int32 (0x40) Branches to specified offset if value1 isn't equal to value2 (unsigned or unordered) ...,value1,value2->... box type (0x8C) Converts value type to object reference ...,valType->...,obj br int32 (0x38) Unconditional branch to specified offset ...->... br.s int8 (0x2B) Branches to specified offset ...->... Break (0x01) Informs the debugger that a breakpoint has been reached ...->... brfalse int32 (0x39) Branches to specified offset if value on stack is false ...,value->... brfalse.s int8 (0x2C) Branches to specified offset if value on stack is false ...,value->... brtrue int32 (0x3A) Branches to specified offset if value on stack is true ...,value->... brtrue.s int8 (0x2D) Branches to specified offset if value on stack is true ...,value->... call method (0x28) Calls a method ...->... calli signature (0x29) Calls method indicated by address on stack; stack also contains 1...n arguments

...,arg1,arg2,argN, method->retVal

(retVal is not always pushed onto the stack as a result of the calli signature instruction.)

callvirt method (0x6F) Calls virtual method of obj

...,obj,arg1... argn->...,retVal

(Not always pushed onto the stack for the callvirt method instruction.)

castclass type (0x74) Casts obj to class ...,obj->...,obj2 ceq (0xFE 0x01) Compares equality of two values on stack; pushes 1 if equal; otherwise, pushes 0 ...,val1,val2->...,result cgt (0xFE 0x02) Compares to see whether val1 is greater than val2; pushes 1 if true and 0 if false ...,val1,val2->...,result cgt.un (0xFE 0x03) Compares to see whether val1 is greater than val2 (unsigned or unordered); pushes 1 if true and 0 if false ...,val1,val2->...,result ckfinite (0xC3) Checks for a finite real number; exception thrown if not a number (NaN) or (+/-)infinity; otherwise, value is left on stack ...,value->...,value clt (0xFE 0x04) Compares to see whether val1 is less than val2; pushes 1 if true and 0 if false ...,val1,val2->...,result clt.un (0xFE 0x05) Compares to see whether val1 is less than val2 (unsigned or unordered); pushes 1 if true and 0 if false ...,val1,val2->...,result conv.i (0xD3) Converts value to native int, pushing resulting native int ...,value->...,result conv.i1 (0x67) Converts value to int8, pushing int32 ...,value->...,result conv.i2 (0x68) Converts value to int16, pushing int32 ...,value->...,result conv.i4 (0x69) Converts value to int32, pushing int32 ...,value->...,result conv.i8 (0x6A) Converts value to int64, pushing int64 ...,value->...,result conv.ovf.i (0xD4) Converts value to native int, pushing resulting native int; throws exception on overflow ...,value->...,result conv.ovf.i.un (0x8A) Converts unsigned value to native int, pushing resulting native int; throws exception on overflow ...,value->...,result conv.ovf.i1 (0xB3) Converts value to int8, pushing resulting int32; throws exception on overflow ...,value->...,result conv.ovf.i1.un (0x82) Converts value to uint8, pushing resulting int32; throws exception on overflow ...,value->...,result conv.ovf.i2 (0xB5) Converts value to int16, pushing resulting int32; throws exception on overflow ...,value->...,result conv.ovf.i2.un (0x83) Converts value to uint16, pushing resulting int32; throws exception on overflow ...,value->...,result conv.ovf.i4 (0xB7) Converts value to int32, pushing resulting int32; throws exception on overflow ...,value->...,result conv.ovf.i4.un (0x84) Converts value to uint32, pushing resulting int32; throws exception on overflow ...,value->...,result conv.ovf.i8 (0xB9) Converts value to int64, pushing resulting int64; throws exception on overflow ...,value->...,result conv.ovf.i8.un (0x85) Converts value to uint64, pushing resulting int64; throws exception on overflow ...,value->...,result conv.ovf.u (0xD5) Converts value to native unsigned int, pushing resulting native unsigned int; throws exception on overflow ...,value->...,result conv.ovf.u.un (0x8B) Converts unsigned value to native unsigned int, pushing resulting native int; throws exception on overflow ...,value->...,result conv.ovf.u2 (0xB6) Converts value to uint16, pushing resulting int32; throws exception on overflow ...,value->...,result conv.ovf.u2.un (0x87) Converts unsigned value to uint16, pushing resulting int32; throws exception on overflow ...,value->...,result conv.ovf.u4 (0xB8) Converts value to uint32, pushing resulting int32; throws exception on overflow ...,value->...,result conv.ovf.u4.un (0x88) Converts unsigned value to uint32, pushing resulting int32; throws exception on overflow ...,value->...,result conv.ovf.u8 (0xBA) Converts value to uint16, pushing resulting int64; throws exception on overflow ...,value->...,result conv.ovf.u8.un (0x89) Converts unsigned value to uint64, pushing resulting int64; throws exception on overflow ...,value->...,result conv.ovf.u1 (0xB4) Converts value to uint8, pushing resulting int32; throws exception on overflow ...,value->...,result conv.ovf.u1.un (0x86) Converts unsigned value to uint8, pushing resulting int32; throws exception on overflow ...,value->...,result conv.r.un (0x76) Converts unsigned integer to floating point, pushing F ...,value->...,result conv.r4 (0x6B) Converts value to float32, pushing F ...,value->...,result conv.r8 (0x6C) Converts value to float64, pushing F ...,value->...,result conv.u (0xE0) Converts value to native unsigned int, pushing native int ...,value->...,result conv.u1 (0xD2) Converts value to uint8, pushing resulting int32 ...,value->...,result conv.u2 (0xD1) Converts value to uint16, pushing resulting int32 ...,value->...,result conv.u4 (0x6D) Converts value to uint32, pushing int32 ...,value->...,result conv.u8 (0x6E) Converts value to uint32, pushing int32 ...,value->...,result cpblk (0xFE 0x17) Copies size bytes from srcAddr to destAddr in memory ...,destAddr,srcAddr, size->... cpobj type (0x70) Copies a value type ...,destAddr, srcAddr->... div (0x5B) Divides value1 by value2, pushing result ...,val1,val2->...,result div.un (0x5C) Divides (unsigned) integer values, pushing result ...,val1,val2->...,result dup (0x25) Duplicates the value at top of stack ...,value-> ...,value,value endfilter (0xFE 0x11) Returns from the filter clause of an SEH exception ...,value->... endfinally (0xDC) Returns from a finally clause ...->... jmp method (0x27) Transfers control to the specified method ...->... initblk (0xFE 0x18) Initializes a block of size memory starting at addr with value ...,addr,value,size->... initobj classToken (0xFE 0x15) Initializes a value type ...,valueObjAddr->... isinst type (0x75)

