-
-
[求助]Fixing Multiple Module Definitions In Reactor Protected Assemblies
-
发表于: 2010-6-29 01:12 1609
-
INFO about MetaData :
The MetaData Tables
Also knows as #~ Stream. This stream begins with a header I call "MetaData Tables Header", here are the members:
Reserved The first dword is always 0.
MajorVersion and MinorVersion Two bytes.
HeapOffsetSizes This field is very important, it's a byte that tells us the size that indexes into the "#String", "#GUID" and "#Blob" streams will have. I paste you the description and the bit mask from the SDK:
"The HeapSizes field is a bitvector that encodes how wide indexes into the various heaps are. If bit 0 is set, indexes into the “#String” heap are 4 bytes wide; if bit 1 is set, indexes into the “#GUID” heap are 4 bytes wide; if bit 2 is set, indexes into the “#Blob” heap are 4 bytes wide. Conversely, if the HeapSize bit for a particular heap is not set, indexes into that heap are 2 bytes wide."
Bitmask Description
0x01 Size of “#String” stream >= 2^16.
0x02 Size of “#GUID” stream >= 2^16
0x04 Size of “#Blob” stream >= 2^16.
Reserved Byte, always 1.
Valid It's a bitmask-qword that tells us which MetaData Tables are present in the assembly. Of course, since this is a qword the maximum number of tables is 64. However, most of the tables aren't defined yet. So, the high bits of this qword are always 0.
Sorted Also a bitmask-qword. It tells us which tables are sorted.
Following there's an array of dwords with the number of rows for each present table. Ok this has to be explained. For every table there can be n rows. Let's say we have three tables: A, B and C. And the Valid mask tells us that the B table is not present, but A and C are. In this case there will be 2 dwords (not three), one for the rows in the A table and one for the C table. The B table rows are skypped since there is no B table in the assembly.
Following the array we find the actual MetaData Tables. The defined tables are:
00 - Module 01 - TypeRef 02 - TypeDef
04 - Field 06 - MethodDef 08 - Param
09 - InterfaceImpl 10 - MemberRef 11 - Constant
12 - CustomAttribute 13 - FieldMarshal 14 - DeclSecurity
15 - ClassLayout 16 - FieldLayout 17 - StandAloneSig
18 - EventMap 20 - Event 21 - PropertyMap
23 - Property 24 - MethodSemantics 25 - MethodImpl
26 - ModuleRef 27 - TypeSpec 28 - ImplMap
29 - FieldRVA 32 - Assembly 33 - AssemblyProcessor
34 - AssemblyOS 35 - AssemblyRef 36 - AssemblyRefProcessor
37 - AssemblyRefOS 38 - File 39 - ExportedType
40 - ManifestResource 41 - NestedClass
Nice tutorial how to fix multiple modules
http://rapidshare.com/files/403592264/fix_multi_module.rar.html
The MetaData Tables
Also knows as #~ Stream. This stream begins with a header I call "MetaData Tables Header", here are the members:
Reserved The first dword is always 0.
MajorVersion and MinorVersion Two bytes.
HeapOffsetSizes This field is very important, it's a byte that tells us the size that indexes into the "#String", "#GUID" and "#Blob" streams will have. I paste you the description and the bit mask from the SDK:
"The HeapSizes field is a bitvector that encodes how wide indexes into the various heaps are. If bit 0 is set, indexes into the “#String” heap are 4 bytes wide; if bit 1 is set, indexes into the “#GUID” heap are 4 bytes wide; if bit 2 is set, indexes into the “#Blob” heap are 4 bytes wide. Conversely, if the HeapSize bit for a particular heap is not set, indexes into that heap are 2 bytes wide."
Bitmask Description
0x01 Size of “#String” stream >= 2^16.
0x02 Size of “#GUID” stream >= 2^16
0x04 Size of “#Blob” stream >= 2^16.
Reserved Byte, always 1.
Valid It's a bitmask-qword that tells us which MetaData Tables are present in the assembly. Of course, since this is a qword the maximum number of tables is 64. However, most of the tables aren't defined yet. So, the high bits of this qword are always 0.
Sorted Also a bitmask-qword. It tells us which tables are sorted.
Following there's an array of dwords with the number of rows for each present table. Ok this has to be explained. For every table there can be n rows. Let's say we have three tables: A, B and C. And the Valid mask tells us that the B table is not present, but A and C are. In this case there will be 2 dwords (not three), one for the rows in the A table and one for the C table. The B table rows are skypped since there is no B table in the assembly.
Following the array we find the actual MetaData Tables. The defined tables are:
00 - Module 01 - TypeRef 02 - TypeDef
04 - Field 06 - MethodDef 08 - Param
09 - InterfaceImpl 10 - MemberRef 11 - Constant
12 - CustomAttribute 13 - FieldMarshal 14 - DeclSecurity
15 - ClassLayout 16 - FieldLayout 17 - StandAloneSig
18 - EventMap 20 - Event 21 - PropertyMap
23 - Property 24 - MethodSemantics 25 - MethodImpl
26 - ModuleRef 27 - TypeSpec 28 - ImplMap
29 - FieldRVA 32 - Assembly 33 - AssemblyProcessor
34 - AssemblyOS 35 - AssemblyRef 36 - AssemblyRefProcessor
37 - AssemblyRefOS 38 - File 39 - ExportedType
40 - ManifestResource 41 - NestedClass
Nice tutorial how to fix multiple modules
http://rapidshare.com/files/403592264/fix_multi_module.rar.html
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)
赞赏
他的文章
看原图
赞赏
雪币:
留言: