Rizin
unix-like reverse engineering framework and cli tools
dotnet.h File Reference
#include <rz_types.h>
#include <rz_vector.h>

Go to the source code of this file.

Classes

struct  Pe_image_clr_header
 
struct  Pe_image_metadata_header
 
struct  Pe_image_metadata_stream
 
struct  Pe_image_metadata_tilde_rowcounts
 
struct  Pe_image_metadata_tilde_header
 
struct  Pe_image_metadata_index_sizes
 
struct  Pe_image_metadata_methoddef
 
struct  Pe_image_metadata_typedef
 
struct  Pe_image_clr_methodheader
 
struct  Pe_image_clr
 

Macros

#define BIT_MODULE   0x00
 
#define BIT_TYPEREF   0x01
 
#define BIT_TYPEDEF   0x02
 
#define BIT_FIELDPTR   0x03
 
#define BIT_FIELD   0x04
 
#define BIT_METHODDEFPTR   0x05
 
#define BIT_METHODDEF   0x06
 
#define BIT_PARAMPTR   0x07
 
#define BIT_PARAM   0x08
 
#define BIT_INTERFACEIMPL   0x09
 
#define BIT_MEMBERREF   0x0A
 
#define BIT_CONSTANT   0x0B
 
#define BIT_CUSTOMATTRIBUTE   0x0C
 
#define BIT_FIELDMARSHAL   0x0D
 
#define BIT_DECLSECURITY   0x0E
 
#define BIT_CLASSLAYOUT   0x0F
 
#define BIT_FIELDLAYOUT   0x10
 
#define BIT_STANDALONESIG   0x11
 
#define BIT_EVENTMAP   0x12
 
#define BIT_EVENTPTR   0x13
 
#define BIT_EVENT   0x14
 
#define BIT_PROPERTYMAP   0x15
 
#define BIT_PROPERTYPTR   0x16
 
#define BIT_PROPERTY   0x17
 
#define BIT_METHODSEMANTICS   0x18
 
#define BIT_METHODIMPL   0x19
 
#define BIT_MODULEREF   0x1A
 
#define BIT_TYPESPEC   0x1B
 
#define BIT_IMPLMAP   0x1C
 
#define BIT_FIELDRVA   0x1D
 
#define BIT_ENCLOG   0x1E
 
#define BIT_ENCMAP   0x1F
 
#define BIT_ASSEMBLY   0x20
 
#define BIT_ASSEMBLYPROCESSOR   0x21
 
#define BIT_ASSEMBLYOS   0x22
 
#define BIT_ASSEMBLYREF   0x23
 
#define BIT_ASSEMBLYREFPROCESSOR   0x24
 
#define BIT_ASSEMBLYREFOS   0x25
 
#define BIT_FILE   0x26
 
#define BIT_EXPORTEDTYPE   0x27
 
#define BIT_MANIFESTRESOURCE   0x28
 
#define BIT_NESTEDCLASS   0x29
 
#define BIT_GENERICPARAM   0x2A
 
#define BIT_METHODSPEC   0x2B
 
#define BIT_GENERICPARAMCONSTRAINT   0x2C
 

Functions

int bin_pe_dotnet_init_metadata (Pe_image_clr *clr, bool big_endian, RzBuffer *b, ut64 metadata_directory)
 
int bin_pe_dotnet_init_clr (Pe_image_clr *clr, RzBuffer *b, ut64 image_clr_hdr_paddr)
 
void bin_pe_dotnet_destroy_clr (Pe_image_clr *clr)
 
int bin_pe_dotnet_read_method_header (Pe_image_clr *clr, RzBuffer *b, RzBinSymbol *sym)
 

Macro Definition Documentation

◆ BIT_ASSEMBLY

#define BIT_ASSEMBLY   0x20

Definition at line 206 of file dotnet.h.

◆ BIT_ASSEMBLYOS

#define BIT_ASSEMBLYOS   0x22

Definition at line 208 of file dotnet.h.

◆ BIT_ASSEMBLYPROCESSOR

#define BIT_ASSEMBLYPROCESSOR   0x21

Definition at line 207 of file dotnet.h.

◆ BIT_ASSEMBLYREF

#define BIT_ASSEMBLYREF   0x23

Definition at line 209 of file dotnet.h.

