Module `refinery.lib.dotnet.header`

Parsing of the .NET header. The code is based on the description in 1.

References

Expand source code Browse git

"""
Parsing of the .NET header. The code is based on the description in [1].

References:
  [1]: https://www.ntcore.com/files/dotnetformat.htm
"""
from __future__ import annotations

from refinery.lib import lief
from refinery.lib.dotnet.types import (
    Box,
    Byte,
    NullTerminatedString,
    ParserEOF,
    ParserException,
    RawBytes,
    StreamReader,
    StringGUID,
    StringPrimitive,
    Struct,
    UInt16,
    UInt32,
    UInt64,
    UnicodeString,
    unpack,
)


class InvalidDotNetHeader(ValueError):
    def __init__(self, msg=None):
        ValueError.__init__(self, msg or '.NET parsing failed: corrupt header.')


class InvalidSignature(InvalidDotNetHeader):
    def __init__(self):
        ValueError.__init__(self, '.NET parsing failed: Invalid signature.')


class BitMask:
    def __init__(self, bitmask):
        self._bitmask = bitmask

    def __contains__(self, pos):
        return self[pos] == 1

    def __len__(self):
        return self._bitmask.bit_length()

    def __getitem__(self, pos):
        return (self._bitmask >> pos) & 1

    def __iter__(self):
        for k in range(len(self)):
            if k in self:
                yield k

    def __repr__(self):
        return f'{self._bitmask:b}'


def bits_required(n):
    return 0 if not n else (n - 1).bit_length()


class MultiTableIndex(Struct):
    _name_to_id = {
        'Assembly'               : 0x20,
        'AssemblyOS'             : 0x22,
        'AssemblyProcessor'      : 0x21,
        'AssemblyRef'            : 0x23,
        'AssemblyRefOS'          : 0x25,
        'AssemblyRefProcessor'   : 0x24,
        'ClassLayout'            : 0x0F,
        'Constant'               : 0x0B,
        'CustomAttribute'        : 0x0C,
        'ENCLog'                 : 0x1E,
        'ENCMap'                 : 0x1F,
        'Event'                  : 0x14,
        'EventMap'               : 0x12,
        'EventPtr'               : 0x13,
        'ExportedType'           : 0x27,
        'Field'                  : 0x04,
        'FieldLayout'            : 0x10,
        'FieldMarshal'           : 0x0D,
        'FieldPtr'               : 0x03,
        'FieldRVA'               : 0x1D,
        'File'                   : 0x26,
        'GenericParam'           : 0x2A,
        'GenericParamConstraint' : 0x2C,
        'ImplMap'                : 0x1C,
        'InterfaceImpl'          : 0x09,
        'ManifestResource'       : 0x28,
        'MemberRef'              : 0x0A,
        'MethodDef'              : 0x06,
        'MethodImpl'             : 0x19,
        'MethodPtr'              : 0x05,
        'MethodSemantics'        : 0x18,
        'MethodSpec'             : 0x2B,
        'Module'                 : 0x00,
        'ModuleRef'              : 0x1A,
        'NestedClass'            : 0x29,
        'Param'                  : 0x08,
        'ParamPtr'               : 0x07,
        'Permission'             : 0x0E,
        'Property'               : 0x17,
        'PropertyMap'            : 0x15,
        'PropertyPtr'            : 0x16,
        'StandAloneSig'          : 0x11,
        'TypeDef'                : 0x02,
        'TypeRef'                : 0x01,
        'TypeSpec'               : 0x1B,
    }
    refs = ()

    def __init__(self, reader, rows):
        if not self.refs:
            raise NotImplementedError
        row_max_len = max(
            rows.get(self._name_to_id[n], 0)
            for n in self.refs if n is not None
        )
        bits = self.bits + bits_required(row_max_len)
        Type = UInt32 if bits > 16 else UInt16
        Struct.__init__(self, reader, _type=Type)

    def __len__(self):
        return len(self.refs)

    @property
    def bits(self):
        return bits_required(len(self))

    @property
    def mask(self):
        return (1 << self.bits) - 1

    def parse(self):
        raw = self.expect(self._type)
        try:
            self.RowName = self.refs[raw & self.mask]
        except IndexError:
            self.Error = f'no ref at index {raw & self.mask}'
            self.RowName = None
        if self.RowName is not None:
            self.RowType = self._name_to_id[self.RowName]
        self.Index = raw >> self.bits


class TypeDefOrRefIndex(MultiTableIndex):
    refs = (
        'TypeDef',
        'TypeRef',
        'TypeSpec'
    )


class HasConstantIndex(MultiTableIndex):
    refs = (
        'Field',
        'Param',
        'Property'
    )


class HasCustomAttributeIndex(MultiTableIndex):
    refs = (
        'MethodDef',
        'Field',
        'TypeRef',
        'TypeDef',
        'Param',
        'InterfaceImpl',
        'MemberRef',
        'Module',
        'Permission',
        'Property',
        'Event',
        'StandAloneSig',
        'ModuleRef',
        'TypeSpec',
        'Assembly',
        'AssemblyRef',
        'File',
        'ExportedType',
        'ManifestResource',
    )


class HasFieldMarshallIndex(MultiTableIndex):
    refs = (
        'Field',
        'Param',
    )


class HasDeclSecurityIndex(MultiTableIndex):
    refs = (
        'TypeDef',
        'MethodDef',
        'Assembly',
    )


class MemberRefParentIndex(MultiTableIndex):
    refs = (
        'TypeDef',
        'TypeRef',
        'ModuleRef',
        'MethodDef',
        'TypeSpec',
    )


class HasSemanticsIndex(MultiTableIndex):
    refs = (
        'Event',
        'Property',
    )


class MethodDefOrRefIndex(MultiTableIndex):
    refs = (
        'MethodDef',
        'MemberRef',
    )


class MemberForwardedIndex(MultiTableIndex):
    refs = (
        'Field',
        'MethodDef',
    )


class ImplementationIndex(MultiTableIndex):
    refs = (
        'File',
        'AssemblyRef',
        'ExportedType',
    )


class CustomAttributeTypeIndex(MultiTableIndex):
    refs = (
        None,
        None,
        'MethodDef',
        'MemberRef',
        None
    )


class ResolutionScopeIndex(MultiTableIndex):
    refs = (
        'Module',
        'ModuleRef',
        'AssemblyRef',
        'TypeRef'
    )


class TypeOrMethodDefIndex(MultiTableIndex):
    refs = (
        'TypeDef',
        'MethodDef',
    )


class FieldIndex(MultiTableIndex):
    refs = ('Field',)


class MethodDefIndex(MultiTableIndex):
    refs = ('MethodDef',)


class ParamIndex(MultiTableIndex):
    refs = ('Param',)


class TypeDefIndex(MultiTableIndex):
    refs = ('TypeDef',)


class EventIndex(MultiTableIndex):
    refs = ('Event',)


class PropertyIndex(MultiTableIndex):
    refs = ('Property',)


class ModuleRefIndex(MultiTableIndex):
    refs = ('ModuleRef',)


class AssemblyRefIndex(MultiTableIndex):
    refs = ('AssemblyRef',)


class GenericParamIndex(MultiTableIndex):
    refs = ('GenericParam',)


class TableRow(Struct):
    def __init__(self, reader, streams, header, **kw):
        Struct.__init__(self, reader, _streams=streams, _header=header)

    def expect_strA(self):
        offset = self.expect(self._header.HeapOffsetTypes.String)
        return self._streams.Strings[offset]

    def expect_guid(self):
        index = self.expect(self._header.HeapOffsetTypes.GUID)
        offset = (index - 1) * 0x10
        return self._streams.GUID[offset]

    def expect_blob(self):
        offset = self.expect(self._header.HeapOffsetTypes.Blob)
        return self._streams.Blob[offset]

    def index(self, IndexParser):
        return self.expect(IndexParser, rows=self._header.RowCount)


class Module(TableRow):
    def parse(self):
        self.Generation = self.expect(UInt16)
        self.Name = self.expect_strA()
        self.MvId = self.expect_guid()
        self.EncId = self.expect_guid()
        self.EncBaseId = self.expect_guid()


class TypeRef(TableRow):
    def parse(self):
        self.ResolutionScope = self.index(ResolutionScopeIndex)
        self.TypeName = self.expect_strA()
        self.TypeNamespace = self.expect_strA()


class TypeDef(TableRow):
    def parse(self):
        self.Flags = self.expect(UInt32)
        self.TypeName = self.expect_strA()
        self.TypeNamespace = self.expect_strA()
        self.Extends = self.index(TypeDefOrRefIndex)
        self.FieldList = self.index(FieldIndex)
        self.MethodList = self.index(MethodDefIndex)


class FieldPtr(TableRow):
    def parse(self):
        self.Ref = self.expect(UInt16)


class Field(TableRow):
    def parse(self):
        class FieldFlags:
            def __init__(self, mask):
                self.Value = BitMask(mask)
                self.Static = bool(self.Value[4])
                self.InitOnly = bool(self.Value[5])
                self.Literal = bool(self.Value[6])
                self.NotSerialized = bool(self.Value[7])
                self.HasFieldRVA = bool(self.Value[8])
                self.SpecialName = bool(self.Value[9])
                self.RTSpecialName = bool(self.Value[10])
                self.HasFieldMarshal = bool(self.Value[11])
                self.PinvokeImpl = bool(self.Value[12])
                self.HasDefault = bool(self.Value[13])

            def __str__(self):
                return str(self.Value)

        self.Flags = FieldFlags(self.expect(UInt16))
        self.Name = self.expect_strA()
        self.Signature = self.expect_blob()


class MethodPtr(TableRow):
    def parse(self):
        self.Ref = self.expect(UInt16)


class MethodDef(TableRow):
    def parse(self):
        self.RVA = self.expect(UInt32)
        self.ImplFlags = self.expect(UInt16)
        self.Flags = self.expect(UInt16)
        self.Name = self.expect_strA()
        self.Signature = self.expect_blob()
        self.ParamList = self.index(ParamIndex)


class ParamPtr(TableRow):
    def parse(self):
        self.Ref = self.expect(UInt16)


class Param(TableRow):
    def parse(self):
        self.Flags = self.expect(UInt16)
        self.Sequence = self.expect(UInt16)
        self.Name = self.expect_strA()


class InterfaceImpl(TableRow):
    def parse(self):
        self.Class = self.index(TypeDefIndex)
        self.Interface = self.index(TypeDefOrRefIndex)


class MemberRef(TableRow):
    def parse(self):
        self.Class = self.index(MemberRefParentIndex)
        self.Name = self.expect_strA()
        self.Signature = self.expect_blob()


class Constant(TableRow):
    def parse(self):
        self.Type = self.expect(UInt16)
        self.Parent = self.index(HasConstantIndex)
        self.Value = self.expect_blob()


class CustomAttribute(TableRow):
    def parse(self):
        self.Parent = self.index(HasCustomAttributeIndex)
        self.Type = self.index(CustomAttributeTypeIndex)
        self.Value = self.expect_blob()


class FieldMarshal(TableRow):
    def parse(self):
        self.Parent = self.index(HasFieldMarshallIndex)
        self.NativeType = self.expect_blob()


class Permission(TableRow):
    def parse(self):
        self.Action = self.expect(UInt16)
        self.Parent = self.index(HasDeclSecurityIndex)
        self.PermissionSet = self.expect_blob()


class ClassLayout(TableRow):
    def parse(self):
        self.PackingSize = self.expect(UInt16)
        self.ClassSize = self.expect(UInt32)
        self.Parent = self.index(TypeDefIndex)


class FieldLayout(TableRow):
    def parse(self):
        self.Offset = self.expect(UInt32)
        self.Field = self.index(FieldIndex)


class StandAloneSig(TableRow):
    def parse(self):
        self.Signature = self.expect_blob()


class EventMap(TableRow):
    def parse(self):
        self.Parent = self.index(TypeDefIndex)
        self.EventList = self.index(EventIndex)


class EventPtr(TableRow):
    def parse(self):
        self.Ref = self.expect(UInt16)


class Event(TableRow):
    def parse(self):
        self.EventFlags = self.expect(UInt16)
        self.Name = self.expect_strA()
        self.EventType = self.index(TypeDefOrRefIndex)


class PropertyMap(TableRow):
    def parse(self):
        self.Parent = self.index(TypeDefIndex)
        self.PropertyList = self.index(PropertyIndex)


class PropertyPtr(TableRow):
    def parse(self):
        self.Ref = self.expect(UInt16)


class Property(TableRow):
    def parse(self):
        self.Flags = self.expect(UInt16)
        self.Name = self.expect_strA()
        self.Type = self.expect_blob()


class MethodSemantics(TableRow):
    def parse(self):
        self.Semantics = self.expect(UInt16)
        self.Method = self.index(MethodDefIndex)
        self.Association = self.index(HasSemanticsIndex)


class MethodImpl(TableRow):
    def parse(self):
        self.Class = self.index(TypeDefIndex)
        self.MethodBody = self.index(MethodDefOrRefIndex)
        self.MethodDeclaration = self.index(MethodDefOrRefIndex)


class ModuleRef(TableRow):
    def parse(self):
        self.Name = self.expect_strA()


class TypeSpec(TableRow):
    def parse(self):
        self.Signature = self.expect_blob()


class ImplMap(TableRow):
    def parse(self):
        self.MappingFlags = self.expect(UInt16)
        self.MemberForwarded = self.index(MemberForwardedIndex)
        self.ImportName = self.expect_strA()
        self.ImportScope = self.index(ModuleRefIndex)


class FieldRVA(TableRow):
    def parse(self):
        self.RVA = self.expect(UInt32)
        self.Field: MultiTableIndex = self.index(FieldIndex)


class Assembly(TableRow):
    def parse(self):
        self.HashAlgId = self.expect(UInt32)
        self.MajorVersion = self.expect(UInt16)
        self.MinorVersion = self.expect(UInt16)
        self.BuildNumber = self.expect(UInt16)
        self.RevisionNumber = self.expect(UInt16)
        self.Flags = self.expect(UInt32)
        self.PublicKey = self.expect_blob()
        self.Name = self.expect_strA()
        self.Culture = self.expect_strA()


class AssemblyProcessor(TableRow):
    def parse(self):
        self.Processor = self.expect(UInt32)


class AssemblyOS(TableRow):
    def parse(self):
        self.OsPlatformId = self.expect(UInt32)
        self.OsMajorVersion = self.expect(UInt32)
        self.OsMinorVersion = self.expect(UInt32)


class AssemblyRef(TableRow):
    def parse(self):
        self.MajorVersion = self.expect(UInt16)
        self.MinorVersion = self.expect(UInt16)
        self.BuildNumber = self.expect(UInt16)
        self.RevisionNumber = self.expect(UInt16)
        self.Flags = self.expect(UInt32)
        self.PublicKeyOrToken = self.expect_blob()
        self.Name = self.expect_strA()
        self.Culture = self.expect_strA()
        self.HashValue = self.expect_blob()


class AssemblyRefProcessor(TableRow):
    def parse(self):
        self.Processor = self.expect(UInt32)
        self.AssemblyRef = self.index(AssemblyRefIndex)


class AssemblyRefOS(TableRow):
    def parse(self):
        self.OsPlatformId = self.expect(UInt32)
        self.OsMajorVersion = self.expect(UInt32)
        self.OsMinorVersion = self.expect(UInt32)
        self.AssemblyRef = self.index(AssemblyRefIndex)


class File(TableRow):
    def parse(self):
        self.Flags = self.expect(UInt32)
        self.Name = self.expect_strA()
        self.HashValue = self.expect_blob()


class ExportedType(TableRow):
    def parse(self):
        self.Flags = self.expect(UInt32)
        self.TypeDefId = self.expect(UInt32)
        self.TypeName = self.expect_strA()
        self.TypeNamespace = self.expect_strA()
        self.Implementation = self.index(ImplementationIndex)


class ManifestResource(TableRow):
    def parse(self):
        self.Offset = self.expect(UInt32)
        self.Flags = self.expect(UInt32)
        self.Name = self.expect_strA()
        self.Implementation = self.index(ImplementationIndex)


class NestedClass(TableRow):
    def parse(self):
        self.NestedClass = self.index(TypeDefIndex)
        self.EnclosingClass = self.index(TypeDefIndex)


class GenericParam(TableRow):
    def parse(self):
        self.Number = self.expect(UInt16)
        self.Flags = self.expect(UInt16)
        self.Owner = self.index(TypeOrMethodDefIndex)
        self.Name = self.expect_strA()


class MethodSpec(TableRow):
    def parse(self):
        self.Method = self.index(MethodDefOrRefIndex)
        self.Instantiation = self.expect_blob()


class GenericParamConstraint(TableRow):
    def parse(self):
        self.Owner = self.index(GenericParamIndex)
        self.Constraint = self.index(TypeDefOrRefIndex)


class ENCLog(TableRow):
    def parse(self):
        self.Token = self.expect(UInt32)
        self.FuncCode = self.expect(UInt32)


class ENCMap(TableRow):
    def parse(self):
        self.Token = self.expect(UInt32)


class ImageDataDirectory(Struct):
    def parse(self):
        self.VirtualAddress = self.expect(UInt32)
        self.Size = self.expect(UInt32)


class NetDirectory(Struct):
    def parse(self):
        self.Size = self.expect(UInt32)
        self.MajorRuntimeVersion = self.expect(UInt16)
        self.MinorRuntimeVersion = self.expect(UInt16)
        self.MetaData = self.expect(ImageDataDirectory)
        self.Flags = self.expect(UInt32)
        self.EntryPointToken = self.expect(UInt32)
        self.Resources = self.expect(ImageDataDirectory)
        self.StringNameSignature = self.expect(ImageDataDirectory)
        self.CodeManagerTable = self.expect(ImageDataDirectory)
        self.VTableFixups = self.expect(ImageDataDirectory)
        self.ExportAddressTableJumps = self.expect(ImageDataDirectory)
        self.ManagedNativeHeader = self.expect(ImageDataDirectory)
        # Known Flags
        self.KnownFlags = dict(
            IL_ONLY=((self.Flags >> 0) & 1 == 1),
            REQUIRE_32BIT=((self.Flags >> 1) & 1 == 1),
            IL_LIBRARY=((self.Flags >> 2) & 1 == 1),
            STRONG_NAME_SIGNED=((self.Flags >> 3) & 1 == 1),
            NATIVE_ENTRYPOINT=((self.Flags >> 4) & 1 == 1),
            TRACK_DEBUG_DATA=((self.Flags >> 16) & 1 == 1)
        )


class NetMetaDataStreamEntry(Struct):
    def parse(self):
        self.VirtualAddress = self.expect(UInt32)
        self.Size = self.expect(UInt32)
        self.Name = self.expect(NullTerminatedString, align=4)


class NetMetaDataTablesHeader(Struct):
    def parse(self):
        Types = (UInt16, UInt32)
        self._Reserved1 = self.expect(UInt32)
        self.MajorVersion = self.expect(Byte)
        self.MinorVersion = self.expect(Byte)
        self.Flags = BitMask(self.expect(Byte))
        self.KnownFlags = dict(
            PADDING=bool(self.Flags[3]),
            DELTA_ONLY=bool(self.Flags[5]),
            LARGE_STRA=bool(self.Flags[0]),  # Strings require 4 byte offsets
            LARGE_GUID=bool(self.Flags[1]),  # GUIDs require 4 byte offsets
            LARGE_BLOB=bool(self.Flags[2]),  # Blobs require 4 byte offsets
            EXTRA_DATA=bool(self.Flags[6]),  # Extra data follows the row counts
            HAS_DELETE=bool(self.Flags[7])   # Certain tables can contain deleted rows.
        )
        self.HeapOffsetTypes = Box(
            String=Types[self.Flags[0]],
            GUID=Types[self.Flags[1]],
            Blob=Types[self.Flags[2]])
        self._Reserved2 = self.expect(Byte)
        self.ExistingRows = BitMask(self.expect(UInt64))
        self.SortedRows = BitMask(self.expect(UInt64))
        self.RowCount = {k: self.expect(UInt32) for k in self.ExistingRows}


class NetMetaDataTables(Struct):
    lookup = {
        0x00: Module,
        0x01: TypeRef,
        0x02: TypeDef,
        0x03: FieldPtr,
        0x04: Field,
        0x05: MethodPtr,
        0x06: MethodDef,
        0x07: ParamPtr,
        0x08: Param,
        0x09: InterfaceImpl,
        0x0A: MemberRef,
        0x0B: Constant,
        0x0C: CustomAttribute,
        0x0D: FieldMarshal,
        0x0E: Permission,
        0x0F: ClassLayout,
        0x10: FieldLayout,
        0x11: StandAloneSig,
        0x12: EventMap,
        0x13: EventPtr,
        0x14: Event,
        0x15: PropertyMap,
        0x16: PropertyPtr,
        0x17: Property,
        0x18: MethodSemantics,
        0x19: MethodImpl,
        0x1A: ModuleRef,
        0x1B: TypeSpec,
        0x1C: ImplMap,
        0x1D: FieldRVA,
        0x1E: ENCLog,
        0x1F: ENCMap,
        0x20: Assembly,
        0x21: AssemblyProcessor,
        0x22: AssemblyOS,
        0x23: AssemblyRef,
        0x24: AssemblyRefProcessor,
        0x25: AssemblyRefOS,
        0x26: File,
        0x27: ExportedType,
        0x28: ManifestResource,
        0x29: NestedClass,
        0x2A: GenericParam,
        0x2B: MethodSpec,
        0x2C: GenericParamConstraint,
    }

    def __init__(self, reader, streams):
        Struct.__init__(self, reader, _streams=streams)

    def parse(self):
        self.Header: NetMetaDataTablesHeader = self.expect(NetMetaDataTablesHeader)
        if self.Header.Flags[6]:
            self.ExtraData = self.expect(UInt32)

        self.Module: list[Module] = []
        self.TypeRef: list[TypeRef] = []
        self.TypeDef: list[TypeDef] = []
        self.FieldPtr: list[FieldPtr] = []
        self.Field: list[Field] = []
        self.MethodPtr: list[MethodPtr] = []
        self.MethodDef: list[MethodDef] = []
        self.ParamPtr: list[ParamPtr] = []
        self.Param: list[Param] = []
        self.InterfaceImpl: list[InterfaceImpl] = []
        self.MemberRef: list[MemberRef] = []
        self.Constant: list[Constant] = []
        self.CustomAttribute: list[CustomAttribute] = []
        self.FieldMarshal: list[FieldMarshal] = []
        self.Permission: list[Permission] = []
        self.ClassLayout: list[ClassLayout] = []
        self.FieldLayout: list[FieldLayout] = []
        self.StandAloneSig: list[StandAloneSig] = []
        self.EventMap: list[EventMap] = []
        self.EventPtr: list[EventPtr] = []
        self.Event: list[Event] = []
        self.PropertyMap: list[PropertyMap] = []
        self.PropertyPtr: list[PropertyPtr] = []
        self.Property: list[Property] = []
        self.MethodSemantics: list[MethodSemantics] = []
        self.MethodImpl: list[MethodImpl] = []
        self.ModuleRef: list[ModuleRef] = []
        self.TypeSpec: list[TypeSpec] = []
        self.ImplMap: list[ImplMap] = []
        self.FieldRVA: list[FieldRVA] = []
        self.ENCLog: list[ENCLog] = []
        self.ENCMap: list[ENCMap] = []
        self.Assembly: list[Assembly] = []
        self.AssemblyProcessor: list[AssemblyProcessor] = []
        self.AssemblyOS: list[AssemblyOS] = []
        self.AssemblyRef: list[AssemblyRef] = []
        self.AssemblyRefProcessor: list[AssemblyRefProcessor] = []
        self.AssemblyRefOS: list[AssemblyRefOS] = []
        self.File: list[File] = []
        self.ExportedType: list[ExportedType] = []
        self.ManifestResource: list[ManifestResource] = []
        self.NestedClass: list[NestedClass] = []
        self.GenericParam: list[GenericParam] = []
        self.MethodSpec: list[MethodSpec] = []
        self.GenericParamConstraint: list[GenericParamConstraint] = []

        for k in sorted(self.Header.RowCount):
            count = self.Header.RowCount[k]
            try:
                Type = self.lookup[k]
            except KeyError:
                raise RuntimeError('Cannot parse unknown table index 0x{:08X}; unable to continue parsing.')
            TypeEntries = getattr(self, repr(Type))
            for _ in range(count):
                Entry = self.expect(Type, streams=self._streams, header=self.Header)
                TypeEntries.append(Entry)

    def __getitem__(self, k):
        try:
            Type = self.lookup[k]
        except KeyError:
            return super().__getitem__(k)
        else:
            return getattr(self, repr(Type))


class ODict(dict):
    def in_sequence(self, k, default=None):
        for j, index in enumerate(sorted(self)):
            if j == k:
                return self[index]
        else:
            return default


class NetMetaDataStreamDummy(dict):
    def __init__(self, default=None):
        self._default = default
        dict.__init__(self)

    def __getitem__(self, offset):
        return self._default


class NetMetaDataStream(dict):
    def __init__(self, reader, type, default=None):
        dict.__init__(self)
        self._default = default
        self._reader = reader
        self._type = type
        self._cached = False
        self.read()

    def _next(self):
        return self._reader.expect(self._type)

    def __getitem__(self, offset):
        if offset < 0:
            return self._default
        try:
            return dict.__getitem__(self, offset)
        except KeyError:
            try:
                self._reader.seek(offset)
                item = self._next()
            except ParserException:
                pass
            else:
                self[offset] = item
                return item
        try:
            closest = max(key for key in self if key < offset)
        except ValueError:
            return None
        container = unpack(self[closest])
        return container[offset - closest:] or self._default

    def read(self):
        if self._cached:
            return
        self._reader.seek(0)
        while True:
            offset = self._reader.tell()
            try:
                self[offset] = self._next()
            except ParserException:
                break
        self._cached = True

    def __iter__(self):
        self.read()
        return dict.__iter__(self)


class NetMetaDataStreams(Struct):
    def __init__(self, reader, meta):
        Struct.__init__(self, reader, _meta=meta)

    def _read_all(self, reader, Type):
        while True:
            offset = reader.tell()
            try:
                yield offset, reader.expect(Type)
            except ParserException:
                break

    def parse(self):
        self.Tables: NetMetaDataTables = None
        self.Strings = NetMetaDataStreamDummy('')
        self.US = NetMetaDataStreamDummy('')
        self.GUID = NetMetaDataStreamDummy()
        self.Blob = NetMetaDataStreamDummy(B'')
        with self._reader.checkpoint():
            TableName = '#~'
            for se in self._meta.StreamInfo:
                if se.Name == TableName:
                    break
                if se.Name == '#-':
                    TableName = se.Name
                    break
            for k, name in reversed(tuple(enumerate((TableName, '#Strings', '#US', '#GUID', '#Blob')))):
                for _, Entry in enumerate(self._meta.StreamInfo):
                    if Entry.Name.upper() == name.upper():
                        break
                else:
                    continue
                self._reader.seek(Entry.VirtualAddress)
                try:
                    reader = StreamReader(self._reader.read(Entry.Size))
                except ParserEOF:
                    continue
                if name != TableName:
                    Default = ['', '', None, B''][k - 1]
                    Type = [NullTerminatedString, UnicodeString, StringGUID, RawBytes][k - 1]
                    Stream = NetMetaDataStream(reader, Type, Default)
                    setattr(self, name[1:], Stream)
                else:
                    self.Tables = reader.expect(NetMetaDataTables, streams=self)


class NetMetaData(Struct):
    @property
    def resources(self):
        return self.Streams.Tables.ManifestResource

    @property
    def RVAs(self):
        return self.Streams.Tables.FieldRVA

    def parse(self):
        try:
            self.Signature = self.expect(UInt32)
        except ParserEOF:
            raise InvalidSignature
        if self.Signature != 0x424A5342:
            raise InvalidSignature
        self.MajorVersion = self.expect(UInt16)
        self.MinorVersion = self.expect(UInt16)
        self._Reserved = self.expect(UInt32)
        size = self.expect(UInt32)
        self.VersionString = self.expect(StringPrimitive, size=size, align=4)
        self.Flags = self.expect(UInt16)
        self.StreamCount = self.expect(UInt16)
        self.StreamInfo = [
            self.expect(NetMetaDataStreamEntry)
            for _ in range(self.StreamCount)
        ]
        self.Streams: NetMetaDataStreams = self.expect(NetMetaDataStreams, meta=self)


class NetResourceWithName(Struct):
    def parse(self):
        self.Name = self.expect(StringPrimitive, codec='utf-16LE')
        self.Offset = self.expect(UInt32)
        with self._reader.checkpoint():
            self._reader.seek(self.Offset)
            self.Size = self.expect(UInt32)
            self.Data = self._reader.read(self.Size)


class DotNetHeader:
    def __init__(self, data, pe=None, parse_resources=True):
        try:
            self.pe = pe = pe or lief.load_pe(data)
            self.data = data
            self.head = NetDirectory(self.reader(pe.data_directory(lief.PE.DataDirectory.TYPES.CLR_RUNTIME_HEADER)))
        except Exception as E:
            raise InvalidDotNetHeader from E
        try:
            self.meta = NetMetaData(self.reader(self.head.MetaData))
        except Exception as E:
            raise InvalidDotNetHeader from E
        self.resources = self.parse_resources() if parse_resources else []

    def parse_resources(self):
        def parse(reader):
            for entry in self.meta.resources:
                try:
                    reader.seek(entry.Offset)
                    size = reader.expect(UInt32)
                    yield Box(
                        Name=entry.Name,
                        Data=reader.read(size)
                    )
                except ParserEOF:
                    yield Box(
                        Name=entry.Name,
                        Data=B''
                    )
        return list(parse(self.reader(self.head.Resources)))

    def reader(self, obj):
        try:
            rva, size = obj.rva, obj.size
        except AttributeError:
            rva, size = obj.VirtualAddress, obj.Size
        start = self.pe.rva_to_offset(rva)
        end = start + size
        return StreamReader(self.data[start:end])

Functions

def bits_required(n)

Expand source code Browse git

def bits_required(n):
    return 0 if not n else (n - 1).bit_length()

Classes

class InvalidDotNetHeader (msg=None)

Inappropriate argument value (of correct type).

Expand source code Browse git

class InvalidDotNetHeader(ValueError):
    def __init__(self, msg=None):
        ValueError.__init__(self, msg or '.NET parsing failed: corrupt header.')

Ancestors

builtins.ValueError
builtins.Exception
builtins.BaseException

Subclasses

InvalidSignature

class InvalidSignature

Inappropriate argument value (of correct type).

Expand source code Browse git

class InvalidSignature(InvalidDotNetHeader):
    def __init__(self):
        ValueError.__init__(self, '.NET parsing failed: Invalid signature.')

