# TypeRef

The TypeRef table contains various information about referenced types.

# Get referenced type names

TypeRef.get_typeref_names() -> List[str]

Get a list of referenced type names.

Parameters:

-

Return value:

A list with referenced type names

Example:

# Import class DotNetPE from module dotnetfile
from dotnetfile import DotNetPE

# Create an instance of DotNetPE with the file path as a parameter
dotnet_file = DotNetPE('/Users/<username>/my_dotnet_assembly.exe')

# Check if the "TypeRef" table exists
if dotnet_file.metadata_table_exists('TypeRef'):
    # Get list with referenced types names
    ref_type_names = dotnet_file.TypeRef.get_typeref_names()

    # Print out the referenced type names
    for type_name in ref_type_names:
        print(f'{type_name}')

# Get TypeRef hash

TypeRef.get_typeref_hash(hash_type: Type.Hash, skip_self_referenced_entries: bool, strings_sorted: bool) -> str:

Get the TypeRef hash that is a modified version of the original GData implementation. It uses the resolution scope names instead of the namespace names as they're always present. Additionally, there is an option to skip types that reference each other as added by some .NET protectors. Lastly, you can also sort the type names alphabetically before they get hashed. Strings are used case-sensitive as in the original implementation.

Parameters:

  • hash_type Hash algortihm. Options:
    • Type.Hash.MD5
    • Type.Hash.SHA1
    • Type.Hash.SHA256 (on by default)
  • skip_self_referenced_entries Skip types that reference each other (on by default)
  • strings_sorted Sort type name strings alphabetically (off by default)

Return value:

A TypeRef hash as a hexadecimal string

Example:

# Import class DotNetPE from module dotnetfile
from dotnetfile import DotNetPE

# Create an instance of DotNetPE with the file path as a parameter
dotnet_file = DotNetPE('/Users/<username>/my_dotnet_assembly.exe')

# Check if the "TypeRef" table exists and print out TypeRef hashes
if dotnet_file.metadata_table_exists('TypeRef'):
    print(f'TypeRefHash (unsorted): {dotnet_file.TypeRef.get_typeref_hash()} (SHA-256)')
    print(f'TypeRefHash (sorted, include self-referenced entries) {dotnet_file.TypeRef.get_typeref_hash(dotnet_file.Type.Hash.SHA256, False, True)} (SHA-256)')