md

Documentation

Overview

Package md contains win32metadata structures and decoding helpers.

Index

• type CLIHeader
• type Column
  • func (c Column) Zero() bool
• type Columns
• type Metadata
  • func ParseMetadata(f *pe.File) (*Metadata, error)
  • func (m *Metadata) ReadBlob(idx uint64) ([]byte, error)
  • func (m *Metadata) ReadString(idx uint64) (string, error)
  • func (m *Metadata) StreamByName(name string) (*io.SectionReader, error)
  • func (m *Metadata) Tables() (TablesHeader, *io.SectionReader, error)
• type MetadataRoot
  • func (m *MetadataRoot) Decode(r io.Reader) error
• type StreamHeader
  • func (h *StreamHeader) Decode(r io.Reader) error
• type Table
  • func (t Table) Find(row, column uint32) (uint32, error)
  • func (t Table) IndexSize() uint32
  • func (t *Table) SetRowType(sizes [6]uint32)
  • func (t Table) Uint32(r io.ReaderAt, row, column uint32) (uint32, error)
  • func (t Table) Uint64(r io.ReaderAt, row, column uint32) (uint64, error)
• type TableType
  • func (i TableType) String() string
• type TablesHeader
  • func (h TablesHeader) BlobIndexSize() uint32
  • func (h *TablesHeader) Decode(r io.Reader) error
  • func (h TablesHeader) GUIDIndexSize() uint32
  • func (h TablesHeader) StringIndexSize() uint32

Types

type CLIHeader

type CLIHeader struct {
	CB                             uint32
	MajorRuntimeVersion            uint16
	MinorRuntimeVersion            uint16
	MetaData                       pe.DataDirectory
	Flags                          uint32
	EntryPointTokenOrEntryPointRva uint32
	Resources                      pe.DataDirectory
	StrongNameSignature            pe.DataDirectory
	CodeManagerTable               pe.DataDirectory
	VtableFixups                   pe.DataDirectory
	ExportAddressTableJumps        pe.DataDirectory
	ManagedNativeHeader            pe.DataDirectory
}

CLIHeader is a II.25.3.3 CLI header representation.

type Column

type Column struct {
	// Offset from row start.
	Offset uint32
	// Size of column in bytes.
	Size uint32
}

Column represents metadata table column sizes.

func (Column) Zero

func (c Column) Zero() bool

Zero denotes that column has zero value.

type Columns

type Columns = [6]Column

Columns is a table columns list.

type Metadata

type Metadata struct {
	MetadataRoot
	// contains filtered or unexported fields
}

Metadata is a simple wrapper around MetadataRoot to access metadata streams.

func ParseMetadata

func ParseMetadata(f *pe.File) (*Metadata, error)

ParseMetadata parses and creates Metadata from given PE file.

func (*Metadata) ReadBlob

func (m *Metadata) ReadBlob(idx uint64) ([]byte, error)

ReadBlob reads blob from Blob heap.

func (*Metadata) ReadString

func (m *Metadata) ReadString(idx uint64) (string, error)

ReadString reads string from String heap.

func (*Metadata) StreamByName

func (m *Metadata) StreamByName(name string) (*io.SectionReader, error)

StreamByName finds and returns metadata section reader by name.

func (*Metadata) Tables

func (m *Metadata) Tables() (TablesHeader, *io.SectionReader, error)

Tables decodes metadata tables header and returns it and table data reader.

type MetadataRoot

type MetadataRoot struct {
	MajorVersion  uint16
	MinorVersion  uint16
	Reserved      [4]byte
	Version       string
	Flags         uint16
	StreamHeaders []StreamHeader
}

MetadataRoot is a representation of II.24.2.1 Metadata root

func (*MetadataRoot) Decode

func (m *MetadataRoot) Decode(r io.Reader) error

Decode decodes MetadataRoot from stream.

type StreamHeader

type StreamHeader struct {
	Offset uint32
	Size   uint32
	Name   string
}

StreamHeader is a representation of II.24.2.2 Stream header.

func (*StreamHeader) Decode

func (h *StreamHeader) Decode(r io.Reader) error

Decode decodes StreamHeader from stream.

type Table

type Table struct {
	Type     TableType
	Offset   int64
	RowCount uint32
	RowSize  uint32
	Columns  Columns
}

Table represents metadata table header.

func (Table) Find

func (t Table) Find(row, column uint32) (uint32, error)