Ancestors

InvalidDotNetHeader
builtins.ValueError
builtins.Exception
builtins.BaseException

class BitMask (bitmask)

Expand source code Browse git

class BitMask:
    def __init__(self, bitmask):
        self._bitmask = bitmask

    def __contains__(self, pos):
        return self[pos] == 1

    def __len__(self):
        return self._bitmask.bit_length()

    def __getitem__(self, pos):
        return (self._bitmask >> pos) & 1

    def __iter__(self):
        for k in range(len(self)):
            if k in self:
                yield k

    def __repr__(self):
        return f'{self._bitmask:b}'

class MultiTableIndex (reader, rows)

dict() -> new empty dictionary dict(mapping) -> new dictionary initialized from a mapping object's (key, value) pairs dict(iterable) -> new dictionary initialized as if via: d = {} for k, v in iterable: d[k] = v dict(**kwargs) -> new dictionary initialized with the name=value pairs in the keyword argument list. For example: dict(one=1, two=2)

Expand source code Browse git

class MultiTableIndex(Struct):
    _name_to_id = {
        'Assembly'               : 0x20,
        'AssemblyOS'             : 0x22,
        'AssemblyProcessor'      : 0x21,
        'AssemblyRef'            : 0x23,
        'AssemblyRefOS'          : 0x25,
        'AssemblyRefProcessor'   : 0x24,
        'ClassLayout'            : 0x0F,
        'Constant'               : 0x0B,
        'CustomAttribute'        : 0x0C,
        'ENCLog'                 : 0x1E,
        'ENCMap'                 : 0x1F,
        'Event'                  : 0x14,
        'EventMap'               : 0x12,
        'EventPtr'               : 0x13,
        'ExportedType'           : 0x27,
        'Field'                  : 0x04,
        'FieldLayout'            : 0x10,
        'FieldMarshal'           : 0x0D,
        'FieldPtr'               : 0x03,
        'FieldRVA'               : 0x1D,
        'File'                   : 0x26,
        'GenericParam'           : 0x2A,
        'GenericParamConstraint' : 0x2C,
        'ImplMap'                : 0x1C,
        'InterfaceImpl'          : 0x09,
        'ManifestResource'       : 0x28,
        'MemberRef'              : 0x0A,
        'MethodDef'              : 0x06,
        'MethodImpl'             : 0x19,
        'MethodPtr'              : 0x05,
        'MethodSemantics'        : 0x18,
        'MethodSpec'             : 0x2B,
        'Module'                 : 0x00,
        'ModuleRef'              : 0x1A,
        'NestedClass'            : 0x29,
        'Param'                  : 0x08,
        'ParamPtr'               : 0x07,
        'Permission'             : 0x0E,
        'Property'               : 0x17,
        'PropertyMap'            : 0x15,
        'PropertyPtr'            : 0x16,
        'StandAloneSig'          : 0x11,
        'TypeDef'                : 0x02,
        'TypeRef'                : 0x01,
        'TypeSpec'               : 0x1B,
    }
    refs = ()

    def __init__(self, reader, rows):
        if not self.refs:
            raise NotImplementedError
        row_max_len = max(
            rows.get(self._name_to_id[n], 0)
            for n in self.refs if n is not None
        )
        bits = self.bits + bits_required(row_max_len)
        Type = UInt32 if bits > 16 else UInt16
        Struct.__init__(self, reader, _type=Type)

    def __len__(self):
        return len(self.refs)

    @property
    def bits(self):
        return bits_required(len(self))

    @property
    def mask(self):
        return (1 << self.bits) - 1

    def parse(self):
        raw = self.expect(self._type)
        try:
            self.RowName = self.refs[raw & self.mask]
        except IndexError:
            self.Error = f'no ref at index {raw & self.mask}'
            self.RowName = None
        if self.RowName is not None:
            self.RowType = self._name_to_id[self.RowName]
        self.Index = raw >> self.bits

Ancestors

Struct
Box
builtins.dict
MetaBox

Subclasses

Class variables

var refs

Instance variables

var bits

Expand source code Browse git

@property
def bits(self):
    return bits_required(len(self))

var mask

Expand source code Browse git

@property
def mask(self):
    return (1 << self.bits) - 1

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    raw = self.expect(self._type)
    try:
        self.RowName = self.refs[raw & self.mask]
    except IndexError:
        self.Error = f'no ref at index {raw & self.mask}'
        self.RowName = None
    if self.RowName is not None:
        self.RowType = self._name_to_id[self.RowName]
    self.Index = raw >> self.bits

class TypeDefOrRefIndex (reader, rows)

Expand source code Browse git

class TypeDefOrRefIndex(MultiTableIndex):
    refs = (
        'TypeDef',
        'TypeRef',
        'TypeSpec'
    )

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class HasConstantIndex (reader, rows)

Expand source code Browse git

class HasConstantIndex(MultiTableIndex):
    refs = (
        'Field',
        'Param',
        'Property'
    )

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class HasCustomAttributeIndex (reader, rows)

Expand source code Browse git

class HasCustomAttributeIndex(MultiTableIndex):
    refs = (
        'MethodDef',
        'Field',
        'TypeRef',
        'TypeDef',
        'Param',
        'InterfaceImpl',
        'MemberRef',
        'Module',
        'Permission',
        'Property',
        'Event',
        'StandAloneSig',
        'ModuleRef',
        'TypeSpec',
        'Assembly',
        'AssemblyRef',
        'File',
        'ExportedType',
        'ManifestResource',
    )

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class HasFieldMarshallIndex (reader, rows)

Expand source code Browse git

class HasFieldMarshallIndex(MultiTableIndex):
    refs = (
        'Field',
        'Param',
    )

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class HasDeclSecurityIndex (reader, rows)

Expand source code Browse git

class HasDeclSecurityIndex(MultiTableIndex):
    refs = (
        'TypeDef',
        'MethodDef',
        'Assembly',
    )

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class MemberRefParentIndex (reader, rows)

Expand source code Browse git

class MemberRefParentIndex(MultiTableIndex):
    refs = (
        'TypeDef',
        'TypeRef',
        'ModuleRef',
        'MethodDef',
        'TypeSpec',
    )

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class HasSemanticsIndex (reader, rows)

Expand source code Browse git

class HasSemanticsIndex(MultiTableIndex):
    refs = (
        'Event',
        'Property',
    )

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class MethodDefOrRefIndex (reader, rows)

Expand source code Browse git

class MethodDefOrRefIndex(MultiTableIndex):
    refs = (
        'MethodDef',
        'MemberRef',
    )

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class MemberForwardedIndex (reader, rows)

Expand source code Browse git

class MemberForwardedIndex(MultiTableIndex):
    refs = (
        'Field',
        'MethodDef',
    )

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class ImplementationIndex (reader, rows)

Expand source code Browse git

class ImplementationIndex(MultiTableIndex):
    refs = (
        'File',
        'AssemblyRef',
        'ExportedType',
    )

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class CustomAttributeTypeIndex (reader, rows)

Expand source code Browse git

class CustomAttributeTypeIndex(MultiTableIndex):
    refs = (
        None,
        None,
        'MethodDef',
        'MemberRef',
        None
    )

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class ResolutionScopeIndex (reader, rows)

Expand source code Browse git

class ResolutionScopeIndex(MultiTableIndex):
    refs = (
        'Module',
        'ModuleRef',
        'AssemblyRef',
        'TypeRef'
    )

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class TypeOrMethodDefIndex (reader, rows)

Expand source code Browse git

class TypeOrMethodDefIndex(MultiTableIndex):
    refs = (
        'TypeDef',
        'MethodDef',
    )

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class FieldIndex (reader, rows)

Expand source code Browse git

class FieldIndex(MultiTableIndex):
    refs = ('Field',)

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class MethodDefIndex (reader, rows)

Expand source code Browse git

class MethodDefIndex(MultiTableIndex):
    refs = ('MethodDef',)

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class ParamIndex (reader, rows)

Expand source code Browse git

class ParamIndex(MultiTableIndex):
    refs = ('Param',)

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class TypeDefIndex (reader, rows)

Expand source code Browse git

class TypeDefIndex(MultiTableIndex):
    refs = ('TypeDef',)

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class EventIndex (reader, rows)

Expand source code Browse git

class EventIndex(MultiTableIndex):
    refs = ('Event',)

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class PropertyIndex (reader, rows)

Expand source code Browse git

class PropertyIndex(MultiTableIndex):
    refs = ('Property',)

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class ModuleRefIndex (reader, rows)

Expand source code Browse git

class ModuleRefIndex(MultiTableIndex):
    refs = ('ModuleRef',)

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class AssemblyRefIndex (reader, rows)

Expand source code Browse git

class AssemblyRefIndex(MultiTableIndex):
    refs = ('AssemblyRef',)

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class GenericParamIndex (reader, rows)

Expand source code Browse git

class GenericParamIndex(MultiTableIndex):
    refs = ('GenericParam',)

Ancestors

MultiTableIndex
Struct
Box
builtins.dict
MetaBox

Class variables

var refs

class TableRow (reader, streams, header, **kw)

Expand source code Browse git

class TableRow(Struct):
    def __init__(self, reader, streams, header, **kw):
        Struct.__init__(self, reader, _streams=streams, _header=header)

    def expect_strA(self):
        offset = self.expect(self._header.HeapOffsetTypes.String)
        return self._streams.Strings[offset]

    def expect_guid(self):
        index = self.expect(self._header.HeapOffsetTypes.GUID)
        offset = (index - 1) * 0x10
        return self._streams.GUID[offset]

    def expect_blob(self):
        offset = self.expect(self._header.HeapOffsetTypes.Blob)
        return self._streams.Blob[offset]

    def index(self, IndexParser):
        return self.expect(IndexParser, rows=self._header.RowCount)

Ancestors

Struct
Box
builtins.dict
MetaBox

Subclasses

Methods

def expect_strA(self)

Expand source code Browse git

def expect_strA(self):
    offset = self.expect(self._header.HeapOffsetTypes.String)
    return self._streams.Strings[offset]

def expect_guid(self)

Expand source code Browse git

def expect_guid(self):
    index = self.expect(self._header.HeapOffsetTypes.GUID)
    offset = (index - 1) * 0x10
    return self._streams.GUID[offset]

def expect_blob(self)

Expand source code Browse git

def expect_blob(self):
    offset = self.expect(self._header.HeapOffsetTypes.Blob)
    return self._streams.Blob[offset]

def index(self, IndexParser)

Expand source code Browse git

def index(self, IndexParser):
    return self.expect(IndexParser, rows=self._header.RowCount)

class Module (reader, streams, header, **kw)

Expand source code Browse git

class Module(TableRow):
    def parse(self):
        self.Generation = self.expect(UInt16)
        self.Name = self.expect_strA()
        self.MvId = self.expect_guid()
        self.EncId = self.expect_guid()
        self.EncBaseId = self.expect_guid()

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Generation = self.expect(UInt16)
    self.Name = self.expect_strA()
    self.MvId = self.expect_guid()
    self.EncId = self.expect_guid()
    self.EncBaseId = self.expect_guid()

class TypeRef (reader, streams, header, **kw)

Expand source code Browse git

class TypeRef(TableRow):
    def parse(self):
        self.ResolutionScope = self.index(ResolutionScopeIndex)
        self.TypeName = self.expect_strA()
        self.TypeNamespace = self.expect_strA()

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.ResolutionScope = self.index(ResolutionScopeIndex)
    self.TypeName = self.expect_strA()
    self.TypeNamespace = self.expect_strA()

class TypeDef (reader, streams, header, **kw)

