#
MemberRef
The MemberRef
table contains various information about referenced members.
#
Get referenced member names
MemberRef.get_memberref_names(deduplicate: bool) -> List[str]:
Get a list of referenced member names.
Parameters:
- deduplicate De-duplicate names (off by default)
Return value:
A list with referenced member names
Example:
# Import class DotNetPE from module dotnetfile
from dotnetfile import DotNetPE
# Create an instance of DotNetPE with the file path as a parameter
dotnet_file = DotNetPE('/Users/<username>/my_dotnet_assembly.exe')
# Check if the "MemberRef" table exists
if dotnet_file.metadata_table_exists('MemberRef'):
# Get list of all member names (de-duplicated)
memberref_names = dotnet_file.MemberRef.get_memberref_names(deduplicate=True)
# Print out the member names
for memberref_name in memberref_names:
print(f'{memberref_name}')
#
Get MemberRef hash
MemberRef.get_memberref_hash(hash_type: Type.Hash, strings_sorted: bool) -> str:
The MemberRef
hash is a hash of reference (to methods and fields of a class) and table names of their corresponding classes. We take the table name of the belonging class and the reference name to create a string pair separated by a "-" character. This table<->name string pair is added to a list and the hash value is calculated at the end. The class always belongs to one of the five tables 'TypeDef', 'TypeRef', 'ModuleRef', 'MethodDef' or 'TypeSpec'.
The list of table and reference names can be sorted alphabetically after the reference names before being hashed. Strings are used case-sensitive.
This is a purely experimental hash and hasn't been tested for file identification purposes yet. It might not be very reliable, so use it at your own risk!
Parameters:
-
hash_type
Hash algortihm. Options:
- Type.Hash.MD5
- Type.Hash.SHA1
- Type.Hash.SHA256 (on by default)
- strings_sorted Sort string pairs alphabetically after the referenced member names (off by default)
Return value:
A MemberRef hash as a hexadecimal string
Example:
# Import class DotNetPE from module dotnetfile
from dotnetfile import DotNetPE
# Create an instance of DotNetPE with the file path as a parameter
dotnet_file = DotNetPE('/Users/<username>/my_dotnet_assembly.exe')
# Check if the "MemberRef" table exists and print out MemberRef hashes
if dotnet_file.metadata_table_exists('MemberRef'):
print(f'MemberRefHash (unsorted): {dotnet_file.MemberRef.get_memberref_hash()} (SHA-256)')
print(f'MemberRefHash (sorted): {dotnet_file.MemberRef.get_memberref_hash(strings_sorted=True)} (SHA-256)')