Tests whether an object is an instance of a type or interface, pushing resulting cast if successful or null on failure.

(A null is defined by the CLI as zero (having a bit pattern of all bits zero).)

...,obj->...,result ldarg uint32 (0xFE 0x09) Pushes argument at specified index ...->...,value ldarg.0 (0x02) Pushes the first argument of a method ...->...,value ldarg.1 (0x03) Pushes the second argument of a method ...->...,value ldarg.2 (0x04) Pushes the third argument of a method ...->...,value ldarg.3 (0x05) Pushes the fourth argument of a method ...->...,value ldarg.s uint8 (0x0E) Pushes specified argument ...->...,value ldarga uint32 (0xFE 0x0A) Pushes address of argument at specified index ...->...,address ldarga.s uint8 (0x0F) Pushes address of specified argument ...->...,value ldc.i4.m1 (0x15) Pushes the literal value, -1 ...->...,-1 ldc.i4 int32 (0x20) Pushes specified 32-bit value ...-> ...,value ldc.i4.0 (0x16) Pushes the literal value, 0 ...->...,0 ldc.i4.1 (0x17) Pushes the literal value, 1 ...->...,1 ldc.i4.2 (0x18) Pushes the literal value, 2 ...->...,2 ldc.i4.3 (0x19) Pushes the literal value, 3 ...>...,3 ldc.i4.4 (0x1A) Pushes the literal value, 4 ...->...,4 ldc.i4.5 (0x1B) Pushes the literal value, 5 ...->...,5 ldc.i4.6 (0x1C) Pushes the literal value, 6 ...->...,6 ldc.i4.7 (0x1D) Pushes the literal value, 7 ...->...,7 ldc.i4.8 (0x1E) Pushes the literal value, 8 ...->...,8 ldc.i4.s int8 (0x1F) Pushes specified 8-bit value as 32-bit ...->...,value ldc.i8 int64 (0x21) Pushes specified 64-bit value ...->...,value ldc.r4 float32 (0x22) Pushes specified 32-bit floating point ...->...,value ldc.r8 float64 (0x23) Pushes specified 64-bit floating point ...->...,value ldelem.i (0x97) Pushes array element (native int) as native int ...array,index->..., value ldelem.i1 (0x90) Pushes array element (int8) as int32 ...array,index->..., value ldelem.i2 (0x92) Pushes array element (int16) as int32 ...array,index->..., value ldelem.i4 (0x94) Pushes array element (int32) as int32 ...array,index->..., value ldelem.i8 (0x96) Pushes array element (int64) as int64 ...array,index->..., value ldelem.r4 (0x98) Pushes array element (float32) as F ...array,index->..., value ldelem.r8 (0x99) Pushes array element (float64) as F ...array,index->..., value ldelem.ref (0x9A) Pushes array element (object) as object ...array,index->..., value ldelem.u1 (0x91) Pushes array element (uint8) as int32 ...array,index-> ...,value ldelem.u2 (0x93) Pushes array element (uint16) as int32 ...array,index-> ...,value ldelem.u4 (0x95) Pushes array element (uint32) as int32 ...array,index-> ...,value ldelema type (0x8F) Pushes the address of an array element ...,array,index-> ...,addr ldfld field (0x7B) Pushes field of an object ...,obj->...,value ldflda field (0x7C) Pushes field address of an object ...,obj->...,addr ldftn method (0xFE 0x06) Pushes the method pointer referenced by method ...->...,ftn ldind.i (0x4D) Pushes (indirect) value of type native int as native int ...,addr->...,value ldind.i1 (0x46) Pushes (indirect) value of type int8 as int32 ...,addr->...,value ldind.i2 (0x48) Pushes (indirect) value of type int16 as int32 ...,addr->...,value ldind.i4 (0x4A) Pushes (indirect) value of type int32 as int32 ...,addr->...,value ldind.i8 (0x4C) Pushes (indirect) value of type int64 as int64 ...,addr->...,value ldind.u1 (0x47) Pushes (indirect) value of type uint8 as int32 ...,addr->...,value ldind.u2 (0x49) Pushes (indirect) value of type uint16 as int32 ...,addr->...,value ldind.u4 (0x4B) Pushes (indirect) value of type uint32 as int32 ...,addr->...,value ldind.r4 (0x4E) Pushes (indirect) value of type float32 as F ...,addr->...,value ldind.r8 (0x4F) Pushes (indirect) value of type float64 as F ...,addr->...,value ldind.ref (0x50) Pushes (indirect) object ref as o ...,addr->...,value ldlen (0x8E) Pushes the length of an array ...,array->...,length ldloc uint32 (0xFE 0x0C) Pushes local variable at specified index ...->...,value ldloc.0 (0x06) Pushes the first local variable ...->...,value ldloc.1 (0x07) Pushes the second local variable ...->...,value ldloc.2 (0x08) Pushes the third local variable ...->...,value ldloc.3 (0x09) Pushes the fourth local variable ...->...,value ldloc.s uint8 (0x11) Pushes the specified local variable ...->...,value ldloca uint32 (0xFE 0x0D) Pushes address of local variable at specified index ...->...,address ldloca.s uint8 (0x12) Pushes address of specified local variable ...->...,value ldnull (0x14) Pushes null reference ...->...,null ldobj type (0x71) Pushes value ...,addrValueObj-> ...,valueObj ldsfld field (0x7E) Pushes static field of an object ...->...,value ldsflda field (0x7F) Pushes static field address of an object ...->...,value ldstr type (0x72) Pushes a literal string ...,->..,string ldtoken token (0xD0) Loads the common language runtime representation of a metadata token ...->...,runtimeHandle ldvirtftn method (0xFE 0x07) Pushes the method pointer referenced by method ...,obj->...,ftn leave int32 (0xDD) Branches out of a protected block of code (try, filter, catch) to target (int32 offset) ...->... leave.s int8 (0xDE) Branches out of a protected block of code (try, filter, catch) to target (int8 offset) ...->... localloc (0xFE 0x0F) Allocates size (native unsigned int) bytes from the local dynamic memory pool and pushes address ...,size->...,address mkrefany type (0xC6) Pushes a typed reference on the stack ...,ptr->...,typedRef mul (0x5A) Multiplies two values, pushing result ...,val1,val2->...,result mul.ovf (0xD8) Multiplies signed integer values, pushing result; throws exception on overflow ...,val1,val2->...,result mul.ovf.un (0xD9) Multiplies unsigned signed integer values, pushing result; throws exception on overflow ...,val1,val2->...,result neg (0x65) Negates the value on the stack ...,value->...,result newarr elementType (0x8D) Creates a one-dimensional array of elementType ...,numberOfElements->...,array newobj method (0x73) Creates a new object (calling its ctor) ...,arg1...argn->...,obj not (0x66) Computes bitwise complement of value on stack, pushing result ...,value->...,result nop (0x00) Null operation used only to fill in space if bytecodes are patched ...->... or (0x60) Bitwise OR of two integral values, pushing an integral value ...val1,val2->...,result pop (0x26) Pops top element of stack ...,value->... refanytype (0xFE 0x1D) Pushes the type token out of typed reference ...,typedRef->...,type refanyval type (0xC2) Loads the address out of a typed reference ...,typedRef->...,addr rem (0x5D) Computes remainder of dividing value1 by value2 ...,val1,val2->...,result rem.un (0x5E) Computes remainder of dividing value1 by value2 (both unsigned) ...,val1,val2->...,result ret (0x2A) Returns control from current method to caller

...,retVal->

(Not always pushed onto the stack for the ret instruction.)

