def MakeAssemblyRefOSRow():
return construct.Struct('AssemblyRefOSRow',
construct.ULInt32('OSPlatformID'),
construct.ULInt32('OSMajorVersion'),
construct.ULInt32('OSMinorVersion'),
MDTag.AssemblyRefRId.parse('AssemblyRef')
)
def MakeManifestResourceRow():
return construct.Struct('ManifestResourceRow',
construct.ULInt32('Offset'),
construct.ULInt32('Flags'),
MDTag.StringHeapRef.parse('Name'),
MDTag.Implementation.parse('Implementation')
)
def MakeGenericParamRow():
return construct.Struct('GenericParamRow',
construct.ULInt16('Number'),
construct.ULInt16('Flags'),
MDTag.TypeOrMethodDef.parse('Owner'),
MDTag.StringHeapRef.parse('Name')
)
def MakeConstantRow():
return construct.Struct('ConstantRow',
construct.ULInt8('Type'),
construct.Padding(1, strict = True),
MDTag.HasConstant.parse('Parent'),
MDTag.BlobHeapRef.parse('Value')
)
def MakeImplMapRow():
return construct.Struct('ImplMapRow',
construct.ULInt16('MappingFlags'),
MDTag.MemberForwarded.parse('MemberForwarded'),
MDTag.StringHeapRef.parse('ImportName'),
MDTag.ModuleRefRId.parse('ImportScope')
)
def MakeExportedTypeRow():
return construct.Struct('ExportedTypeRow',
construct.ULInt32('Flags'),
construct.ULInt32('TypeDefId'),
MDTag.StringHeapRef.parse('TypeName'),
MDTag.StringHeapRef.parse('TypeNamespace'),
MDTag.Implementation.parse('Implementation')
)
def MakeModuleRow():
return construct.Struct('ModuleRow',
construct.ULInt16('Generation'),
MDTag.StringHeapRef.parse('Name'),
MDTag.GuidHeapRef.parse('MVId'),
MDTag.GuidHeapRef.parse('EnCId'),
MDTag.GuidHeapRef.parse('EnCBaseId')
)
def MakeTypeDefRow():
return construct.Struct('TypeDefRow',
construct.ULInt32('Flags'),
MDTag.StringHeapRef.parse('Name'),
MDTag.StringHeapRef.parse('Namespace'),
MDTag.TypeDefOrRef.parse('Extends'),
MDTag.FieldRef.parse('FieldList'),
MDTag.MethodRef.parse('MethodList')
)
def MakeMethodRow():
return construct.Struct('MethodRow',
MakeRva('RVA'),
construct.ULInt16('ImplFlags'),
construct.ULInt16('Flags'),
MDTag.StringHeapRef.parse('Name'),
MDTag.BlobHeapRef.parse('Signature'),
MDTag.ParamRef.parse('ParamList')
)
def MakeAssemblyRefRow():
return construct.Struct('AssemblyRefRow',
construct.ULInt16('MajorVersion'),
construct.ULInt16('MinorVersion'),
construct.ULInt16('BuildNumber'),
construct.ULInt16('RevisionNumber'),
construct.ULInt32('Flags'),
MDTag.BlobHeapRef.parse('PublicKeyOrToken'),
MDTag.StringHeapRef.parse('Name'),
MDTag.StringHeapRef.parse('Culture'),
MDTag.BlobHeapRef.parse('HashValue')
)
def ReadVtableFixups(ClrHeader):
VTableFixup = construct.Struct('VTableFixup',
MakeRva('RVA'),
construct.ULInt16('Count'),
construct.FlagsEnum(construct.ULInt16('Type'),
COR_VTABLE_32BIT = 0x01, # V-table slots are 32-bits in size.
COR_VTABLE_64BIT = 0x02, # V-table slots are 64-bits in size.
COR_VTABLE_FROM_UNMANAGED = 0x04, # If set, transition from unmanaged.
COR_VTABLE_FROM_UNMANAGED_RETAIN_APPDOMAIN = 0x08, # If set, transition from unmanaged with keeping the current appdomain.
