娱乐精神

警告：本系列文章为本人原创，只作技术研究之用，您可以引用链接传播，禁止其它的转载方式，禁止用于商业或非法目的， 对于造成的一切后果本人概不负责

MethodDef的Rva定义了一个方法的位置, 每个方法体之前都有一个方法头
方法头分为tiny头 和 fat头两种格式, 方法的前两位定义是tiny还是fat头, Partition II Metadata文档描述如下:

25.4.1    Method header type values
The two least significant bits of the first byte of the method header indicate what type of header is present.  These 2 bits will be one and only one of the following:
Value                                     Value    Description
CorILMethod_TinyFormat    0x2    The method header is tiny (§25.4.2) .
CorILMethod_FatFormat    0x3    The method header is fat (§25.4.3).

tiny头的格式比较简单, 只有一个字节, 除了最低的0x2外, 其余6位保存IL代码的大小
如果一个方法没有局部变量, 异常处理, 方法小于64字节, 存储栈深度为8时, 那么就使用tiny头
Partition II Metadata文档描述如下:
Start Bit    Count of Bits    Description
0            2                Flags (CorILMethod_TinyFormat shall be set, see §25.4.4)
2            6                Size, in bytes, of the method body immediately following this header.

fat头的格式就比较复杂, 大小是12个字节, Partition II Metadata文档中描述如下:
Offset     Size         Field       Description
0          12 (bits)    Flags       Flags (CorILMethod_FatFormat shall be set in bits 0:1, see §25.4.4)
12 (bits)  4 (bits)     Size        Size of this header expressed as the count of 4-byte integers occupied (currently 3)
2          2            MaxStack    Maximum number of items on the operand stack
4          4            CodeSize    Size in bytes of the actual method body
8          4            LocalVarSigTok    Meta Data token for a signature describing the layout of the local variables for the method.  0 means there are no local variables present

最开始的2个字节中低两位是表示fat头的0x3, 接下来的10是标志(见Partition II Metadata 的 25.4.4 Flags for method headers), 最高4位一直为3
接下来的2个字节是MaxStack, 是存储栈最大深度
之后的4个字节是CodeSize, 是IL代码的大小
最后的4个字节是LocalVarSigTok,是局部变量的特征标识

程序如下:
    PBYTE instructions = (PBYTE)GetPtrFromRva(rva, m_pNTHeader, m_pImageBase);
    if((instructions[0] & 3) == 0x2)
    {

        WCHAR lBuffer[64];
        methodSize = instructions[0] >> 2;
        codeSize = methodSize;
        maxstack = 8;
        localVariables = 0;
        exceptionHandler = false;
        initLocals = false;           
    }
    else if((instructions[0] & 3) == 0x3)
    {

            USHORT flagsSize = *((USHORT*)&instructions[0]);
            methodSize = ((flagsSize >> 12) & 0xf) * 4;

            if((flagsSize & 0x8) != 0)
            {
                exceptionHandler = true;
            }
            else
            {
                exceptionHandler = false;
            }

            if((flagsSize & 0x10) != 0)
            {
                initLocals = true;
            }
            else
            {
                initLocals = false;           
            }

            maxstack = *((USHORT*)&instructions[2]);
            codeSize = *((DWORD*)&instructions[4]);

            localVariables = *((DWORD*)&instructions[8]);
    }

警告：本系列文章为本人原创，只作技术研究之用，您可以引用链接传播，禁止其它的转载方式，禁止用于商业或非法目的， 对于造成的一切后果本人概不负责

FieldDef非常的简单, Partition II Metadata中描述为:

22.15    Field : 0x04
The Field table has the following columns:
•    Flags (a 2-byte bitmask of type FieldAttributes, §23.1.5)
•    Name (an index into the String heap)
•    Signature (an index into the Blob heap)

其中Flags 字段是一个位掩码, 描述了字段的属性
corhdl.h中有它的定义
typedef enum CorFieldAttr
{
    // member access mask - Use this mask to retrieve accessibility information.
    fdFieldAccessMask           =   0x0007,
    fdPrivateScope              =   0x0000,     // Member not referenceable.
    fdPrivate                   =   0x0001,     // Accessible only by the parent type.
    fdFamANDAssem               =   0x0002,     // Accessible by sub-types only in this Assembly.
    fdAssembly                  =   0x0003,     // Accessibly by anyone in the Assembly.
    fdFamily                    =   0x0004,     // Accessible only by type and sub-types.
    fdFamORAssem                =   0x0005,     // Accessibly by sub-types anywhere, plus anyone in assembly.
    fdPublic                    =   0x0006,     // Accessibly by anyone who has visibility to this scope.
    // end member access mask

    // field contract attributes.
    fdStatic                    =   0x0010,     // Defined on type, else per instance.
    fdInitOnly                  =   0x0020,     // Field may only be initialized, not written to after init.
    fdLiteral                   =   0x0040,     // Value is compile time constant.
    fdNotSerialized             =   0x0080,     // Field does not have to be serialized when type is remoted.

    fdSpecialName               =   0x0200,     // field is special.  Name describes how.

    // interop attributes
    fdPinvokeImpl               =   0x2000,     // Implementation is forwarded through pinvoke.

    // Reserved flags for runtime use only.
    fdReservedMask              =   0x9500,
    fdRTSpecialName             =   0x0400,     // Runtime(metadata internal APIs) should check name encoding.
    fdHasFieldMarshal           =   0x1000,     // Field has marshalling information.
    fdHasDefault                =   0x8000,     // Field has default.
    fdHasFieldRVA               =   0x0100,     // Field has RVA.
} CorFieldAttr;

可以通过如下程序得到所有Field的属性, t为FieldDef表

for(DWORD i = 0; i < t.Rows; ++i)
{
    row = t.Address + t.RowSize * index;

    // Flags
    flags = *((USHORT *)row);
    row += 2;

    // Name
    if(t.HeapSizes & 0x01)
    {
        name = *((ULONG *)row);
        row += 4;
    }
    else
    {
        name = *((USHORT *)row);
        row += 2;
    }

    // Signature
    if(t.HeapSizes & 0x04)
    {
        signature = *((ULONG *)row);
        row += 4;
    }
    else
    {
        signature = *((USHORT *)row);
        row += 2;
    }
}

MethodDef 表在Partition II Metadata中描述为:
22.26    MethodDef : 0x06
The MethodDef table has the following columns:
•    RVA (a 4-byte constant)
•    ImplFlags (a 2-byte bitmask of type MethodImplAttributes, §23.1.10)
•    Flags (a 2-byte bitmask of type MethodAttributes, §23.1.10)
•    Name (an index into the String heap)
•    Signature (an index into the Blob heap)
•    ParamList (an index into the Param table).  It marks the first of a contiguous run of Parameters owned by this method.  The run continues to the smaller of:
o    the last row of the Param table
o    the next run of Parameters, found by inspecting the ParamList of the next row in the MethodDef  table

对了, 别忘了Property(属性实际上就是get_和set_方法)
其中Flags标记保存Method的一些可访问性及其它属性
corhdr.h 中有它的定义
typedef enum CorMethodAttr
{
    // member access mask - Use this mask to retrieve accessibility information.
    mdMemberAccessMask          =   0x0007,
    mdPrivateScope              =   0x0000,     // Member not referenceable.
    mdPrivate                   =   0x0001,     // Accessible only by the parent type.
    mdFamANDAssem               =   0x0002,     // Accessible by sub-types only in this Assembly.
    mdAssem                     =   0x0003,     // Accessibly by anyone in the Assembly.
    mdFamily                    =   0x0004,     // Accessible only by type and sub-types.
    mdFamORAssem                =   0x0005,     // Accessibly by sub-types anywhere, plus anyone in assembly.
    mdPublic                    =   0x0006,     // Accessibly by anyone who has visibility to this scope.
    // end member access mask

    // method contract attributes.
    mdStatic                    =   0x0010,     // Defined on type, else per instance.
    mdFinal                     =   0x0020,     // Method may not be overridden.
    mdVirtual                   =   0x0040,     // Method virtual.
    mdHideBySig                 =   0x0080,     // Method hides by name+sig, else just by name.

