Example 2: Decoding a private field signature of a reference type declared in another assembly

This example is just as easy as last night's example 1, except this deals with the TypeRef table - which holds classes declared in other assemblies [usually].

C# code:

private StringBuilder sb = null;

The field's information from ILDasm:

0x06 is calling convention for a field (IMAGE_CEE_CS_CALLCONV_FIELD)

0x12 is ELEMENT_TYPE_CLASS  for a class token

0x0d like example 1 is a TypeDefOrRef [signature] token.

0x0d, is a compressed integer of 13 (0x0d)

NOTE: As in example 1, since 0x0d is under 128, the compressed value is the same as the uncompressed value and only takes 1 byte to represent it.

Determine the table the type is in:

If you AND the uncompressed value with 0x03 you can determine which of the least 2 bits are on or off, in this case it will be 01 = TypeRef.

Get the index of the record in the table:

Bit shift 13 to the right 2 bits and you get 3 (0x03) (which is the index in the TypeRef table for the System.Text.StringBuilder record)

Calling Conventions

Taken from CorCallingConvention on line 837 of CorHdr.h - found in Windows Sdk includes directory

Element Types

Taken from CorElementType on line 774 of CorHdr.h - found in the Windows Sdk includes directory

Next notes will provide:

1. Compression/Decompression Algorithm
2. Decoding a field that is a generic type