569 lines
16 KiB
Python
569 lines
16 KiB
Python
import enum
|
|
from destruct import Struct
|
|
|
|
from .common import (
|
|
MultiEnum,
|
|
CLRElementType, CLRStreamType, CLRTableType,
|
|
CLRCodedToken, CLRStreamIndex, CLRTableIndex, CLRTableRange
|
|
)
|
|
from .types import CLRSignature
|
|
|
|
|
|
TABLE_PARSERS = {}
|
|
|
|
def table_parser(name):
|
|
def inner(c):
|
|
TABLE_PARSERS[name] = c
|
|
return c
|
|
return inner
|
|
|
|
|
|
@table_parser(CLRTableType.Module)
|
|
class CLRModuleTable(Struct):
|
|
generation = UInt(16)
|
|
name = CLRStreamIndex(CLRStreamType.String)
|
|
mvid = CLRStreamIndex(CLRStreamType.GUID)
|
|
encid = CLRStreamIndex(CLRStreamType.GUID)
|
|
encbaseid = CLRStreamIndex(CLRStreamType.GUID)
|
|
|
|
|
|
ResolutionScope = CLRCodedToken([
|
|
CLRTableType.Module, CLRTableType.ModuleRef,
|
|
CLRTableType.AssemblyRef, CLRTableType.TypeRef
|
|
])
|
|
|
|
@table_parser(CLRTableType.TypeRef)
|
|
class CLRTypeRefTable(Struct):
|
|
scope = ResolutionScope
|
|
name = CLRStreamIndex(CLRStreamType.String)
|
|
namespace = CLRStreamIndex(CLRStreamType.String)
|
|
|
|
|
|
TypeDefOrRef = CLRCodedToken([
|
|
CLRTableType.TypeDef, CLRTableType.TypeRef, CLRTableType.TypeSpec
|
|
])
|
|
|
|
class CLRTypeVisiblity(enum.Enum):
|
|
NotPublic = 0x0
|
|
Public = 0x1
|
|
NestedPublic = 0x2
|
|
NestedPrivate = 0x3
|
|
NestedFamily = 0x4
|
|
NestedAssembly = 0x5
|
|
NestedFamANDAssem = 0x6
|
|
NestedFamORAssem = 0x7
|
|
|
|
class CLRTypeLayout(enum.Enum):
|
|
AutoLayout = 0x0
|
|
SequentialLayout = 0x8
|
|
ExplicitLayout = 0x10
|
|
|
|
class CLRTypeClassSemantics(enum.Enum):
|
|
Class = 0x0
|
|
Interface = 0x20
|
|
|
|
class CLRTypeStringFormatting(enum.IntFlag):
|
|
ANSI = 0
|
|
Unicode = 0x10000
|
|
Custom = 0x30000
|
|
|
|
class CLRTypeFlags(enum.Flag):
|
|
Abstract = 0x80
|
|
Sealed = 0x100
|
|
SpecialName = 0x400
|
|
RTSpecialName = 0x800
|
|
Import = 0x1000
|
|
Serializable = 0x2000
|
|
HasSecurity = 0x4000
|
|
BeforeFieldInit = 0x100000
|
|
IsTypeForwarder = 0x200000
|
|
|
|
class CLRTypeAttributes(MultiEnum):
|
|
visibility = (CLRTypeVisiblity, 0x7)
|
|
layout = (CLRTypeLayout, 0x18)
|
|
semantics = (CLRTypeClassSemantics, 0x20)
|
|
formatting = (CLRTypeStringFormatting, 0xC30000)
|
|
flags = (CLRTypeFlags, None)
|
|
|
|
@table_parser(CLRTableType.TypeDef)
|
|
class CLRTypeDefTable(Struct):
|
|
flags = Enum(CLRTypeAttributes, UInt(32))
|
|
name = CLRStreamIndex(CLRStreamType.String)
|
|
namespace = CLRStreamIndex(CLRStreamType.String)
|
|
extends = TypeDefOrRef
|
|
fields = CLRTableRange(CLRTableType.Field)
|
|
methods = CLRTableRange(CLRTableType.MethodDef)
|
|
|
|
|
|
@table_parser(CLRTableType.FieldPointer)
|
|
def CLRFieldPointerTable(Struct):