Expand source code Browse git

class TypeDef(TableRow):
    def parse(self):
        self.Flags = self.expect(UInt32)
        self.TypeName = self.expect_strA()
        self.TypeNamespace = self.expect_strA()
        self.Extends = self.index(TypeDefOrRefIndex)
        self.FieldList = self.index(FieldIndex)
        self.MethodList = self.index(MethodDefIndex)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Flags = self.expect(UInt32)
    self.TypeName = self.expect_strA()
    self.TypeNamespace = self.expect_strA()
    self.Extends = self.index(TypeDefOrRefIndex)
    self.FieldList = self.index(FieldIndex)
    self.MethodList = self.index(MethodDefIndex)

class FieldPtr (reader, streams, header, **kw)

Expand source code Browse git

class FieldPtr(TableRow):
    def parse(self):
        self.Ref = self.expect(UInt16)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Ref = self.expect(UInt16)

class Field (reader, streams, header, **kw)

Expand source code Browse git

class Field(TableRow):
    def parse(self):
        class FieldFlags:
            def __init__(self, mask):
                self.Value = BitMask(mask)
                self.Static = bool(self.Value[4])
                self.InitOnly = bool(self.Value[5])
                self.Literal = bool(self.Value[6])
                self.NotSerialized = bool(self.Value[7])
                self.HasFieldRVA = bool(self.Value[8])
                self.SpecialName = bool(self.Value[9])
                self.RTSpecialName = bool(self.Value[10])
                self.HasFieldMarshal = bool(self.Value[11])
                self.PinvokeImpl = bool(self.Value[12])
                self.HasDefault = bool(self.Value[13])

            def __str__(self):
                return str(self.Value)

        self.Flags = FieldFlags(self.expect(UInt16))
        self.Name = self.expect_strA()
        self.Signature = self.expect_blob()

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    class FieldFlags:
        def __init__(self, mask):
            self.Value = BitMask(mask)
            self.Static = bool(self.Value[4])
            self.InitOnly = bool(self.Value[5])
            self.Literal = bool(self.Value[6])
            self.NotSerialized = bool(self.Value[7])
            self.HasFieldRVA = bool(self.Value[8])
            self.SpecialName = bool(self.Value[9])
            self.RTSpecialName = bool(self.Value[10])
            self.HasFieldMarshal = bool(self.Value[11])
            self.PinvokeImpl = bool(self.Value[12])
            self.HasDefault = bool(self.Value[13])

        def __str__(self):
            return str(self.Value)

    self.Flags = FieldFlags(self.expect(UInt16))
    self.Name = self.expect_strA()
    self.Signature = self.expect_blob()

class MethodPtr (reader, streams, header, **kw)

Expand source code Browse git

class MethodPtr(TableRow):
    def parse(self):
        self.Ref = self.expect(UInt16)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Ref = self.expect(UInt16)

class MethodDef (reader, streams, header, **kw)

Expand source code Browse git

class MethodDef(TableRow):
    def parse(self):
        self.RVA = self.expect(UInt32)
        self.ImplFlags = self.expect(UInt16)
        self.Flags = self.expect(UInt16)
        self.Name = self.expect_strA()
        self.Signature = self.expect_blob()
        self.ParamList = self.index(ParamIndex)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.RVA = self.expect(UInt32)
    self.ImplFlags = self.expect(UInt16)
    self.Flags = self.expect(UInt16)
    self.Name = self.expect_strA()
    self.Signature = self.expect_blob()
    self.ParamList = self.index(ParamIndex)

class ParamPtr (reader, streams, header, **kw)

Expand source code Browse git

class ParamPtr(TableRow):
    def parse(self):
        self.Ref = self.expect(UInt16)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Ref = self.expect(UInt16)

class Param (reader, streams, header, **kw)

Expand source code Browse git

class Param(TableRow):
    def parse(self):
        self.Flags = self.expect(UInt16)
        self.Sequence = self.expect(UInt16)
        self.Name = self.expect_strA()

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Flags = self.expect(UInt16)
    self.Sequence = self.expect(UInt16)
    self.Name = self.expect_strA()

class InterfaceImpl (reader, streams, header, **kw)

Expand source code Browse git

class InterfaceImpl(TableRow):
    def parse(self):
        self.Class = self.index(TypeDefIndex)
        self.Interface = self.index(TypeDefOrRefIndex)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Class = self.index(TypeDefIndex)
    self.Interface = self.index(TypeDefOrRefIndex)

class MemberRef (reader, streams, header, **kw)

Expand source code Browse git

class MemberRef(TableRow):
    def parse(self):
        self.Class = self.index(MemberRefParentIndex)
        self.Name = self.expect_strA()
        self.Signature = self.expect_blob()

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Class = self.index(MemberRefParentIndex)
    self.Name = self.expect_strA()
    self.Signature = self.expect_blob()

class Constant (reader, streams, header, **kw)

Expand source code Browse git

class Constant(TableRow):
    def parse(self):
        self.Type = self.expect(UInt16)
        self.Parent = self.index(HasConstantIndex)
        self.Value = self.expect_blob()

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Type = self.expect(UInt16)
    self.Parent = self.index(HasConstantIndex)
    self.Value = self.expect_blob()

class CustomAttribute (reader, streams, header, **kw)

Expand source code Browse git

class CustomAttribute(TableRow):
    def parse(self):
        self.Parent = self.index(HasCustomAttributeIndex)
        self.Type = self.index(CustomAttributeTypeIndex)
        self.Value = self.expect_blob()

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Parent = self.index(HasCustomAttributeIndex)
    self.Type = self.index(CustomAttributeTypeIndex)
    self.Value = self.expect_blob()

class FieldMarshal (reader, streams, header, **kw)

Expand source code Browse git

class FieldMarshal(TableRow):
    def parse(self):
        self.Parent = self.index(HasFieldMarshallIndex)
        self.NativeType = self.expect_blob()

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Parent = self.index(HasFieldMarshallIndex)
    self.NativeType = self.expect_blob()

class Permission (reader, streams, header, **kw)

Expand source code Browse git

class Permission(TableRow):
    def parse(self):
        self.Action = self.expect(UInt16)
        self.Parent = self.index(HasDeclSecurityIndex)
        self.PermissionSet = self.expect_blob()

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Action = self.expect(UInt16)
    self.Parent = self.index(HasDeclSecurityIndex)
    self.PermissionSet = self.expect_blob()

class ClassLayout (reader, streams, header, **kw)

Expand source code Browse git

class ClassLayout(TableRow):
    def parse(self):
        self.PackingSize = self.expect(UInt16)
        self.ClassSize = self.expect(UInt32)
        self.Parent = self.index(TypeDefIndex)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.PackingSize = self.expect(UInt16)
    self.ClassSize = self.expect(UInt32)
    self.Parent = self.index(TypeDefIndex)

class FieldLayout (reader, streams, header, **kw)

Expand source code Browse git

class FieldLayout(TableRow):
    def parse(self):
        self.Offset = self.expect(UInt32)
        self.Field = self.index(FieldIndex)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Offset = self.expect(UInt32)
    self.Field = self.index(FieldIndex)

class StandAloneSig (reader, streams, header, **kw)

Expand source code Browse git

class StandAloneSig(TableRow):
    def parse(self):
        self.Signature = self.expect_blob()

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Signature = self.expect_blob()

class EventMap (reader, streams, header, **kw)

Expand source code Browse git

class EventMap(TableRow):
    def parse(self):
        self.Parent = self.index(TypeDefIndex)
        self.EventList = self.index(EventIndex)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Parent = self.index(TypeDefIndex)
    self.EventList = self.index(EventIndex)

class EventPtr (reader, streams, header, **kw)

Expand source code Browse git

class EventPtr(TableRow):
    def parse(self):
        self.Ref = self.expect(UInt16)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Ref = self.expect(UInt16)

class Event (reader, streams, header, **kw)

Expand source code Browse git

class Event(TableRow):
    def parse(self):
        self.EventFlags = self.expect(UInt16)
        self.Name = self.expect_strA()
        self.EventType = self.index(TypeDefOrRefIndex)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.EventFlags = self.expect(UInt16)
    self.Name = self.expect_strA()
    self.EventType = self.index(TypeDefOrRefIndex)

class PropertyMap (reader, streams, header, **kw)

Expand source code Browse git

class PropertyMap(TableRow):
    def parse(self):
        self.Parent = self.index(TypeDefIndex)
        self.PropertyList = self.index(PropertyIndex)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Parent = self.index(TypeDefIndex)
    self.PropertyList = self.index(PropertyIndex)

class PropertyPtr (reader, streams, header, **kw)

Expand source code Browse git

class PropertyPtr(TableRow):
    def parse(self):
        self.Ref = self.expect(UInt16)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Ref = self.expect(UInt16)

class Property (reader, streams, header, **kw)

Expand source code Browse git

class Property(TableRow):
    def parse(self):
        self.Flags = self.expect(UInt16)
        self.Name = self.expect_strA()
        self.Type = self.expect_blob()

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Flags = self.expect(UInt16)
    self.Name = self.expect_strA()
    self.Type = self.expect_blob()

class MethodSemantics (reader, streams, header, **kw)

Expand source code Browse git

class MethodSemantics(TableRow):
    def parse(self):
        self.Semantics = self.expect(UInt16)
        self.Method = self.index(MethodDefIndex)
        self.Association = self.index(HasSemanticsIndex)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Semantics = self.expect(UInt16)
    self.Method = self.index(MethodDefIndex)
    self.Association = self.index(HasSemanticsIndex)

class MethodImpl (reader, streams, header, **kw)

Expand source code Browse git

class MethodImpl(TableRow):
    def parse(self):
        self.Class = self.index(TypeDefIndex)
        self.MethodBody = self.index(MethodDefOrRefIndex)
        self.MethodDeclaration = self.index(MethodDefOrRefIndex)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Class = self.index(TypeDefIndex)
    self.MethodBody = self.index(MethodDefOrRefIndex)
    self.MethodDeclaration = self.index(MethodDefOrRefIndex)

class ModuleRef (reader, streams, header, **kw)

Expand source code Browse git

class ModuleRef(TableRow):
    def parse(self):
        self.Name = self.expect_strA()

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Name = self.expect_strA()

class TypeSpec (reader, streams, header, **kw)

Expand source code Browse git

class TypeSpec(TableRow):
    def parse(self):
        self.Signature = self.expect_blob()

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Signature = self.expect_blob()

class ImplMap (reader, streams, header, **kw)