    // vtable layout mask - Use this mask to retrieve vtable attributes.
    mdVtableLayoutMask          =   0x0100,
    mdReuseSlot                 =   0x0000,     // The default.
    mdNewSlot                   =   0x0100,     // Method always gets a new slot in the vtable.
    // end vtable layout mask

    // method implementation attributes.
    mdCheckAccessOnOverride     =   0x0200,     // Overridability is the same as the visibility.
    mdAbstract                  =   0x0400,     // Method does not provide an implementation.
    mdSpecialName               =   0x0800,     // Method is special.  Name describes how.

    // interop attributes
    mdPinvokeImpl               =   0x2000,     // Implementation is forwarded through pinvoke.
    mdUnmanagedExport           =   0x0008,     // Managed method exported via thunk to unmanaged code.

    // Reserved flags for runtime use only.
    mdReservedMask              =   0xd000,
    mdRTSpecialName             =   0x1000,     // Runtime should check name encoding.
    mdHasSecurity               =   0x4000,     // Method has security associate with it.
    mdRequireSecObject          =   0x8000,     // Method calls another method containing security code.

} CorMethodAttr;

值得说明的是ParamList字段
它记录了Param表的记录索引,  指明所属方法的参数的开始位置, 结束于下一个方法参数的开始
程序如下, t为MethodDef表
for(DWORD i = 0; i < t.Rows; ++i)
{
    row = t.Address + t.RowSize * index;

    // RVA
    rva = *((DWORD *)row);
    row += 4;

    // ImplFlags
    implFlags = *((USHORT *)row);
    row += 2;

    // Flags
    flags = *((USHORT *)row);
    row += 2;

    // Name
    if(t.HeapSizes & 0x01)
    {
        nameIndex = *((ULONG *)row);
        row += 4;
        wcscpy(lBuffer, pView->StringTableEntry(nameIndex).c_str());
    }
    else
    {
        nameIndex = *((USHORT *)row);
        row += 2;
        wcscpy(lBuffer, pView->StringTableEntry(nameIndex).c_str());
    }

    // Signature
    if(t.HeapSizes & 0x04)
    {
        signature = *((DWORD *)row);
        row += 4;
    }
    else
    {
        signature = *((USHORT *)row);
        row += 2;
    }

    // ParamList
    if(t.IndexSizes & 0x10)
    {
        params = *((DWORD *)row);

        if(index < t.Rows - 1)
            endparams = *((DWORD *)(row + t.RowSize));
        else
            endparams = 0;
        row += 4;
    }
    else
    {
        params = *((USHORT *)row);

        if(index < t.Rows - 1)
            endparams = *((USHORT *)(row + t.RowSize));
        else
            endparams = 0;
        row += 2;
    }
}

        // Flags
        flags = *((DWORD *)row);
        row += 4;

        // Name
        if(t.HeapSizes & 0x01)
        {
                nameIndex = *((ULONG *)row);
                row += 4;
                nameSpaceIndex = *((ULONG *)row);
                row += 4;
        }
        else
        {
                nameIndex = *((USHORT *)row);
                row += 2;
                nameSpaceIndex = *((USHORT *)row);
                row += 2;
        }
        //nameIndex 和nameSpaceIndex 为在String表中的索引

        // Extends
        if(t.IndexSizes & 0x08)
        {
                extends = *((DWORD *)row);
                row += 4;
        }
        else
        {
                extends = *((USHORT *)row);
                row += 2;
        }
        extendsTable = (BYTE)(extends & 0x3);
        extendsIndex = extends = extends >> 2;
        switch(extendsTable)
        {
        case 0:
                // TypeDef
                extends |= 0x02 << 24;
                break;
        case 1:
                // TypeRef
                extends |= 0x01 << 24;
                break;
        case 2:
                // TypeSpec
                extends |= 0x1b << 24;
                break;
        }
        // 现在extends 为Extends转成token的格式

        // FieldList
        if(t.IndexSizes & 0x08)
        {
                fields = *((DWORD *)row);
                if(index < t.Rows - 1)
                        endFields = *((DWORD *)(row + t.RowSize));
                else
                        endFields = 0;
                row += 4;
        }
        else
        {
                fields = *((USHORT *)row);
                if(index < t.Rows - 1)
                        endFields = *((USHORT *)(row + t.RowSize));
                else
                        endFields = 0;
                row += 2;
        }
        // fields 为该类型FieldList的起始索引, endFields 为结束索引