|
|
field = CLRTableIndex(CLRTableType.Field)
|
|
|
|
|
|
class CLRAccess(enum.Enum):
|
|
CompilerControlled = 0
|
|
Private = 1
|
|
FamANDAssem = 2
|
|
Assembly = 3
|
|
Family = 4
|
|
FamORAssem = 5
|
|
Public = 6
|
|
|
|
class CLRFieldFlags(enum.Flag):
|
|
Static = 0x10
|
|
InitOnly = 0x20
|
|
Literal = 0x40
|
|
NotSerialized = 0x80
|
|
HasFieldRVA = 0x100
|
|
SpecialName = 0x200
|
|
RTSpecialName = 0x400
|
|
HasFieldMarshal = 0x1000
|
|
PInvokeImpl = 0x2000
|
|
HasDefault = 0x8000
|
|
|
|
class CLRFieldAttributes(MultiEnum):
|
|
access = (CLRAccess, 0x7)
|
|
flags = (CLRFieldFlags, 0xFFF0)
|
|
|
|
@table_parser(CLRTableType.Field)
|
|
class CLRFieldTable(Struct):
|
|
flags = Enum(CLRFieldAttributes, UInt(16))
|
|
name = CLRStreamIndex(CLRStreamType.String)
|
|
signature = CLRStreamIndex(CLRStreamType.Blob, CLRSignature)
|
|
|
|
|
|
@table_parser(CLRTableType.MethodPointer)
|
|
def CLRMethodPointerTable(Struct):
|
|
method = CLRTableIndex(CLRTableType.Method)
|
|
|
|
|
|
class CLRMemberVtableLayout(enum.Enum):
|
|
ReuseSlot = 0
|
|
NewSlot = 0x100
|
|
|
|
class CLRMethodFlags(enum.Flag):
|
|
Static = 0x10
|
|
Final = 0x20
|
|
Virtual = 0x40
|
|
HideBySig = 0x80
|
|
Strict = 0x200
|
|
Abstract = 0x400
|
|
SpecialName = 0x800
|
|
RTSpecialName = 0x1000
|
|
PInvokeImpl = 0x2000
|
|
HasSecurity = 0x4000
|
|
RequireSecObject = 0x8000
|
|
|
|
class CLRMethodAttributes(MultiEnum):
|
|
access = (CLRAccess, 0x7)
|
|
vtable = (CLRMemberVtableLayout, 0x100)
|
|
flags = (CLRMethodFlags, 0xFEF0)
|
|
|
|
class CLRMethodCodeType(enum.Enum):
|
|
IL = 0
|
|
Native = 1
|
|
OPTIL = 2
|
|
Runtime = 3
|
|
|
|
class CLRMethodManaged(enum.Enum):
|
|
Managed = 0
|
|
Unmanaged = 4
|
|
|
|
class CLRMethodImplFlags(enum.Flag):
|
|
NoInlining = 0x8
|
|
ForwardRef = 0x10
|
|
Synchronized = 0x20
|
|
NoOptimization = 0x40
|
|
PreserveSig = 0x80
|
|
AggressiveInlining = 0x100
|
|
InternalCall = 0x1000
|
|
|
|
class CLRMethodImplAttributes(MultiEnum):
|
|
code_type = (CLRMethodCodeType, 0x3)
|
|
managed = (CLRMethodManaged, 0x4)
|
|
flags = (CLRMethodImplFlags, 0xFFF8)
|
|
|
|
@table_parser(CLRTableType.MethodDef)
|
|
class CLRMethodDefTable(Struct):
|
|
rva = UInt(32)
|
|
impl_flags = Enum(CLRMethodImplAttributes, UInt(16))
|
|
flags = Enum(CLRMethodAttributes, UInt(16))
|
|
name = CLRStreamIndex(CLRStreamType.String)
|
|
signature = CLRStreamIndex(CLRStreamType.Blob, CLRSignature)
|
|
params = CLRTableRange(CLRTableType.Param)
|
|
|
|
|
|
@table_parser(CLRTableType.ParamPointer)
|
|
def CLRParamPointerTable(Struct):
|
|
param = CLRTableIndex(CLRTableType.Param)
|
|
|
|
|
|
class CLRParamAttributes(enum.Flag):
|
|
In = 0x1
|
|
Out = 0x2
|
|
Optional = 0x10
|
|
HasDefault = 0x1000