COR_VTABLE_CALL_MOST_DERIVED = 0x10, # Call most derived method described by
)
)
numFixups = ClrHeader.VTableFixups.Size / VTableFixup.sizeof()
VTableFixups = construct.Array(numFixups, VTableFixup)
if numFixups == 0: return []
return VTableFixups.parse(idc.get_bytes(ClrHeader.VTableFixups.VA, int(VTableFixups.sizeof())))
def MakeEventRow():
return construct.Struct('EventRow',
construct.ULInt16('EventFlags'),
MDTag.StringHeapRef.parse('Name'),
MDTag.TypeDefOrRef.parse('EventType')
)
def MakeNestedClassRow():
return construct.Struct('NestedClassRow',
MDTag.TypeDefRId.parse('NestedClass'),
MDTag.TypeDefRId.parse('EnclosingClass')
)
def MakeFileRow():
return construct.Struct('FileRow',
construct.ULInt32('Flags'),
MDTag.StringHeapRef.parse('Name'),
MDTag.BlobHeapRef.parse('HashValue')
)
def MakePropertyMapRow():
return construct.Struct('PropertyMapRow',
MDTag.TypeDefRId.parse('Parent'),
MDTag.PropertyRId.parse('PropertyList')
)
def MakeTypeSpecRow():
return construct.Struct('TypeSpecRow',
MDTag.BlobHeapRef.parse('Signature')
)
def MakePropertyPtrRow():
return construct.Struct('PropertyPtrRow',
MDTag.PropertyRef.parse('Property')
)
def MakeAssemblyOSRow():
return construct.Struct('AssemblyOSRow',
construct.ULInt32('OSPlatformID'),
construct.ULInt32('OSMajorVersion'),
construct.ULInt32('OSMinorVersion')
)
def MakeGenericParamConstraintRow():
return construct.Struct('GenericParamConstraintRow',
MDTag.GenericParamRId.parse('Owner'),
MDTag.TypeDefOrRef.parse('Constraint')
)
def MakeEnCMapRow():
return construct.Struct('EnCMapRow',
construct.ULInt32('Token')
)
def MakeAssemblyProcessorRow():
return construct.Struct('AssemblyProcessorRow',
construct.ULInt32('Processor')
)
def MakeMethodSemanticsRow():
return construct.Struct('MethodSemanticsRow',
construct.ULInt16('Flags'),
MDTag.MethodRId.parse('Method'),
MDTag.HasSemantics.parse('Association')
)
def MakeFieldRvaRow():
return construct.Struct('FieldRvaRow',
MakeRva('RVA'),
MDTag.FieldRId.parse('Field')
)
def MakeMethodImplRow():
return construct.Struct('MethodImplRow',
MDTag.TypeDefRId.parse('Class'),
MDTag.MethodDefOrRef.parse('MethodBody'),
MDTag.MethodDefOrRef.parse('MethodDeclaration')
)
def MakeEventPtrRow():
return construct.Struct('EventPtrRow',
MDTag.EventRef.parse('Event')
)
def MakePropertyRow():
return construct.Struct('PropertyRow',
construct.ULInt16('Flags'),
MDTag.StringHeapRef.parse('Name'),
MDTag.BlobHeapRef.parse('Type')
)
def MakeMethodSpecRow():
return construct.Struct('MethodSpecRow',
MDTag.MethodDefOrRef.parse('Method'),
MDTag.BlobHeapRef.parse('Instantiation')
)
def MakeAssemblyRefProcessorRow():
return construct.Struct('AssemblyRefProcessorRow',
construct.ULInt32('Processor'),
MDTag.AssemblyRefRId.parse('AssemblyRef')
)
def MakeEnCLogRow():
return construct.Struct('EnCLogRow',
construct.ULInt32('Token'),
construct.ULInt32('FuncCode')
)
def MakeModuleRefRow():
return construct.Struct('ModuleRefRow',
MDTag.StringHeapRef.parse('Name')
)