◆ BIT_ASSEMBLYREFOS

#define BIT_ASSEMBLYREFOS   0x25

Definition at line 211 of file dotnet.h.

◆ BIT_ASSEMBLYREFPROCESSOR

#define BIT_ASSEMBLYREFPROCESSOR   0x24

Definition at line 210 of file dotnet.h.

◆ BIT_CLASSLAYOUT

#define BIT_CLASSLAYOUT   0x0F

Definition at line 189 of file dotnet.h.

◆ BIT_CONSTANT

#define BIT_CONSTANT   0x0B

Definition at line 185 of file dotnet.h.

◆ BIT_CUSTOMATTRIBUTE

#define BIT_CUSTOMATTRIBUTE   0x0C

Definition at line 186 of file dotnet.h.

◆ BIT_DECLSECURITY

#define BIT_DECLSECURITY   0x0E

Definition at line 188 of file dotnet.h.

◆ BIT_ENCLOG

#define BIT_ENCLOG   0x1E

Definition at line 204 of file dotnet.h.

◆ BIT_ENCMAP

#define BIT_ENCMAP   0x1F

Definition at line 205 of file dotnet.h.

◆ BIT_EVENT

#define BIT_EVENT   0x14

Definition at line 194 of file dotnet.h.

◆ BIT_EVENTMAP

#define BIT_EVENTMAP   0x12

Definition at line 192 of file dotnet.h.

◆ BIT_EVENTPTR

#define BIT_EVENTPTR   0x13

Definition at line 193 of file dotnet.h.

◆ BIT_EXPORTEDTYPE

#define BIT_EXPORTEDTYPE   0x27

Definition at line 213 of file dotnet.h.

◆ BIT_FIELD

#define BIT_FIELD   0x04

Definition at line 178 of file dotnet.h.

◆ BIT_FIELDLAYOUT

#define BIT_FIELDLAYOUT   0x10

Definition at line 190 of file dotnet.h.

◆ BIT_FIELDMARSHAL

#define BIT_FIELDMARSHAL   0x0D

Definition at line 187 of file dotnet.h.

◆ BIT_FIELDPTR

#define BIT_FIELDPTR   0x03

Definition at line 177 of file dotnet.h.

◆ BIT_FIELDRVA

#define BIT_FIELDRVA   0x1D

Definition at line 203 of file dotnet.h.

◆ BIT_FILE

#define BIT_FILE   0x26

Definition at line 212 of file dotnet.h.

◆ BIT_GENERICPARAM

#define BIT_GENERICPARAM   0x2A

Definition at line 216 of file dotnet.h.

◆ BIT_GENERICPARAMCONSTRAINT

#define BIT_GENERICPARAMCONSTRAINT   0x2C

Definition at line 218 of file dotnet.h.

◆ BIT_IMPLMAP

#define BIT_IMPLMAP   0x1C

Definition at line 202 of file dotnet.h.

◆ BIT_INTERFACEIMPL

#define BIT_INTERFACEIMPL   0x09

Definition at line 183 of file dotnet.h.

◆ BIT_MANIFESTRESOURCE

#define BIT_MANIFESTRESOURCE   0x28

Definition at line 214 of file dotnet.h.

◆ BIT_MEMBERREF

#define BIT_MEMBERREF   0x0A

Definition at line 184 of file dotnet.h.

◆ BIT_METHODDEF

#define BIT_METHODDEF   0x06

Definition at line 180 of file dotnet.h.

◆ BIT_METHODDEFPTR

#define BIT_METHODDEFPTR   0x05

Definition at line 179 of file dotnet.h.

◆ BIT_METHODIMPL

#define BIT_METHODIMPL   0x19

Definition at line 199 of file dotnet.h.

◆ BIT_METHODSEMANTICS

#define BIT_METHODSEMANTICS   0x18

Definition at line 198 of file dotnet.h.

◆ BIT_METHODSPEC

#define BIT_METHODSPEC   0x2B

Definition at line 217 of file dotnet.h.

◆ BIT_MODULE

#define BIT_MODULE   0x00

Definition at line 174 of file dotnet.h.

◆ BIT_MODULEREF

#define BIT_MODULEREF   0x1A

Definition at line 200 of file dotnet.h.

◆ BIT_NESTEDCLASS

#define BIT_NESTEDCLASS   0x29

Definition at line 215 of file dotnet.h.

◆ BIT_PARAM

#define BIT_PARAM   0x08

Definition at line 182 of file dotnet.h.

◆ BIT_PARAMPTR

#define BIT_PARAMPTR   0x07

Definition at line 181 of file dotnet.h.

◆ BIT_PROPERTY

#define BIT_PROPERTY   0x17

Definition at line 197 of file dotnet.h.

◆ BIT_PROPERTYMAP

#define BIT_PROPERTYMAP   0x15

Definition at line 195 of file dotnet.h.

◆ BIT_PROPERTYPTR

#define BIT_PROPERTYPTR   0x16

Definition at line 196 of file dotnet.h.

◆ BIT_STANDALONESIG

#define BIT_STANDALONESIG   0x11

Definition at line 191 of file dotnet.h.

◆ BIT_TYPEDEF

#define BIT_TYPEDEF   0x02

Definition at line 176 of file dotnet.h.

◆ BIT_TYPEREF

#define BIT_TYPEREF   0x01

Definition at line 175 of file dotnet.h.

◆ BIT_TYPESPEC

#define BIT_TYPESPEC   0x1B

Definition at line 201 of file dotnet.h.

Function Documentation

◆ bin_pe_dotnet_destroy_clr()

void bin_pe_dotnet_destroy_clr ( Pe_image_clr clr)

Definition at line 968 of file dotnet.c.

968  {
969  if (!clr) {
970  return;
971  }
972  free(clr->header);
973  free(clr->tilde);
975  rz_list_free(clr->streams);
976  rz_buf_free(clr->strings);
977 
979  rz_list_free(clr->typedefs);
980 
981  free(clr);
982 }
static void free_metadata_header(Pe_image_metadata_header *metadata)
Definition: dotnet.c:960
RZ_API void Ht_() free(HtName_(Ht) *ht)
Definition: ht_inc.c:130
RZ_API void rz_list_free(RZ_NONNULL RzList *list)
Empties the list and frees the list pointer.
Definition: list.c:137
RZ_API void rz_buf_free(RzBuffer *b)
Free all internal data hold by the buffer and the buffer.
Definition: buf.c:1253
RZ_API void rz_pvector_free(RzPVector *vec)
Definition: vector.c:336
RzList * typedefs
Definition: dotnet.h:164
RzPVector * methoddefs
Definition: dotnet.h:163
Pe_image_metadata_header * metadata_header
Definition: dotnet.h:152
RzList * streams
Definition: dotnet.h:153
Pe_image_clr_header * header
Definition: dotnet.h:151
Pe_image_metadata_tilde_header * tilde
Definition: dotnet.h:161
RzBuffer * strings
Definition: dotnet.h:162

References free(), free_metadata_header(), Pe_image_clr::header, Pe_image_clr::metadata_header, Pe_image_clr::methoddefs, rz_buf_free(), rz_list_free(), rz_pvector_free(), Pe_image_clr::streams, Pe_image_clr::strings, Pe_image_clr::tilde, and Pe_image_clr::typedefs.

Referenced by rz_bin_pe_free().

◆ bin_pe_dotnet_init_clr()

int bin_pe_dotnet_init_clr ( Pe_image_clr clr,
RzBuffer b,
ut64  image_clr_hdr_paddr 
)

Definition at line 932 of file dotnet.c.

932  {
934  if (!header) {
935  goto error;
936  }
937  clr->header = header;
938 
939  int rr, len = sizeof(Pe_image_clr_header);
940 
941  rr = read_image_clr_header(b, image_clr_hdr_paddr, header);
942 
943  // probably not a .NET binary
944  // 64bit?
945  if (header->HeaderSize != 0x48) {
946  goto error;
947  }
948  if (rr != len) {
949  goto error;
950  }
951  return 0;
952 
953 error:
954  free(header);
955  free(clr);
956  return -1;
957 }
size_t len
Definition: 6502dis.c:15
static int read_image_clr_header(RzBuffer *b, ut64 addr, Pe_image_clr_header *header)
Definition: dotnet.c:715
#define header(is_bt, len_min, ret_op)
#define RZ_NEW0(x)
Definition: rz_types.h:284
#define b(i)
Definition: sha256.c:42
void error(const char *msg)
Definition: untgz.c:593

References b, error(), free(), Pe_image_clr::header, header, len, read_image_clr_header(), and RZ_NEW0.

Referenced by bin_pe_init_clr().

◆ bin_pe_dotnet_init_metadata()

int bin_pe_dotnet_init_metadata ( Pe_image_clr clr,
bool  big_endian,
RzBuffer b,
ut64  metadata_directory 
)

Definition at line 783 of file dotnet.c.

783  {
785  if (!metadata) {
786  return -1;
787  }
788  if (!metadata_directory) {
789  free(metadata);
790  return -1;
791  }
792 
793  int rr = rz_buf_fread_at(b, metadata_directory,
794  (ut8 *)metadata, big_endian ? "1I2S" : "1i2s", 1);
795  if (rr < 1) {
796  goto fail;
797  }
798 
799  rr = rz_buf_fread_at(b, metadata_directory + 8,
800  (ut8 *)(&metadata->Reserved), big_endian ? "1I" : "1i", 1);
801  if (rr < 1) {
802  goto fail;
803  }
804 
805  rr = rz_buf_fread_at(b, metadata_directory + 12,
806  (ut8 *)(&metadata->VersionStringLength), big_endian ? "1I" : "1i", 1);
807  if (rr < 1) {
808  goto fail;
809  }
810 
811  // read the version string
812  int len = metadata->VersionStringLength; // XXX: dont trust this length
813  if (len > 0) {
814  metadata->VersionString = calloc(1, len + 1);
815  if (!metadata->VersionString) {
816  goto fail;
817  }
818 
819  rr = rz_buf_read_at(b, metadata_directory + 16, (ut8 *)(metadata->VersionString), len);
820  if (rr != len) {
821  RZ_LOG_WARN("read (metadata header) - cannot parse version string\n");
822  free(metadata->VersionString);
823  free(metadata);
824  return -1;
825  }
826  }
827 
828  // read the header after the string
829  rr = rz_buf_fread_at(b, metadata_directory + 16 + metadata->VersionStringLength,
830  (ut8 *)(&metadata->Flags), big_endian ? "2S" : "2s", 1);
831 
832  if (rr < 1) {
833  goto fail;
834  }
835 
836  clr->metadata_header = metadata;
837 
838  // read metadata streams
839  int start_of_stream = metadata_directory + 20 + metadata->VersionStringLength;
842  if (!streams) {
843  goto fail;
844  }
845  int count = 0;
846 
847  while (count < metadata->NumberOfStreams) {
849  if (!stream) {
851  goto fail;
852  }
853 
854  if (rz_buf_fread_at(b, start_of_stream, (ut8 *)stream, big_endian ? "2I" : "2i", 1) < 1) {
855  free(stream);
857  goto fail;
858  }
859  char *stream_name = calloc(1, MAX_METADATA_STRING_LENGTH + 1);
860 
861  if (!stream_name) {
862  free(stream);
864  goto fail;
865  }
866 
867  if (rz_buf_size(b) < (start_of_stream + 8 + MAX_METADATA_STRING_LENGTH)) {
868  free(stream_name);
869  free(stream);
871  goto fail;
872  }
873  int c = bin_pe_read_metadata_string(stream_name, b, start_of_stream + 8);
874  if (c == 0) {
875  free(stream_name);
876  free(stream);
878  goto fail;
879  }
880 
881  stream->Name = stream_name;
883  start_of_stream += 8 + c;
884  count += 1;
885 
886  // save special streams
887  if (strncmp(stream_name, "#Strings", 8) == 0 && clr->strings_stream == NULL) {
888  clr->strings_stream = stream;
889  } else if (strncmp(stream_name, "#~", 2) == 0 && clr->tilde_stream == NULL) {
890  clr->tilde_stream = stream;
891  } else if (strncmp(stream_name, "#Blob", 5) == 0) {
892  clr->blob_stream = stream;
893  }
894  }
895  clr->streams = streams;
896 
897  if (clr->strings_stream) {
898  RzBuffer *strings = rz_buf_new_slice(b, metadata_directory + clr->strings_stream->Offset, clr->strings_stream->Size);
899  if (!strings) {
900  return -1;
901  }