|
|
HasFieldMarshal = 0x2000
|
|
|
|
@table_parser(CLRTableType.Param)
|
|
class CLRParamTable(Struct):
|
|
flags = Enum(CLRParamAttributes, UInt(16))
|
|
sequence = UInt(16)
|
|
name = CLRStreamIndex(CLRStreamType.String)
|
|
|
|
|
|
MemberRefParent = CLRCodedToken([
|
|
CLRTableType.MethodDef, CLRTableType.ModuleRef,
|
|
CLRTableType.TypeDef, CLRTableType.TypeRef, CLRTableType.TypeSpec
|
|
])
|
|
|
|
@table_parser(CLRTableType.MemberRef)
|
|
class CLRMemberRefTable(Struct):
|
|
parent = MemberRefParent
|
|
name = CLRStreamIndex(CLRStreamType.String)
|
|
signature = CLRStreamIndex(CLRStreamType.Blob, CLRSignature)
|
|
|
|
|
|
HasCustomAttribute = CLRCodedToken([
|
|
CLRTableType.MethodDef, CLRTableType.Field,
|
|
CLRTableType.TypeDef, CLRTableType.TypeRef,
|
|
CLRTableType.Param, CLRTableType.InterfaceImpl,
|
|
CLRTableType.MemberRef, CLRTableType.Module, 'Permission',
|
|
CLRTableType.Property, CLRTableType.Event,
|
|
CLRTableType.StandAloneSig, CLRTableType.ModuleRef, CLRTableType.TypeSpec,
|
|
CLRTableType.Assembly, CLRTableType.AssemblyRef,
|
|
CLRTableType.File, CLRTableType.ExportedType, CLRTableType.ManifestResource,
|
|
CLRTableType.GenericParam, CLRTableType.GenericParamConstraint,
|
|
CLRTableType.MethodSpec
|
|
])
|
|
CustomAttributeType = CLRCodedToken([
|
|
None, None, CLRTableType.MethodDef, CLRTableType.MemberRef, None
|
|
])
|
|
|
|
@table_parser(CLRTableType.CustomAttribute)
|
|
class CLRCustomAttributeTable(Struct):
|
|
parent = HasCustomAttribute
|
|
type = CustomAttributeType
|
|
value = CLRStreamIndex(CLRStreamType.Blob)
|
|
|
|
|
|
@table_parser(CLRTableType.StandAloneSig)
|
|
class CLRStandAloneSigTable(Struct):
|
|
signature = CLRStreamIndex(CLRStreamType.Blob, CLRSignature)
|
|
|
|
|
|
@table_parser(CLRTableType.TypeSpec)
|
|
class CLRTypeSpecTable(Struct):
|
|
signature = CLRStreamIndex(CLRStreamType.Blob, CLRSignature)
|
|
|
|
|
|
class AssemblyHashAlgorithm(enum.Enum):
|
|
Null = 0
|
|
MD5 = 0x8003
|
|
SHA1 = 0x8004
|
|
|
|
class AssemblyFlags(enum.Flag):
|
|
PublicKey = 0x1
|
|
Retargetable = 0x100
|
|
DisableJITOptimizing = 0x4000
|
|
EnableJITracking = 0x8000
|
|
|
|
@table_parser(CLRTableType.Assembly)
|
|
class CLRAssemblyTable(Struct):
|
|
hash_algo = Enum(AssemblyHashAlgorithm, UInt(32))
|
|
version_major = UInt(16)
|
|
version_minor = UInt(16)
|
|
build_number = UInt(16)
|
|
rev_number = UInt(16)
|
|
flags = Enum(AssemblyFlags, UInt(32))
|
|
public_key = CLRStreamIndex(CLRStreamType.Blob)
|
|
name = CLRStreamIndex(CLRStreamType.String)
|
|
culture = CLRStreamIndex(CLRStreamType.String)
|
|
|
|
|
|
@table_parser(CLRTableType.AssemblyCPU)
|
|
class CLRAssemblyCPUTable(Struct):
|
|
processor = UInt(32)
|
|
|
|
|
|