...,retVal

(Not always pushed onto the stack for the ret instruction.)

rethrow (0xFE 0x1A) Only valid within a catch block; this instruction rethrows the current exception back up the call stack ...->... shl (0x62) Shift-left operation in which signed integer value and number of decimal places to shift are on stack ...,value,shiftAmount-> ...,result shr (0x63) Shift-right operation in which signed integer value and number of decimal places to shift are on stack ...,value,shiftAmount-> ...,result shr.un (0x64) Shift-right operation in which unsigned integer value and number of decimal places to shift are on stack ...,value,shiftAmount-> ...,result sizeof valueType (0xFE 0x1C) Pushes the size (in bytes) of the specified valueType ...->...,size starg uint32 (0xFE 0x0B) Stores a value to argument at specified index ...,value->... starg.s uint8 (0x10) Pops value to specified method argument ...,value ->... stelem.i (0x9B) Overwrites array element at index with value on the stack ...,array,index,value-> ... stelem.i1 (0x9C) Overwrites array element at index with int8 value on the stack ...,array,index,value-> ... stelem.i2 (0x9D) Overwrites array element at index with int16 value on the stack ...,array,index,value-> ... stelem.i4 (0x9E) Overwrites array element at index with int32 value on the stack ...,array,index,value-> ... stelem.i8 (0x9F) Overwrites array element at index with int64 value on the stack ...,array,index,value-> ... stelem.r4 (0xA0) Overwrites array element at index with float32 value on the stack ...,array,index,value-> ... stelem.r8 (0xA1) Overwrites array element at index with float64 value on the stack ...,array,index,value-> ... stelem.ref (0xA2) Overwrites array element at index with reference value on the stack ...array,index,value-> ... stfld field (0x7D) Stores into a field of an object ...,obj,value->... stind.ref (0x51) Stores object reference value into addr ...,addr,value->... stind.i (0xDF) Stores native int value into addr ...,addr,value->... stind.i1 (0x52) Stores int8 value at addr ...,addr,value->... stind.i2 (0x53) Stores int16 value at addr ...,addr,value->... stind.i4 (0x54) Stores int32 value at addr ...,addr,value->... stind.i8 (0x55) Stores int64 value at addr ...,addr,value->... stind.r4 (0x56) Stores float32 value at addr ...,addr,value->... stind.r8 (0x57) Stores float64 value at addr ...,addr,value->... stloc uint32 (0xFE 0x0E) Pops value to local variable at specified index ...,value->... stloc.0 (0x0A) Pops value to first local variable ...,value ->... stloc.1 (0x0B) Pops value to second local variable ...,value ->... stloc.2 (0x0C) Pops value to third local variable ...,value ->... stloc.3 (0x0D) Pops value to fourth local variable ...,value ->... stloc.s uint8 (0x13) Pops value to specified local variable ..,value ->... stobj type (0x81) Copies valObj into addr ...,addr,valObj->... stsfld field (0x80) Stores a static field ...,value->... sub (0x59) Subtracts value2 from value1, pushing result ...,val1,val2->...,result sub.ovf (0xDA) Subtracts integer values, pushing result; throws exception on overflow ...,val1,val2->...,result sub.ovf.un (0xDB) Subtracts unsigned integer values, pushing result; throws exception on overflow ...,val1,val2->...,result switch uint32 (N) + N(int32) (0x45) Implements a jump table in which first argument (uint32) is number of targets (specified as offsets); remaining arguments (int32) are the target offsets ...,value->... tail (0xFE 0x14) This prefix indicates termination of current method via subsequent call, calli, or callvirt instructions ...->... throw (0x7A) Throws an exception of type o ...,object->... unaligned uint8 (0xFE 0x12) Specifies that addr shouldn't be aligned ...,addr->...,addr unbox type (0x79) Converts boxed value type to raw form ...,obj->..., valueTypePtr volatile (0xFE 0x13) This prefix specifies that the pointer reference (on the stack) is volatile ...,addr->...,addr xor (0x61) Bitwise exclusive OR of two integral values, pushing an integral value ...val1,val2->...,result