#
TypeRef
The TypeRef
table contains various information about referenced types.
#
Get referenced type names
TypeRef.get_typeref_names() -> List[str]
Get a list of referenced type names.
Parameters:
-
Return value:
A list with referenced type names
Example:
# Import class DotNetPE from module dotnetfile
from dotnetfile import DotNetPE
# Create an instance of DotNetPE with the file path as a parameter
dotnet_file = DotNetPE('/Users/<username>/my_dotnet_assembly.exe')
# Check if the "TypeRef" table exists
if dotnet_file.metadata_table_exists('TypeRef'):
# Get list with referenced types names
ref_type_names = dotnet_file.TypeRef.get_typeref_names()
# Print out the referenced type names
for type_name in ref_type_names:
print(f'{type_name}')
#
Get TypeRef hash
TypeRef.get_typeref_hash(hash_type: Type.Hash, skip_self_referenced_entries: bool, strings_sorted: bool) -> str:
Get the TypeRef hash that is a modified version of the original GData implementation. It uses the resolution scope names instead of the namespace names as they're always present. Additionally, there is an option to skip types that reference each other as added by some .NET protectors. Lastly, you can also sort the type names alphabetically before they get hashed. Strings are used case-sensitive as in the original implementation.
Parameters:
-
hash_type
Hash algorithm. Options:
- Type.Hash.MD5
- Type.Hash.SHA1
- Type.Hash.SHA256 (on by default)
- skip_self_referenced_entries Skip types that reference each other (on by default)
- strings_sorted Sort type name strings alphabetically (off by default)
Return value:
A TypeRef hash as a hexadecimal string
Example:
# Import class DotNetPE from module dotnetfile
from dotnetfile import DotNetPE
# Create an instance of DotNetPE with the file path as a parameter
dotnet_file = DotNetPE('/Users/<username>/my_dotnet_assembly.exe')
# Check if the "TypeRef" table exists and print out TypeRef hashes
if dotnet_file.metadata_table_exists('TypeRef'):
print(f'TypeRefHash (unsorted): {dotnet_file.TypeRef.get_typeref_hash()} (SHA-256)')
print(f'TypeRefHash (sorted, include self-referenced entries) {dotnet_file.TypeRef.get_typeref_hash(dotnet_file.Type.Hash.SHA256, False, True)} (SHA-256)')