902  clr->strings = strings;
903  }
904 
905  if (clr->tilde_stream && clr->blob_stream && clr->strings) {
907  clr->typedefs = rz_list_newf(free);
908  if (!clr->methoddefs || !clr->typedefs) {
909  goto fail;
910  }
911 
913  if (!tilde) {
914  goto fail;
915  }
916 
917  clr->tilde = tilde;
918  if (read_image_metadata_tilde_header(b, metadata_directory + clr->tilde_stream->Offset, clr)) {
919  RZ_LOG_WARN("read (metadata tilde header)\n");
920  goto fail;
921  }
922  }
923 
924  return -1;
925 fail:
926  RZ_LOG_WARN("read (metadata header)\n");
927  free(metadata);
928  clr->metadata_header = NULL;
929  return 0;
930 }
#define NULL
Definition: cris-opc.c:27
static static sync static getppid static getegid const char static filename char static len const char char static bufsiz static mask static vfork const void static prot static getpgrp const char static swapflags static arg static fd static protocol static who struct sockaddr static addrlen static backlog struct timeval struct timezone static tz const struct iovec static count static mode const void const struct sockaddr static tolen const char static pathname void count
Definition: sflib.h:98
static void _free_stream(Pe_image_metadata_stream *stream)
Definition: dotnet.c:32
static int read_image_metadata_tilde_header(RzBuffer *b, ut64 addr, Pe_image_clr *clr)
Definition: dotnet.c:62
static int bin_pe_read_metadata_string(char *to, RzBuffer *frombuf, ut64 fromoff)
Definition: dotnet.c:11
#define MAX_METADATA_STRING_LENGTH
Definition: dotnet.c:9
checking print the parsed form of the magic use in n conjunction with m to debug a new magic file n before installing it n output MIME type strings(--mime-type and\n" " --mime-encoding)\n") OPT('s'
voidpf stream
Definition: ioapi.h:138
uint8_t ut8
Definition: lh5801.h:11
RZ_API RZ_OWN RzList * rz_list_newf(RzListFree f)
Returns a new initialized RzList pointer and sets the free method.
Definition: list.c:248
RZ_API RZ_BORROW RzListIter * rz_list_append(RZ_NONNULL RzList *list, void *data)
Appends at the end of the list a new element.
Definition: list.c:288
void * calloc(size_t number, size_t size)
Definition: malloc.c:102
RZ_API st64 rz_buf_read_at(RZ_NONNULL RzBuffer *b, ut64 addr, RZ_NONNULL RZ_OUT ut8 *buf, ut64 len)
Read len bytes of the buffer at the specified address.
Definition: buf.c:1136
RZ_API st64 rz_buf_fread_at(RZ_NONNULL RzBuffer *b, ut64 addr, RZ_NONNULL ut8 *buf, RZ_NONNULL const char *fmt, int n)
...
Definition: buf.c:1001
RZ_API RZ_OWN RzBuffer * rz_buf_new_slice(RzBuffer *b, ut64 offset, ut64 size)
Creates a new buffer from a slice of another buffer.
Definition: buf.c:364
RZ_API ut64 rz_buf_size(RZ_NONNULL RzBuffer *b)
Return the size of the buffer.
Definition: buf.c:1225
void(* RzListFree)(void *ptr)
Definition: rz_list.h:11
#define RZ_LOG_WARN(fmtstr,...)
Definition: rz_log.h:56
RZ_API RzPVector * rz_pvector_new(RzPVectorFree free)
Definition: vector.c:302
#define c(i)
Definition: sha256.c:43
Pe_image_metadata_stream * tilde_stream
Definition: dotnet.h:156
Pe_image_metadata_stream * strings_stream
Definition: dotnet.h:157
Pe_image_metadata_stream * blob_stream
Definition: dotnet.h:158
uint64_t streams
Definition: list.c:103
#define fail(test)
Definition: tests.h:29