@table_parser(CLRTableType.AssemblyOS)
|
|
class CLRAssemblyOSTable(Struct):
|
|
platform_id = UInt(32)
|
|
version_major = UInt(32)
|
|
version_minor = UInt(32)
|
|
|
|
|
|
@table_parser(CLRTableType.AssemblyRef)
|
|
class CLRAssemblyRefTable(Struct):
|
|
version_major = UInt(16)
|
|
version_minor = UInt(16)
|
|
build_number = UInt(16)
|
|
rev_number = UInt(16)
|
|
flags = Enum(AssemblyFlags, UInt(32))
|
|
public_key = CLRStreamIndex(CLRStreamType.Blob)
|
|
name = CLRStreamIndex(CLRStreamType.String)
|
|
culture = CLRStreamIndex(CLRStreamType.String)
|
|
hash_value = CLRStreamIndex(CLRStreamType.Blob)
|
|
|
|
|
|
@table_parser(CLRTableType.AssemblyRefCPU)
|
|
class CLRAssemblyRefCPUTable(Struct):
|
|
processor = UInt(32)
|
|
assembly = CLRTableIndex(CLRTableType.Assembly)
|
|
|
|
|
|
@table_parser(CLRTableType.AssemblyRefOS)
|
|
class CLRAssemblyRefOSTable(Struct):
|
|
platform_id = UInt(32)
|
|
version_major = UInt(32)
|
|
version_minor = UInt(32)
|
|
assembly = CLRTableIndex(CLRTableType.Assembly)
|
|
|
|
|
|
Implementation = CLRCodedToken([
|
|
CLRTableType.File, CLRTableType.AssemblyRef, CLRTableType.ExportedType
|
|
])
|
|
|
|
class ManifestResourceAttributes(enum.Enum):
|
|
Public = 1
|
|
Private = 2
|
|
|
|
@table_parser(CLRTableType.ManifestResource)
|
|
class CLRManifestResourceTable(Struct):
|
|
offset = UInt(32)
|
|
flags = Enum(ManifestResourceAttributes, UInt(32))
|
|
name = CLRStreamIndex(CLRStreamType.String)
|
|
implementation = Implementation
|
|
|
|
|
|
@table_parser(CLRTableType.NestedClass)
|
|
class CLRNestedClassTable(Struct):
|
|
nested = CLRTableIndex(CLRTableType.TypeDef)
|
|
enclosing = CLRTableIndex(CLRTableType.TypeDef)
|
|
|
|
|
|
@table_parser(CLRTableType.InterfaceImpl)
|
|
class CLRInterfaceImplTable(Struct):
|
|
type = CLRTableIndex(CLRTableType.TypeDef)
|
|
interface = TypeDefOrRef
|
|
|
|
|
|
HasConstant = CLRCodedToken([
|
|
CLRTableType.Param, CLRTableType.Field, CLRTableType.Property
|
|
])
|
|
|
|
@table_parser(CLRTableType.Constant)
|
|
class CLRConstantTable(Struct):
|
|
type = UInt(8)
|
|
_pad1 = UInt(8)
|
|
parent = HasConstant
|
|
value = CLRStreamIndex(CLRStreamType.Blob)
|
|
|
|
|
|
HasDeclSecurity = CLRCodedToken([
|
|
CLRTableType.TypeDef, CLRTableType.MethodDef, CLRTableType.Assembly
|
|
])
|
|
|
|
class CLRSecurityAction(enum.Enum):
|
|
Demand = 2
|
|
Assert = 3
|
|
Deny = 4
|
|
PermitOnly = 5
|
|
LinkDemand = 6
|
|
InheritanceDemand = 7
|
|
RequestMinimum = 8
|
|
RequestOptional = 9
|
|
RequestRefuse = 10
|
|
|
|
@table_parser(CLRTableType.DeclSecurity)
|
|
class CLRDeclSecurityTable(Struct):
|
|
action = Enum(CLRSecurityAction, UInt(16))
|
|
parent = HasDeclSecurity
|
|
permission_set = CLRStreamIndex(CLRStreamType.Blob)
