Disassembling .Net Notes: Field Signatures Part 3

by Jason Haley 10. October 2008 08:42

These notes don't yet get into the compression algorithm, like I mentioned I would in yesterday's Part 2.

Example 3: Decoding a field signature of a generic type declared in another assembly

This example is a little more more complicated due to the field type being a generic type, but it is a simple example of a generic type (only 1 argument and defined in another assembly).

C# code:

private List<TestClass> list = new List<TestClass>();

Field information from ILDasm:

image

0x06 = IMAGE_CEE_CS_CALLCONV_FIELD

0x15 = ELEMENT_TYPE_GENERICINST

The definition for decoding a GENERICINST is: GENERICINST (CLASS | VALUETYPE) TypeDefOrRefEncoded GenArgCount Type Type*

0x12 = ELEMENT_TYPE_CLASS

0x11 TypeDefOrRefEncoded token

image

0x11 is a compressed integer of 17 (0x11) - which is the same compressed or uncompressed.

image

Determine the table the type is in:

If you AND the uncompressed value with 0x03 you can determine which of the least 2 bits are on or off, in this case it will be 01 = TypeRef

Get the index of the record in the table:

Bit shift 17 to the right 2 bits and you get 4 (0x04) - which is the index in the TypeRef table for the System.Collections.Generic.List'1 record.

image

0x01 = GenArgCount (compressed int32, but in this case it is the same uncompressed)

Only one argument, so just one type to decode:

0x12 = ELEMENT_TYPE_CLASS

0x08  TypeDefOrRefEncoded token

image

0x08 is also compressed, but is the same either compressed or not

image

Determine the table the type is in:

Neither of the last 2 bits or on (00 = TypeDef)

Get the index of the record:

Bit shift to the left by 2 and you get 2 (0x02) - which is the index in the TypeDef table for the SignatureUtility.TestClass record.

NOTE: in ILDasm the TypeDef #1 does not match the rid (row or record id) of 2 in the (02 000002) the first (02) is the table index, the 000002 is the rid or index.

image

Overview

This example walked through the following field declaration:

private List<TestClass> list = new List<TestClass>();

From decoding the signature of this field, you find out the following:

  • it is a field
  • it is generic
  • it is a class
  • the type is of System.Collections.Generic.List'1
  • it has only 1 generic argument
  • the argument type is of SignatureUtility.TestClass

Comments (0) | Post RSSRSS comment feed |

Categories:
Tags:

Comments are closed