References _free_stream(), b, bin_pe_read_metadata_string(), Pe_image_clr::blob_stream, c, calloc(), count, fail, Pe_image_metadata_header::Flags, free(), len, MAX_METADATA_STRING_LENGTH, Pe_image_clr::metadata_header, Pe_image_clr::methoddefs, NULL, Pe_image_metadata_stream::Offset, read_image_metadata_tilde_header(), Pe_image_metadata_header::Reserved, rz_buf_fread_at(), rz_buf_new_slice(), rz_buf_read_at(), rz_buf_size(), rz_list_append(), rz_list_free(), rz_list_newf(), RZ_LOG_WARN, RZ_NEW0, rz_pvector_new(), Pe_image_metadata_stream::Size, Pe_image_clr::streams, streams, Pe_image_clr::strings, strings(), Pe_image_clr::strings_stream, Pe_image_clr::tilde, Pe_image_clr::tilde_stream, Pe_image_clr::typedefs, Pe_image_metadata_header::VersionString, and Pe_image_metadata_header::VersionStringLength.

Referenced by bin_pe_init_clr().

◆ bin_pe_dotnet_read_method_header()

int bin_pe_dotnet_read_method_header ( Pe_image_clr clr,
RzBuffer b,
RzBinSymbol sym 
)

Definition at line 745 of file dotnet.c.

745  {
746  st64 o_addr = rz_buf_seek(b, 0, RZ_BUF_CUR);
747  if (rz_buf_seek(b, sym->paddr, RZ_BUF_SET) < 0) {
748  return -1;
749  }
750 
752  if (!rz_buf_read8(b, buf)) {
753  return -1;
754  }
755 
756  if ((buf[0] & 0x03) == 0x02) { // Tiny
757  sym->paddr += 1;
758  sym->vaddr += 1;
759  sym->size = buf[0] >> 2;
760  } else if ((buf[0] & 0x03) == 0x03) { // Fat
761  rz_buf_read(b, buf + 1, sizeof(Pe_image_clr_methodheader) - 1);
762  Pe_image_clr_methodheader methodheader;
764  PE_READ_STRUCT_FIELD((&methodheader), Pe_image_clr_methodheader, maxstack, 16);
765  PE_READ_STRUCT_FIELD((&methodheader), Pe_image_clr_methodheader, size, 32);
766  PE_READ_STRUCT_FIELD((&methodheader), Pe_image_clr_methodheader, tok, 32);
767 
768  rz_warn_if_fail(methodheader.flags >> 12 == 3); // top 4 bits indicate size
769  sym->paddr += 12;
770  sym->vaddr += 12;
771  sym->size = methodheader.size;
772 
773  // TODO: exception sections
774  } else {
776  }
777 
778  rz_buf_seek(b, o_addr, RZ_BUF_SET);
779  return 0;
780 }
voidpf void uLong size
Definition: ioapi.h:138
voidpf void * buf
Definition: ioapi.h:138
#define PE_READ_STRUCT_FIELD(var, struct_type, field, size)
Definition: pe.h:177
#define rz_warn_if_reached()
Definition: rz_assert.h:29
#define rz_warn_if_fail(expr)
Definition: rz_assert.h:35
RZ_API st64 rz_buf_seek(RZ_NONNULL RzBuffer *b, st64 addr, int whence)
Modify the current cursor position in the buffer.
Definition: buf.c:1166
#define RZ_BUF_CUR
Definition: rz_buf.h:15
RZ_API bool rz_buf_read8(RZ_NONNULL RzBuffer *b, RZ_NONNULL RZ_OUT ut8 *result)
Read a byte at the cursor in the buffer.
Definition: buf.c:860
#define RZ_BUF_SET
Definition: rz_buf.h:14
RZ_API st64 rz_buf_read(RZ_NONNULL RzBuffer *b, RZ_NONNULL RZ_OUT ut8 *buf, ut64 len)
#define st64
Definition: rz_types_base.h:10
static struct sockaddr static addrlen static backlog const void static flags void flags
Definition: sfsocketcall.h:123

References b, Pe_image_clr_methodheader::flags, flags, rz_bin_symbol_t::paddr, PE_READ_STRUCT_FIELD, RZ_BUF_CUR, rz_buf_read(), rz_buf_read8(), rz_buf_seek(), RZ_BUF_SET, rz_warn_if_fail, rz_warn_if_reached, Pe_image_clr_methodheader::size, rz_bin_symbol_t::size, st64, and rz_bin_symbol_t::vaddr.

Referenced by rz_bin_pe_get_clr_methoddef_offset(), and rz_bin_pe_get_clr_symbols().