# MemberRef

The MemberRef table contains various information about referenced members.

# Get referenced member names

MemberRef.get_memberref_names(deduplicate: bool) -> List[str]:

Get a list of referenced member names.

Parameters:

  • deduplicate De-duplicate names (off by default)

Return value:

A list with referenced member names

Example:

# Import class DotNetPE from module dotnetfile
from dotnetfile import DotNetPE

# Create an instance of DotNetPE with the file path as a parameter
dotnet_file = DotNetPE('/Users/<username>/my_dotnet_assembly.exe')

# Check if the "MemberRef" table exists
if dotnet_file.metadata_table_exists('MemberRef'):
    # Get list of all member names (de-duplicated)
    memberref_names = dotnet_file.MemberRef.get_memberref_names(deduplicate=True)

    # Print out the member names
    for memberref_name in memberref_names:
        print(f'{memberref_name}')

# Get MemberRef hash

MemberRef.get_memberref_hash(hash_type: Type.Hash, strings_sorted: bool) -> str:

The MemberRef hash is a hash of reference (to methods and fields of a class) and table names of their corresponding classes. We take the table name of the belonging class and the reference name to create a string pair separated by a "-" character. This table<->name string pair is added to a list and the hash value is calculated at the end. The class always belongs to one of the five tables 'TypeDef', 'TypeRef', 'ModuleRef', 'MethodDef' or 'TypeSpec'.

The list of table and reference names can be sorted alphabetically after the reference names before being hashed. Strings are used case-sensitive.

Parameters:

  • hash_type Hash algortihm. Options:
    • Type.Hash.MD5
    • Type.Hash.SHA1
    • Type.Hash.SHA256 (on by default)
  • strings_sorted Sort string pairs alphabetically after the referenced member names (off by default)

Return value:

A MemberRef hash as a hexadecimal string

Example:

# Import class DotNetPE from module dotnetfile
from dotnetfile import DotNetPE

# Create an instance of DotNetPE with the file path as a parameter
dotnet_file = DotNetPE('/Users/<username>/my_dotnet_assembly.exe')

# Check if the "MemberRef" table exists and print out MemberRef hashes
if dotnet_file.metadata_table_exists('MemberRef'):
    print(f'MemberRefHash (unsorted): {dotnet_file.MemberRef.get_memberref_hash()} (SHA-256)')
    print(f'MemberRefHash (sorted): {dotnet_file.MemberRef.get_memberref_hash(strings_sorted=True)} (SHA-256)')