|
|
|
|
|
|
@table_parser(CLRTableType.ClassLayout)
|
|
class CLRClassLayoutTable(Struct):
|
|
packing_size = UInt(16)
|
|
class_size = UInt(32)
|
|
parent = CLRTableIndex(CLRTableType.TypeDef)
|
|
|
|
|
|
@table_parser(CLRTableType.FieldLayout)
|
|
class CLRFieldLayoutTable(Struct):
|
|
offset = UInt(32)
|
|
field = CLRTableIndex(CLRTableType.Field)
|
|
|
|
|
|
@table_parser(CLRTableType.EventMap)
|
|
class CLREventMapTable(Struct):
|
|
parent = CLRTableIndex(CLRTableType.TypeDef)
|
|
events = CLRTableRange(CLRTableType.Event)
|
|
|
|
|
|
@table_parser(CLRTableType.EventPointer)
|
|
class CLREventPointerTable(Struct):
|
|
event = CLRTableIndex(CLRTableType.Event)
|
|
|
|
|
|
class CLREventAttributes(enum.Flag):
|
|
SpecialName = 0x200
|
|
RTSpecialName = 0x400
|
|
|
|
@table_parser(CLRTableType.Event)
|
|
class CLREventTable(Struct):
|
|
flags = Enum(CLREventAttributes, UInt(16))
|
|
name = CLRStreamIndex(CLRStreamType.String)
|
|
type = TypeDefOrRef
|
|
|
|
|
|
@table_parser(CLRTableType.PropertyMap)
|
|
class CLRPropertyMapTable(Struct):
|
|
parent = CLRTableIndex(CLRTableType.TypeDef)
|
|
properties = CLRTableRange(CLRTableType.Property)
|
|
|
|
|
|
@table_parser(CLRTableType.PropertyPointer)
|
|
class CLRPropertyPointerTable(Struct):
|
|
property = CLRTableIndex(CLRTableType.Property)
|
|
|
|
|
|
class CLRPropertyAttributes(enum.Flag):
|
|
SpecialName = 0x0200
|
|
RTSpecialName = 0x0400
|
|
HasDefault = 0x1000
|
|
|
|
@table_parser(CLRTableType.Property)
|
|
class CLRPropertyTable(Struct):
|
|
flags = Enum(CLRPropertyAttributes, UInt(16))
|
|
name = CLRStreamIndex(CLRStreamType.String)
|
|
signature = CLRStreamIndex(CLRStreamType.Blob, CLRSignature)
|
|
|
|
|
|
HasSemantics = CLRCodedToken([CLRTableType.Event, CLRTableType.Property])
|
|
|
|
class CLRMethodSemanticsAttributes(enum.Enum):
|
|
Setter = 0x1
|
|
Getter = 0x2
|
|
Other = 0x4
|
|
AddOn = 0x8
|
|
RemoveOn = 0x10
|
|
Fire = 0x20
|
|
|
|
@table_parser(CLRTableType.MethodSemantics)
|
|
class CLRMethodSemanticsTable(Struct):
|
|
semantics = Enum(CLRMethodSemanticsAttributes, UInt(16))
|
|
method = CLRTableIndex(CLRTableType.MethodDef)
|
|
association = HasSemantics
|
|
|
|
|
|
MethodDefOrRef = CLRCodedToken([
|
|
CLRTableType.MethodDef, CLRTableType.MemberRef
|
|
])
|
|
|
|
@table_parser(CLRTableType.MethodImpl)
|
|
class CLRMethodImplTable(Struct):
|
|
parent = CLRTableIndex(CLRTableType.TypeDef)
|
|
body = MethodDefOrRef
|
|
declaration = MethodDefOrRef
|
|
|
|
|
|
@table_parser(CLRTableType.ModuleRef)
|
|
class CLRModuleRefTable(Struct):
|
|
name = CLRStreamIndex(CLRStreamType.String)
|
|
|
|
|
|
MemberForwarded = CLRCodedToken([CLRTableType.Field, CLRTableType.MethodDef])
|
