MSIL Instruction Set
Base Instructions
| Instruction | Description | Stack Transition | |
| 1 | add | add two values, returning a new value | …, value1, value2…, result |
| 2 | add.ovf.<signed> | add integer value with overflow check | …, value1, value2…, result |
| 3 | and | bitwise AND | …, value1, value2 …, result |
| 4 | arglist | get argument list | … …, argListHandle |
| 5 | beq.<length> | branch on equal | …, value1, value2 … |
| 6 | bge.<length> | branch on greater than or equal to | …, value1, value2 … |
| 7 | bge.un.<length> | branch on greater/equal, unsigned or unordered | …, value1, value2 … |
| 8 | bgt.<length> | branch on greater than | …, value1, value2 … |
| 9 | bgt.un<length> | branch on greater than, unsigned or unordered | …, value1, value2 … |
| 10 | ble.<length> | branch on less than or equal to | …, value1, value2 … |
| 11 | ble..un<length> | branch on less/equal, unsigned or unordered | …, value1, value2 … |
| 12 | blt.<length> | branch on less than | …, value1, value2 … |
| 13 | blt.un.<length> | branch on less than, unsigned or unordered | …, value1, value2 … |
| 14 | bne.un<length> | branch on not equal or unorded | …, value1, value2 … |
| 15 | br.<length> | unconditional branch | …, … |
| 16 | break | breakpoint instruction | …, … |
| 17 | brfalse.<length> | branch on false, null, or zero | …, value … |
| 18 | brtrue.<length> | branch on non-false or non-null | …, value … |
| 19 | call | call a method | …, arg1, arg2 … argn …, retVal (not always returned) |
| 20 | calli | indirect method call | …, arg1, arg2 … argn, ftn …, retVal (not always returned) |
| 21 | ceq | compare equal | …, value1, value2…, result |
| 22 | cgt | compare greater than | …, value1, value2…, result |
| 23 | cgt.un | compare greater than, unsigned or unordered | …, value1, value2…, result |
| 24 | ckfinite | check for a finite real number | …, value …, value |
| 25 | clt | compare less than | …, value1, value2…, result |
| 26 | clt.un | compare less than, unsigned or unordered | …, value1, value2…, result |
| 27 | conv.<to type> | data conversion | …, value …, result |
| 28 | conv.ovf<to type> | data conversion with overflow detection | …, value …, result |
| 29 | conv.ovf.<to type>.un | unsigned data conversion with overflow detection | …, value …, result |
| 30 | cpblk | copy data from memory to memory | …, destaddr, srcaddr, size … |
| 31 | div | divide values | …, value1, value2…, result |
| 32 | div.un | divide integer values, unsigned | …, value1, value2…, result |
| 33 | dup | duplicate the top value of the stack | …, value …, value, value |
| 34 | endfilter | end filter clause of SEH | …, value … |
| 35 | endfinally | end the finally or fault clause of exception block | … … |
| 36 | initblk | initialize a block of memory to a value | …, addr, value, size … |
| 37 | jmp | jump to method | … … |
| 38 | ldarg.<length> | load argument onto the stack | … …, value |
| 39 | ldarga.<length> | load an argument address | …, …, address of argument number argNum |
| 40 | ldc.<type> | load numeric constant | … …, num |
| 41 | ldftn | load method pointer | … …, ftn |
| 42 | ldind.<type> | load value indirect onto the stack | …, addr …, value |
| 43 | ldloc | load local variable onto the stack | … …, value |
| 44 | ldloca.<length> | load local variable address | … …, address |
| 45 | ldnull | load a null pointer | … …, null value |
| 46 | leave.<length> | exit a protected region of code | …, |
| 47 | localloc | allocate space in the local dynamic memory pool | size address |
| 48 | mul | multiply values | …, value1, value2 …, result |
| 49 | mul.ovf<type> | multiply integer values with overflow check | …, value1, value2 …, result |
| 50 | neg | negate | …, value …, result |
| 51 | nop | no operation | …, …, |
| 52 | not | bitwise complement | …, value …, result |
| 53 | or | bitwise OR | …, value1, value2 …, result |
| 54 | pop | remove the top element of the stack | …, value … |
| 55 | rem | compute the remainder | …, value1, value2 …, result |
| 56 | rem.un | compute integer remainder, unsigned | …, value1, value2 …, result |
| 57 | ret | return from method | retValon callee evaluation stack (not always present) …, retValon caller evaluation stack (not always present) |
| 58 | shl | shift integer left | …, value, shiftAmount …, result |
| 59 | shr | shift integer right | …, value, shiftAmount …, result |
| 60 | shr.un | shift integer right, unsigned | …, value, shiftAmount …, result |
| 61 | starg.<length> | store a value in an argument slot | …, value …, |
| 62 | stind.<type> | store value indirect from stack | …, addr, val … |
| 63 | stloc | pop value from stack to local variable | …, value … |
| 64 | sub | substract numeric values | …, value1, value2 …, result |
| 65 | sub.ovf.<type> | substract integer values, checking for overflow | …, value1, value2 …, result |
| 66 | switch | table switch on value | …, value …, |
| 67 | xor | bitwise XOR | ..., value1, value2 ..., result |
Object Model Instructions
| Instruction | Description | Stack Transition | |
| 1 | box | convert value type to object reference | …, valueType …, obj |
| 2 | callvirt | call a method associated, a runtime, with an object | …, obj, arg1, … argN …, returnVal (not always returned) |
| 3 | cast class | cast an object to a class | …, obj …, obj2 |
| 4 | cpobj | copy a value type | …, destValObj, srcValObj …, |
| 5 | initobj | Initialize a value type | …,addrOfValObj …, |
| 6 | isinst | test if an object is is an instance of a class or interface | …, obj …, result |
| 7 | ldelem.<type> | load an element fo an array | …,array, index …, value |
| 8 | ldelema | load address of an element of an array | …, array, index …, address |
| 9 | ldfld | load field of an object | …,obj …, value |
| 10 | ldflda | load field address | …,obj …, address |
| 11 | ldlen | load the length of an array | …, array …, length |
| 12 | ldobj | copy value type to the stack | …, addrOfValObj …, valObj |
| 13 | ldsfld | load static field of a class | …, …, value |
| 14 | ldsflda | load static field address | …, …, address |
| 15 | ldstr | load a literal string | …, …, string |
| 16 | ldtoken | load the runtime representation of metadata token | … …, RuntimeHandle |
| 17 | ldvirtfn | load a virtual method pointer | … object …, ftn |
| 18 | mkrefany | push a typed reference on the stack | …, ptr …, typedRef |
| 19 | newarr | Create a zero-base, on-dimensional array | …, numElems …, array |
| 20 | newobj | create a new object | …, arg1, … argN …, obj |
| 21 | refanytype | load the type out of a typed reference | …,TypedRef …, type |
| 22 | refanyval | load the address out of a typed reference | …,TypedRef …, address |
| 23 | rethrow | rethrow the current exception | …, …, |
| 24 | sizeof | load the size in bytes of a value type | …, …, size (4 bytes, unsigned) |
| 25 | stelem.<type> | store an element of an array | …, array, index, value …, |
| 26 | stfld | store into a field of an object | …, obj, value …, |
| 27 | stobj | store a value type from the stack into memory | …, addr, valObj …, |
| 28 | stsfld | store a static field of class | …, val …, |
| 29 | throw | throw an exception | …, object …, |
| 30 | unbox | convert boxed value type to its raw form |