Expand source code Browse git

class ImplMap(TableRow):
    def parse(self):
        self.MappingFlags = self.expect(UInt16)
        self.MemberForwarded = self.index(MemberForwardedIndex)
        self.ImportName = self.expect_strA()
        self.ImportScope = self.index(ModuleRefIndex)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.MappingFlags = self.expect(UInt16)
    self.MemberForwarded = self.index(MemberForwardedIndex)
    self.ImportName = self.expect_strA()
    self.ImportScope = self.index(ModuleRefIndex)

class FieldRVA (reader, streams, header, **kw)

Expand source code Browse git

class FieldRVA(TableRow):
    def parse(self):
        self.RVA = self.expect(UInt32)
        self.Field: MultiTableIndex = self.index(FieldIndex)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.RVA = self.expect(UInt32)
    self.Field: MultiTableIndex = self.index(FieldIndex)

class Assembly (reader, streams, header, **kw)

Expand source code Browse git

class Assembly(TableRow):
    def parse(self):
        self.HashAlgId = self.expect(UInt32)
        self.MajorVersion = self.expect(UInt16)
        self.MinorVersion = self.expect(UInt16)
        self.BuildNumber = self.expect(UInt16)
        self.RevisionNumber = self.expect(UInt16)
        self.Flags = self.expect(UInt32)
        self.PublicKey = self.expect_blob()
        self.Name = self.expect_strA()
        self.Culture = self.expect_strA()

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.HashAlgId = self.expect(UInt32)
    self.MajorVersion = self.expect(UInt16)
    self.MinorVersion = self.expect(UInt16)
    self.BuildNumber = self.expect(UInt16)
    self.RevisionNumber = self.expect(UInt16)
    self.Flags = self.expect(UInt32)
    self.PublicKey = self.expect_blob()
    self.Name = self.expect_strA()
    self.Culture = self.expect_strA()

class AssemblyProcessor (reader, streams, header, **kw)

Expand source code Browse git

class AssemblyProcessor(TableRow):
    def parse(self):
        self.Processor = self.expect(UInt32)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Processor = self.expect(UInt32)

class AssemblyOS (reader, streams, header, **kw)

Expand source code Browse git

class AssemblyOS(TableRow):
    def parse(self):
        self.OsPlatformId = self.expect(UInt32)
        self.OsMajorVersion = self.expect(UInt32)
        self.OsMinorVersion = self.expect(UInt32)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.OsPlatformId = self.expect(UInt32)
    self.OsMajorVersion = self.expect(UInt32)
    self.OsMinorVersion = self.expect(UInt32)

class AssemblyRef (reader, streams, header, **kw)

Expand source code Browse git

class AssemblyRef(TableRow):
    def parse(self):
        self.MajorVersion = self.expect(UInt16)
        self.MinorVersion = self.expect(UInt16)
        self.BuildNumber = self.expect(UInt16)
        self.RevisionNumber = self.expect(UInt16)
        self.Flags = self.expect(UInt32)
        self.PublicKeyOrToken = self.expect_blob()
        self.Name = self.expect_strA()
        self.Culture = self.expect_strA()
        self.HashValue = self.expect_blob()

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.MajorVersion = self.expect(UInt16)
    self.MinorVersion = self.expect(UInt16)
    self.BuildNumber = self.expect(UInt16)
    self.RevisionNumber = self.expect(UInt16)
    self.Flags = self.expect(UInt32)
    self.PublicKeyOrToken = self.expect_blob()
    self.Name = self.expect_strA()
    self.Culture = self.expect_strA()
    self.HashValue = self.expect_blob()

class AssemblyRefProcessor (reader, streams, header, **kw)

Expand source code Browse git

class AssemblyRefProcessor(TableRow):
    def parse(self):
        self.Processor = self.expect(UInt32)
        self.AssemblyRef = self.index(AssemblyRefIndex)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Processor = self.expect(UInt32)
    self.AssemblyRef = self.index(AssemblyRefIndex)

class AssemblyRefOS (reader, streams, header, **kw)

Expand source code Browse git

class AssemblyRefOS(TableRow):
    def parse(self):
        self.OsPlatformId = self.expect(UInt32)
        self.OsMajorVersion = self.expect(UInt32)
        self.OsMinorVersion = self.expect(UInt32)
        self.AssemblyRef = self.index(AssemblyRefIndex)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.OsPlatformId = self.expect(UInt32)
    self.OsMajorVersion = self.expect(UInt32)
    self.OsMinorVersion = self.expect(UInt32)
    self.AssemblyRef = self.index(AssemblyRefIndex)

class File (reader, streams, header, **kw)

Expand source code Browse git

class File(TableRow):
    def parse(self):
        self.Flags = self.expect(UInt32)
        self.Name = self.expect_strA()
        self.HashValue = self.expect_blob()

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Flags = self.expect(UInt32)
    self.Name = self.expect_strA()
    self.HashValue = self.expect_blob()

class ExportedType (reader, streams, header, **kw)

Expand source code Browse git

class ExportedType(TableRow):
    def parse(self):
        self.Flags = self.expect(UInt32)
        self.TypeDefId = self.expect(UInt32)
        self.TypeName = self.expect_strA()
        self.TypeNamespace = self.expect_strA()
        self.Implementation = self.index(ImplementationIndex)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Flags = self.expect(UInt32)
    self.TypeDefId = self.expect(UInt32)
    self.TypeName = self.expect_strA()
    self.TypeNamespace = self.expect_strA()
    self.Implementation = self.index(ImplementationIndex)

class ManifestResource (reader, streams, header, **kw)

Expand source code Browse git

class ManifestResource(TableRow):
    def parse(self):
        self.Offset = self.expect(UInt32)
        self.Flags = self.expect(UInt32)
        self.Name = self.expect_strA()
        self.Implementation = self.index(ImplementationIndex)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Offset = self.expect(UInt32)
    self.Flags = self.expect(UInt32)
    self.Name = self.expect_strA()
    self.Implementation = self.index(ImplementationIndex)

class NestedClass (reader, streams, header, **kw)

Expand source code Browse git

class NestedClass(TableRow):
    def parse(self):
        self.NestedClass = self.index(TypeDefIndex)
        self.EnclosingClass = self.index(TypeDefIndex)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.NestedClass = self.index(TypeDefIndex)
    self.EnclosingClass = self.index(TypeDefIndex)

class GenericParam (reader, streams, header, **kw)

Expand source code Browse git

class GenericParam(TableRow):
    def parse(self):
        self.Number = self.expect(UInt16)
        self.Flags = self.expect(UInt16)
        self.Owner = self.index(TypeOrMethodDefIndex)
        self.Name = self.expect_strA()

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Number = self.expect(UInt16)
    self.Flags = self.expect(UInt16)
    self.Owner = self.index(TypeOrMethodDefIndex)
    self.Name = self.expect_strA()

class MethodSpec (reader, streams, header, **kw)

Expand source code Browse git

class MethodSpec(TableRow):
    def parse(self):
        self.Method = self.index(MethodDefOrRefIndex)
        self.Instantiation = self.expect_blob()

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Method = self.index(MethodDefOrRefIndex)
    self.Instantiation = self.expect_blob()

class GenericParamConstraint (reader, streams, header, **kw)

Expand source code Browse git

class GenericParamConstraint(TableRow):
    def parse(self):
        self.Owner = self.index(GenericParamIndex)
        self.Constraint = self.index(TypeDefOrRefIndex)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Owner = self.index(GenericParamIndex)
    self.Constraint = self.index(TypeDefOrRefIndex)

class ENCLog (reader, streams, header, **kw)

Expand source code Browse git

class ENCLog(TableRow):
    def parse(self):
        self.Token = self.expect(UInt32)
        self.FuncCode = self.expect(UInt32)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Token = self.expect(UInt32)
    self.FuncCode = self.expect(UInt32)

class ENCMap (reader, streams, header, **kw)

Expand source code Browse git

class ENCMap(TableRow):
    def parse(self):
        self.Token = self.expect(UInt32)

Ancestors

TableRow
Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Token = self.expect(UInt32)

class ImageDataDirectory (reader, cleanup=True, **kw)

Expand source code Browse git

class ImageDataDirectory(Struct):
    def parse(self):
        self.VirtualAddress = self.expect(UInt32)
        self.Size = self.expect(UInt32)

Ancestors

Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.VirtualAddress = self.expect(UInt32)
    self.Size = self.expect(UInt32)

class NetDirectory (reader, cleanup=True, **kw)

Expand source code Browse git

class NetDirectory(Struct):
    def parse(self):
        self.Size = self.expect(UInt32)
        self.MajorRuntimeVersion = self.expect(UInt16)
        self.MinorRuntimeVersion = self.expect(UInt16)
        self.MetaData = self.expect(ImageDataDirectory)
        self.Flags = self.expect(UInt32)
        self.EntryPointToken = self.expect(UInt32)
        self.Resources = self.expect(ImageDataDirectory)
        self.StringNameSignature = self.expect(ImageDataDirectory)
        self.CodeManagerTable = self.expect(ImageDataDirectory)
        self.VTableFixups = self.expect(ImageDataDirectory)
        self.ExportAddressTableJumps = self.expect(ImageDataDirectory)
        self.ManagedNativeHeader = self.expect(ImageDataDirectory)
        # Known Flags
        self.KnownFlags = dict(
            IL_ONLY=((self.Flags >> 0) & 1 == 1),
            REQUIRE_32BIT=((self.Flags >> 1) & 1 == 1),
            IL_LIBRARY=((self.Flags >> 2) & 1 == 1),
            STRONG_NAME_SIGNED=((self.Flags >> 3) & 1 == 1),
            NATIVE_ENTRYPOINT=((self.Flags >> 4) & 1 == 1),
            TRACK_DEBUG_DATA=((self.Flags >> 16) & 1 == 1)
        )

Ancestors

Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Size = self.expect(UInt32)
    self.MajorRuntimeVersion = self.expect(UInt16)
    self.MinorRuntimeVersion = self.expect(UInt16)
    self.MetaData = self.expect(ImageDataDirectory)
    self.Flags = self.expect(UInt32)
    self.EntryPointToken = self.expect(UInt32)
    self.Resources = self.expect(ImageDataDirectory)
    self.StringNameSignature = self.expect(ImageDataDirectory)
    self.CodeManagerTable = self.expect(ImageDataDirectory)
    self.VTableFixups = self.expect(ImageDataDirectory)
    self.ExportAddressTableJumps = self.expect(ImageDataDirectory)
    self.ManagedNativeHeader = self.expect(ImageDataDirectory)
    # Known Flags
    self.KnownFlags = dict(
        IL_ONLY=((self.Flags >> 0) & 1 == 1),
        REQUIRE_32BIT=((self.Flags >> 1) & 1 == 1),
        IL_LIBRARY=((self.Flags >> 2) & 1 == 1),
        STRONG_NAME_SIGNED=((self.Flags >> 3) & 1 == 1),
        NATIVE_ENTRYPOINT=((self.Flags >> 4) & 1 == 1),
        TRACK_DEBUG_DATA=((self.Flags >> 16) & 1 == 1)
    )

class NetMetaDataStreamEntry (reader, cleanup=True, **kw)