|
|
|
class CLRVariance(enum.Enum):
|
|
No = 0
|
|
Covariant = 1
|
|
Contravariant = 2
|
|
|
|
class CLRConstraint(enum.Flag):
|
|
ReferenceTypeConstraint = 0x4
|
|
NotNullableValueTypeConstraint = 0x8
|
|
DefaultConstructorConstraint = 0x10
|
|
|
|
class CLRPInvokeAttributes(MultiEnum):
|
|
variance = (CLRVariance, 0b11)
|
|
constraint = (CLRConstraint, 0b11100)
|
|
|
|
@table_parser(CLRTableType.ImplMap)
|
|
class CLRImplMapTable(Struct):
|
|
flags = Enum(CLRPInvokeAttributes, UInt(16))
|
|
forwarded = MemberForwarded
|
|
name = CLRStreamIndex(CLRStreamType.String)
|
|
scope = CLRTableIndex(CLRTableType.ModuleRef)
|
|
|
|
|
|
@table_parser(CLRTableType.FieldRVA)
|
|
class CLRFieldRVATable(Struct):
|
|
rva = UInt(32)
|
|
field = CLRTableIndex(CLRTableType.Field)
|
|
|
|
|
|
TypeOrMethodDef = CLRCodedToken([CLRTableType.TypeDef, CLRTableType.MethodDef])
|
|
|
|
class CLRGenericParamAttributes(MultiEnum):
|
|
variance = (CLRVariance, 0b11)
|
|
constraint = (CLRConstraint, 0b11100)
|
|
|
|
@table_parser(CLRTableType.GenericParam)
|
|
class CLRGenericParamTable(Struct):
|
|
index = UInt(16)
|
|
flags = Enum(CLRGenericParamAttributes, UInt(16))
|
|
owner = TypeOrMethodDef
|
|
name = CLRStreamIndex(CLRStreamType.String)
|
|
|
|
|
|
@table_parser(CLRTableType.MethodSpec)
|
|
class CLRMethodSpecTable(Struct):
|
|
parent = MethodDefOrRef
|
|
instantiation = CLRStreamIndex(CLRStreamType.Blob)
|
|
|
|
|
|
@table_parser(CLRTableType.GenericParamConstraint)
|
|
class CLRGenericParamConstraintTable(Struct):
|
|
owner = CLRTableIndex(CLRTableType.GenericParam)
|
|
constraint = TypeDefOrRef
|
|
|
|
|
|
HasFieldMarshal = CLRCodedToken([CLRTableType.Field, CLRTableType.Param])
|
|
|
|
@table_parser(CLRTableType.FieldMarshal)
|
|
class CLRFieldMarshalTable(Struct):
|
|
parent = HasFieldMarshal
|
|
native_type = CLRStreamIndex(CLRStreamType.Blob)
|
|
|
|
|
|
@table_parser(CLRTableType.EncLog)
|
|
class CLREncLogTable(Struct):
|
|
token = UInt(32)
|
|
func_code = UInt(32)
|
|
|
|
|
|
@table_parser(CLRTableType.EncMap)
|
|
class CLREncMapTable(Struct):
|
|
token = UInt(32)
|
|
|
|
|
|
class CLRFileAttributes(enum.Enum):
|
|
ContainsMetadata = 0
|
|
ContainsNoMetadata = 1
|
|
|
|
@table_parser(CLRTableType.File)
|
|
class CLRFileTable(Struct):
|
|
flags = Enum(CLRFileAttributes, UInt(32))
|
|
name = CLRStreamIndex(CLRStreamType.String)
|
|
hash = CLRStreamIndex(CLRStreamType.Blob)
|
|
|
|
|
|
@table_parser(CLRTableType.ExportedType)
|
|
class CLRExportedTypeTable(Struct):
|
|
flags = Enum(CLRTypeAttributes, UInt(32))
|
|
type_id = UInt(32)
|
|
name = CLRStreamIndex(CLRStreamType.String)
|
|
namespace = CLRStreamIndex(CLRStreamType.String)
|
|
implementation = Implementation
|