# ModuleRef

The ModuleRef table contains information about unmanaged modules (DLLs).

# Get unmanaged module names

ModuleRef.get_unmanaged_module_names(modules_type: Type.UnmanagedModules) -> List[str]

Get a list with unmanaged module names.

Parameters:

  • modules_type Module names output. Options:
    • Type.UnmanagedModules.RAW Get module names as they are and append to the list (on by default)
    • Type.UnmanagedModules.NORMALIZED Add .dll extension to module names if necessary, lowercase them and remove duplicates

Return value:

A list with unmanaged module names

Example:

# Import class DotNetPE from module dotnetfile
from dotnetfile import DotNetPE

# Create an instance of DotNetPE with the file path as a parameter
dotnet_file = DotNetPE('/Users/<username>/my_dotnet_assembly.exe')

# Check if the "ModuleRef" table exists
if dotnet_file.metadata_table_exists('ModuleRef'):
    # Get a list of unmanaged module names in normalized form
    unmanaged_modules = dotnet_file.ModuleRef.get_unmanaged_module_names(dotnet_file.Type.UnmanagedModules.NORMALIZED)

    # Print out the module names
    for unmanaged_module in unmanaged_modules:
        print(f'{unmanaged_module}')