Find returns offset of given column in row.

func (Table) IndexSize

func (t Table) IndexSize() uint32

IndexSize returns size of table index.

func (*Table) SetRowType

func (t *Table) SetRowType(sizes [6]uint32)

SetRowType sets rows sizes. NB: Zero size means that column is not present.

func (Table) Uint32

func (t Table) Uint32(r io.ReaderAt, row, column uint32) (uint32, error)

Uint32 returns numeric value truncated to uint32.

func (Table) Uint64

func (t Table) Uint64(r io.ReaderAt, row, column uint32) (uint64, error)

Uint64 returns numeric value truncated to uint64.

type TableType

type TableType int

TableType is a metadata table type.

See II.22.1 Metadata validation rules.

const (
	// Module table type.
	Module TableType = 0x00
	// TypeRef table type.
	TypeRef TableType = 0x01
	// TypeDef table type.
	TypeDef TableType = 0x02
	// Field table type.
	Field TableType = 0x04
	// MethodDef table type.
	MethodDef TableType = 0x06
	// Param table type.
	Param TableType = 0x08
	// InterfaceImpl table type.
	InterfaceImpl TableType = 0x09
	// MemberRef table type.
	MemberRef TableType = 0x0a
	// Constant table type.
	Constant TableType = 0x0b
	// CustomAttribute table type.
	CustomAttribute TableType = 0x0c
	// FieldMarshal table type.
	FieldMarshal TableType = 0x0d
	// DeclSecurity table type.
	DeclSecurity TableType = 0x0e
	// ClassLayout table type.
	ClassLayout TableType = 0x0f
	// FieldLayout table type.
	FieldLayout TableType = 0x10
	// StandAloneSig table type.
	StandAloneSig TableType = 0x11
	// EventMap table type.
	EventMap TableType = 0x12
	// Event table type.
	Event TableType = 0x14
	// PropertyMap table type.
	PropertyMap TableType = 0x15
	// Property table type.
	Property TableType = 0x17
	// MethodSemantics table type.
	MethodSemantics TableType = 0x18
	// MethodImpl table type.
	MethodImpl TableType = 0x19
	// ModuleRef table type.
	ModuleRef TableType = 0x1a
	// TypeSpec table type.
	TypeSpec TableType = 0x1b
	// ImplMap table type.
	ImplMap TableType = 0x1c
	// FieldRva table type.
	FieldRva TableType = 0x1d
	// Assembly table type.
	Assembly TableType = 0x20
	// AssemblyProcessor table type.
	AssemblyProcessor TableType = 0x21
	// AssemblyOs table type.
	AssemblyOs TableType = 0x22
	// AssemblyRef table type.
	AssemblyRef TableType = 0x23
	// AssemblyRefProcessor table type.
	AssemblyRefProcessor TableType = 0x24
	// AssemblyRefOs table type.
	AssemblyRefOs TableType = 0x25
	// File table type.
	File TableType = 0x26
	// ExportedType table type.
	ExportedType TableType = 0x27
	// ManifestResource table type.
	ManifestResource TableType = 0x28
	// NestedClass table type.
	NestedClass TableType = 0x29
	// GenericParam table type.
	GenericParam TableType = 0x2a
	// MethodSpec table type.
	MethodSpec TableType = 0x2b
	// GenericParamConstraint table type.
	GenericParamConstraint TableType = 0x2c
)

func (TableType) String

func (i TableType) String() string

type TablesHeader

type TablesHeader struct {
	Reserved     [4]byte
	MajorVersion uint8
	MinorVersion uint8
	HeapSizes    uint8
	Reserved2    [1]byte
	Valid        uint64
	Sorted       uint64
	Tables       [GenericParamConstraint + 1]Table
}

TablesHeader is a representation of II.24.2.6 #~ stream.

func (TablesHeader) BlobIndexSize

func (h TablesHeader) BlobIndexSize() uint32

BlobIndexSize returns size of index of "#Blob" heap.

func (*TablesHeader) Decode

func (h *TablesHeader) Decode(r io.Reader) error

Decode decodes TablesHeader from stream.

func (TablesHeader) GUIDIndexSize

func (h TablesHeader) GUIDIndexSize() uint32

GUIDIndexSize returns size of index of "#GUID" heap.

func (TablesHeader) StringIndexSize

func (h TablesHeader) StringIndexSize() uint32

StringIndexSize returns size of index of "#String" heap.