Expand source code Browse git

class NetMetaDataStreamEntry(Struct):
    def parse(self):
        self.VirtualAddress = self.expect(UInt32)
        self.Size = self.expect(UInt32)
        self.Name = self.expect(NullTerminatedString, align=4)

Ancestors

Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.VirtualAddress = self.expect(UInt32)
    self.Size = self.expect(UInt32)
    self.Name = self.expect(NullTerminatedString, align=4)

class NetMetaDataTablesHeader (reader, cleanup=True, **kw)

Expand source code Browse git

class NetMetaDataTablesHeader(Struct):
    def parse(self):
        Types = (UInt16, UInt32)
        self._Reserved1 = self.expect(UInt32)
        self.MajorVersion = self.expect(Byte)
        self.MinorVersion = self.expect(Byte)
        self.Flags = BitMask(self.expect(Byte))
        self.KnownFlags = dict(
            PADDING=bool(self.Flags[3]),
            DELTA_ONLY=bool(self.Flags[5]),
            LARGE_STRA=bool(self.Flags[0]),  # Strings require 4 byte offsets
            LARGE_GUID=bool(self.Flags[1]),  # GUIDs require 4 byte offsets
            LARGE_BLOB=bool(self.Flags[2]),  # Blobs require 4 byte offsets
            EXTRA_DATA=bool(self.Flags[6]),  # Extra data follows the row counts
            HAS_DELETE=bool(self.Flags[7])   # Certain tables can contain deleted rows.
        )
        self.HeapOffsetTypes = Box(
            String=Types[self.Flags[0]],
            GUID=Types[self.Flags[1]],
            Blob=Types[self.Flags[2]])
        self._Reserved2 = self.expect(Byte)
        self.ExistingRows = BitMask(self.expect(UInt64))
        self.SortedRows = BitMask(self.expect(UInt64))
        self.RowCount = {k: self.expect(UInt32) for k in self.ExistingRows}

Ancestors

Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    Types = (UInt16, UInt32)
    self._Reserved1 = self.expect(UInt32)
    self.MajorVersion = self.expect(Byte)
    self.MinorVersion = self.expect(Byte)
    self.Flags = BitMask(self.expect(Byte))
    self.KnownFlags = dict(
        PADDING=bool(self.Flags[3]),
        DELTA_ONLY=bool(self.Flags[5]),
        LARGE_STRA=bool(self.Flags[0]),  # Strings require 4 byte offsets
        LARGE_GUID=bool(self.Flags[1]),  # GUIDs require 4 byte offsets
        LARGE_BLOB=bool(self.Flags[2]),  # Blobs require 4 byte offsets
        EXTRA_DATA=bool(self.Flags[6]),  # Extra data follows the row counts
        HAS_DELETE=bool(self.Flags[7])   # Certain tables can contain deleted rows.
    )
    self.HeapOffsetTypes = Box(
        String=Types[self.Flags[0]],
        GUID=Types[self.Flags[1]],
        Blob=Types[self.Flags[2]])
    self._Reserved2 = self.expect(Byte)
    self.ExistingRows = BitMask(self.expect(UInt64))
    self.SortedRows = BitMask(self.expect(UInt64))
    self.RowCount = {k: self.expect(UInt32) for k in self.ExistingRows}

class NetMetaDataTables (reader, streams)

Expand source code Browse git

class NetMetaDataTables(Struct):
    lookup = {
        0x00: Module,
        0x01: TypeRef,
        0x02: TypeDef,
        0x03: FieldPtr,
        0x04: Field,
        0x05: MethodPtr,
        0x06: MethodDef,
        0x07: ParamPtr,
        0x08: Param,
        0x09: InterfaceImpl,
        0x0A: MemberRef,
        0x0B: Constant,
        0x0C: CustomAttribute,
        0x0D: FieldMarshal,
        0x0E: Permission,
        0x0F: ClassLayout,
        0x10: FieldLayout,
        0x11: StandAloneSig,
        0x12: EventMap,
        0x13: EventPtr,
        0x14: Event,
        0x15: PropertyMap,
        0x16: PropertyPtr,
        0x17: Property,
        0x18: MethodSemantics,
        0x19: MethodImpl,
        0x1A: ModuleRef,
        0x1B: TypeSpec,
        0x1C: ImplMap,
        0x1D: FieldRVA,
        0x1E: ENCLog,
        0x1F: ENCMap,
        0x20: Assembly,
        0x21: AssemblyProcessor,
        0x22: AssemblyOS,
        0x23: AssemblyRef,
        0x24: AssemblyRefProcessor,
        0x25: AssemblyRefOS,
        0x26: File,
        0x27: ExportedType,
        0x28: ManifestResource,
        0x29: NestedClass,
        0x2A: GenericParam,
        0x2B: MethodSpec,
        0x2C: GenericParamConstraint,
    }

    def __init__(self, reader, streams):
        Struct.__init__(self, reader, _streams=streams)

    def parse(self):
        self.Header: NetMetaDataTablesHeader = self.expect(NetMetaDataTablesHeader)
        if self.Header.Flags[6]:
            self.ExtraData = self.expect(UInt32)

        self.Module: list[Module] = []
        self.TypeRef: list[TypeRef] = []
        self.TypeDef: list[TypeDef] = []
        self.FieldPtr: list[FieldPtr] = []
        self.Field: list[Field] = []
        self.MethodPtr: list[MethodPtr] = []
        self.MethodDef: list[MethodDef] = []
        self.ParamPtr: list[ParamPtr] = []
        self.Param: list[Param] = []
        self.InterfaceImpl: list[InterfaceImpl] = []
        self.MemberRef: list[MemberRef] = []
        self.Constant: list[Constant] = []
        self.CustomAttribute: list[CustomAttribute] = []
        self.FieldMarshal: list[FieldMarshal] = []
        self.Permission: list[Permission] = []
        self.ClassLayout: list[ClassLayout] = []
        self.FieldLayout: list[FieldLayout] = []
        self.StandAloneSig: list[StandAloneSig] = []
        self.EventMap: list[EventMap] = []
        self.EventPtr: list[EventPtr] = []
        self.Event: list[Event] = []
        self.PropertyMap: list[PropertyMap] = []
        self.PropertyPtr: list[PropertyPtr] = []
        self.Property: list[Property] = []
        self.MethodSemantics: list[MethodSemantics] = []
        self.MethodImpl: list[MethodImpl] = []
        self.ModuleRef: list[ModuleRef] = []
        self.TypeSpec: list[TypeSpec] = []
        self.ImplMap: list[ImplMap] = []
        self.FieldRVA: list[FieldRVA] = []
        self.ENCLog: list[ENCLog] = []
        self.ENCMap: list[ENCMap] = []
        self.Assembly: list[Assembly] = []
        self.AssemblyProcessor: list[AssemblyProcessor] = []
        self.AssemblyOS: list[AssemblyOS] = []
        self.AssemblyRef: list[AssemblyRef] = []
        self.AssemblyRefProcessor: list[AssemblyRefProcessor] = []
        self.AssemblyRefOS: list[AssemblyRefOS] = []
        self.File: list[File] = []
        self.ExportedType: list[ExportedType] = []
        self.ManifestResource: list[ManifestResource] = []
        self.NestedClass: list[NestedClass] = []
        self.GenericParam: list[GenericParam] = []
        self.MethodSpec: list[MethodSpec] = []
        self.GenericParamConstraint: list[GenericParamConstraint] = []

        for k in sorted(self.Header.RowCount):
            count = self.Header.RowCount[k]
            try:
                Type = self.lookup[k]
            except KeyError:
                raise RuntimeError('Cannot parse unknown table index 0x{:08X}; unable to continue parsing.')
            TypeEntries = getattr(self, repr(Type))
            for _ in range(count):
                Entry = self.expect(Type, streams=self._streams, header=self.Header)
                TypeEntries.append(Entry)

    def __getitem__(self, k):
        try:
            Type = self.lookup[k]
        except KeyError:
            return super().__getitem__(k)
        else:
            return getattr(self, repr(Type))

Ancestors

Struct
Box
builtins.dict
MetaBox

Class variables

var lookup

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Header: NetMetaDataTablesHeader = self.expect(NetMetaDataTablesHeader)
    if self.Header.Flags[6]:
        self.ExtraData = self.expect(UInt32)

    self.Module: list[Module] = []
    self.TypeRef: list[TypeRef] = []
    self.TypeDef: list[TypeDef] = []
    self.FieldPtr: list[FieldPtr] = []
    self.Field: list[Field] = []
    self.MethodPtr: list[MethodPtr] = []
    self.MethodDef: list[MethodDef] = []
    self.ParamPtr: list[ParamPtr] = []
    self.Param: list[Param] = []
    self.InterfaceImpl: list[InterfaceImpl] = []
    self.MemberRef: list[MemberRef] = []
    self.Constant: list[Constant] = []
    self.CustomAttribute: list[CustomAttribute] = []
    self.FieldMarshal: list[FieldMarshal] = []
    self.Permission: list[Permission] = []
    self.ClassLayout: list[ClassLayout] = []
    self.FieldLayout: list[FieldLayout] = []
    self.StandAloneSig: list[StandAloneSig] = []
    self.EventMap: list[EventMap] = []
    self.EventPtr: list[EventPtr] = []
    self.Event: list[Event] = []
    self.PropertyMap: list[PropertyMap] = []
    self.PropertyPtr: list[PropertyPtr] = []
    self.Property: list[Property] = []
    self.MethodSemantics: list[MethodSemantics] = []
    self.MethodImpl: list[MethodImpl] = []
    self.ModuleRef: list[ModuleRef] = []
    self.TypeSpec: list[TypeSpec] = []
    self.ImplMap: list[ImplMap] = []
    self.FieldRVA: list[FieldRVA] = []
    self.ENCLog: list[ENCLog] = []
    self.ENCMap: list[ENCMap] = []
    self.Assembly: list[Assembly] = []
    self.AssemblyProcessor: list[AssemblyProcessor] = []
    self.AssemblyOS: list[AssemblyOS] = []
    self.AssemblyRef: list[AssemblyRef] = []
    self.AssemblyRefProcessor: list[AssemblyRefProcessor] = []
    self.AssemblyRefOS: list[AssemblyRefOS] = []
    self.File: list[File] = []
    self.ExportedType: list[ExportedType] = []
    self.ManifestResource: list[ManifestResource] = []
    self.NestedClass: list[NestedClass] = []
    self.GenericParam: list[GenericParam] = []
    self.MethodSpec: list[MethodSpec] = []
    self.GenericParamConstraint: list[GenericParamConstraint] = []

    for k in sorted(self.Header.RowCount):
        count = self.Header.RowCount[k]
        try:
            Type = self.lookup[k]
        except KeyError:
            raise RuntimeError('Cannot parse unknown table index 0x{:08X}; unable to continue parsing.')
        TypeEntries = getattr(self, repr(Type))
        for _ in range(count):
            Entry = self.expect(Type, streams=self._streams, header=self.Header)
            TypeEntries.append(Entry)

class ODict (*args, **kwargs)

Expand source code Browse git

class ODict(dict):
    def in_sequence(self, k, default=None):
        for j, index in enumerate(sorted(self)):
            if j == k:
                return self[index]
        else:
            return default

Ancestors

builtins.dict

Methods

def in_sequence(self, k, default=None)

Expand source code Browse git

def in_sequence(self, k, default=None):
    for j, index in enumerate(sorted(self)):
        if j == k:
            return self[index]
    else:
        return default

class NetMetaDataStreamDummy (default=None)

Expand source code Browse git

class NetMetaDataStreamDummy(dict):
    def __init__(self, default=None):
        self._default = default
        dict.__init__(self)

    def __getitem__(self, offset):
        return self._default

Ancestors

builtins.dict

class NetMetaDataStream (reader, type, default=None)

Expand source code Browse git

class NetMetaDataStream(dict):
    def __init__(self, reader, type, default=None):
        dict.__init__(self)
        self._default = default
        self._reader = reader
        self._type = type
        self._cached = False
        self.read()

    def _next(self):
        return self._reader.expect(self._type)

    def __getitem__(self, offset):
        if offset < 0:
            return self._default
        try:
            return dict.__getitem__(self, offset)
        except KeyError:
            try:
                self._reader.seek(offset)
                item = self._next()
            except ParserException:
                pass
            else:
                self[offset] = item
                return item
        try:
            closest = max(key for key in self if key < offset)
        except ValueError:
            return None
        container = unpack(self[closest])
        return container[offset - closest:] or self._default

    def read(self):
        if self._cached:
            return
        self._reader.seek(0)
        while True:
            offset = self._reader.tell()
            try:
                self[offset] = self._next()
            except ParserException:
                break
        self._cached = True

    def __iter__(self):
        self.read()
        return dict.__iter__(self)

Ancestors

builtins.dict

Methods

def read(self)

Expand source code Browse git

def read(self):
    if self._cached:
        return
    self._reader.seek(0)
    while True:
        offset = self._reader.tell()
        try:
            self[offset] = self._next()
        except ParserException:
            break
    self._cached = True

class NetMetaDataStreams (reader, meta)

Expand source code Browse git

class NetMetaDataStreams(Struct):
    def __init__(self, reader, meta):
        Struct.__init__(self, reader, _meta=meta)

    def _read_all(self, reader, Type):
        while True:
            offset = reader.tell()
            try:
                yield offset, reader.expect(Type)
            except ParserException:
                break

    def parse(self):
        self.Tables: NetMetaDataTables = None
        self.Strings = NetMetaDataStreamDummy('')
        self.US = NetMetaDataStreamDummy('')
        self.GUID = NetMetaDataStreamDummy()
        self.Blob = NetMetaDataStreamDummy(B'')
        with self._reader.checkpoint():
            TableName = '#~'
            for se in self._meta.StreamInfo:
                if se.Name == TableName:
                    break
                if se.Name == '#-':
                    TableName = se.Name
                    break
            for k, name in reversed(tuple(enumerate((TableName, '#Strings', '#US', '#GUID', '#Blob')))):
                for _, Entry in enumerate(self._meta.StreamInfo):
                    if Entry.Name.upper() == name.upper():
                        break
                else:
                    continue
                self._reader.seek(Entry.VirtualAddress)
                try:
                    reader = StreamReader(self._reader.read(Entry.Size))
                except ParserEOF:
                    continue
                if name != TableName:
                    Default = ['', '', None, B''][k - 1]
                    Type = [NullTerminatedString, UnicodeString, StringGUID, RawBytes][k - 1]
                    Stream = NetMetaDataStream(reader, Type, Default)
                    setattr(self, name[1:], Stream)
                else:
                    self.Tables = reader.expect(NetMetaDataTables, streams=self)

Ancestors

Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Tables: NetMetaDataTables = None
    self.Strings = NetMetaDataStreamDummy('')
    self.US = NetMetaDataStreamDummy('')
    self.GUID = NetMetaDataStreamDummy()
    self.Blob = NetMetaDataStreamDummy(B'')
    with self._reader.checkpoint():
        TableName = '#~'
        for se in self._meta.StreamInfo:
            if se.Name == TableName:
                break
            if se.Name == '#-':
                TableName = se.Name
                break
        for k, name in reversed(tuple(enumerate((TableName, '#Strings', '#US', '#GUID', '#Blob')))):
            for _, Entry in enumerate(self._meta.StreamInfo):
                if Entry.Name.upper() == name.upper():
                    break
            else:
                continue
            self._reader.seek(Entry.VirtualAddress)
            try:
                reader = StreamReader(self._reader.read(Entry.Size))
            except ParserEOF:
                continue
            if name != TableName:
                Default = ['', '', None, B''][k - 1]
                Type = [NullTerminatedString, UnicodeString, StringGUID, RawBytes][k - 1]
                Stream = NetMetaDataStream(reader, Type, Default)
                setattr(self, name[1:], Stream)
            else:
                self.Tables = reader.expect(NetMetaDataTables, streams=self)

class NetMetaData (reader, cleanup=True, **kw)

Expand source code Browse git

class NetMetaData(Struct):
    @property
    def resources(self):
        return self.Streams.Tables.ManifestResource

    @property
    def RVAs(self):
        return self.Streams.Tables.FieldRVA

    def parse(self):
        try:
            self.Signature = self.expect(UInt32)
        except ParserEOF:
            raise InvalidSignature
        if self.Signature != 0x424A5342:
            raise InvalidSignature
        self.MajorVersion = self.expect(UInt16)
        self.MinorVersion = self.expect(UInt16)
        self._Reserved = self.expect(UInt32)
        size = self.expect(UInt32)
        self.VersionString = self.expect(StringPrimitive, size=size, align=4)
        self.Flags = self.expect(UInt16)
        self.StreamCount = self.expect(UInt16)
        self.StreamInfo = [
            self.expect(NetMetaDataStreamEntry)
            for _ in range(self.StreamCount)
        ]
        self.Streams: NetMetaDataStreams = self.expect(NetMetaDataStreams, meta=self)

Ancestors

Struct
Box
builtins.dict
MetaBox

Instance variables

var resources

Expand source code Browse git

@property
def resources(self):
    return self.Streams.Tables.ManifestResource

var RVAs

Expand source code Browse git

@property
def RVAs(self):
    return self.Streams.Tables.FieldRVA

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    try:
        self.Signature = self.expect(UInt32)
    except ParserEOF:
        raise InvalidSignature
    if self.Signature != 0x424A5342:
        raise InvalidSignature
    self.MajorVersion = self.expect(UInt16)
    self.MinorVersion = self.expect(UInt16)
    self._Reserved = self.expect(UInt32)
    size = self.expect(UInt32)
    self.VersionString = self.expect(StringPrimitive, size=size, align=4)
    self.Flags = self.expect(UInt16)
    self.StreamCount = self.expect(UInt16)
    self.StreamInfo = [
        self.expect(NetMetaDataStreamEntry)
        for _ in range(self.StreamCount)
    ]
    self.Streams: NetMetaDataStreams = self.expect(NetMetaDataStreams, meta=self)

class NetResourceWithName (reader, cleanup=True, **kw)

Expand source code Browse git

class NetResourceWithName(Struct):
    def parse(self):
        self.Name = self.expect(StringPrimitive, codec='utf-16LE')
        self.Offset = self.expect(UInt32)
        with self._reader.checkpoint():
            self._reader.seek(self.Offset)
            self.Size = self.expect(UInt32)
            self.Data = self._reader.read(self.Size)

Ancestors

Struct
Box
builtins.dict
MetaBox

Methods

def parse(self)

Expand source code Browse git

def parse(self):
    self.Name = self.expect(StringPrimitive, codec='utf-16LE')
    self.Offset = self.expect(UInt32)
    with self._reader.checkpoint():
        self._reader.seek(self.Offset)
        self.Size = self.expect(UInt32)
        self.Data = self._reader.read(self.Size)

class DotNetHeader (data, pe=None, parse_resources=True)

Expand source code Browse git

class DotNetHeader:
    def __init__(self, data, pe=None, parse_resources=True):
        try:
            self.pe = pe = pe or lief.load_pe(data)
            self.data = data
            self.head = NetDirectory(self.reader(pe.data_directory(lief.PE.DataDirectory.TYPES.CLR_RUNTIME_HEADER)))
        except Exception as E:
            raise InvalidDotNetHeader from E
        try:
            self.meta = NetMetaData(self.reader(self.head.MetaData))
        except Exception as E:
            raise InvalidDotNetHeader from E
        self.resources = self.parse_resources() if parse_resources else []

    def parse_resources(self):
        def parse(reader):
            for entry in self.meta.resources:
                try:
                    reader.seek(entry.Offset)
                    size = reader.expect(UInt32)
                    yield Box(
                        Name=entry.Name,
                        Data=reader.read(size)
                    )
                except ParserEOF:
                    yield Box(
                        Name=entry.Name,
                        Data=B''
                    )
        return list(parse(self.reader(self.head.Resources)))

    def reader(self, obj):
        try:
            rva, size = obj.rva, obj.size
        except AttributeError:
            rva, size = obj.VirtualAddress, obj.Size
        start = self.pe.rva_to_offset(rva)
        end = start + size
        return StreamReader(self.data[start:end])

Methods

def parse_resources(self)

Expand source code Browse git

def parse_resources(self):
    def parse(reader):
        for entry in self.meta.resources:
            try:
                reader.seek(entry.Offset)
                size = reader.expect(UInt32)
                yield Box(
                    Name=entry.Name,
                    Data=reader.read(size)
                )
            except ParserEOF:
                yield Box(
                    Name=entry.Name,
                    Data=B''
                )
    return list(parse(self.reader(self.head.Resources)))

def reader(self, obj)

Expand source code Browse git

def reader(self, obj):
    try:
        rva, size = obj.rva, obj.size
    except AttributeError:
        rva, size = obj.VirtualAddress, obj.Size
    start = self.pe.rva_to_offset(rva)
    end = start + size
    return StreamReader(self.data[start:end])