        // MethodList
        if(t.IndexSizes & 0x08)
        {
                methods = *((DWORD *)row);
                if(index < t.Rows - 1)
                        endMethods = *((DWORD *)(row + t.RowSize));
                else
                        endMethods = 0;
                row += 4;
        }
        else
        {
                methods = *((USHORT *)row);
                if(index < t.Rows - 1)
                        endMethods = *((USHORT *)(row + t.RowSize));
                else
                        endMethods = 0;
                row += 2;
        }
        // methods 为该类型MethodList的起始索引, endMethods 为结束索引

警告：本系列文章为本人原创，只作技术研究之用，您可以引用链接传播，禁止其它的转载方式，禁止用于商业或非法目的， 对于造成的一切后果本人概不负责

一般的.net程序都是从一个静态的Main方法开法运行的，下面我将演示如何指定程序集中的另一个方法作为入口方法

假设有如下程序,我们要修改程序集让NewMain先运行
using System;
public class Program
{
 public static void Main()
 {
  Console.WriteLine("Program::Main()");
 }

 public static void NewMain()
 {
  Console.WriteLine("Program::NewMain()");
 }
}

回想一下IMAGE_COR20_HEADER的格式，字段EntryPointToken指定了程序入口

在Partition II Metadata中写道：
Entry point metadata token
The entry point token (§15.4.1.2) is always a MethodDef token (§22.26) or File token (§22.19 ) when the entry point for a multi-module assembly is not in the manifest assembly.  The signature and implementation flags in metadata for the method indicate how the entry is run

它的值不是一个地址，而是一个元数据Token
这个Token的格式是，前1个字节是元数据表的编号，最后一个字节是记录的索引
比如Token为0x06000001，0x06指Method表，0x01指Method表的第一个记录，这通常指向到Main方法
在元数据中大量使用了这种Token的方式，来引用其它表或流的项目

我们只需要修改此Token就能指定新的入口方法，在我们这个演示中改为NewMain方法的Token，即0x06000002

程序如下：
pCorHeader->EntryPointToken = _htoi(szNewEntryPointToken);

用ildasm打开后观察
.method public hidebysig static void  NewMain() cil managed
{
  .entrypoint
  // 代码大小       13 (0xd)
  .maxstack  8
  IL_0000:  nop
  IL_0001:  ldstr      "Program::NewMain()"
  IL_0006:  call       void [mscorlib]System.Console::WriteLine(string)
  IL_000b:  nop
  IL_000c:  ret
} // end of method Program::NewMain

可以看到.entrypoint伪指令已经在我们指定的NewMain方法中了

警告：本系列文章为本人原创，只作技术研究之用，您可以引用链接传播，禁止其它的转载方式，禁止用于商业或非法目的， 对于造成的一切后果本人概不负责

上回有一个TableRowSizes函数没有说，它是用来得到指定元数据表的行大小
以Assembly表为例，在Partition II Metadata中描述了它的结构：

The Assembly table has the following columns:
• HashAlgId (a 4-byte constant of type AssemblyHashAlgorithm, §23.1.1)
• MajorVersion, MinorVersion, BuildNumber, RevisionNumber (each being 2-byte constants)
• Flags (a 4-byte bitmask of type AssemblyFlags, §23.1.2)
• PublicKey (an index into the Blob heap)
• Name (an index into the String heap)
• Culture (an index into the String heap)

HashAlgId 4个字节
MajorVersion, MinorVersion, BuildNumber, RevisionNumber 共8个字节
Flags 4个字节，指定了在Side By Side模式运行时的限制
PublicKey、Name、Culture、是#Blob heap或#String heap的索引，Public Key是用于assembly的完整性及发布者验证；Name是Assembly的名字；Culture是此Assembly所支持的语言，要注意这几个字段都不是固定大小，而是能过HeapSize推算出来的

对于Blob heap或String heap的大小的值是通过META_COMPOSITE_HEADER的HeapSizes计算出来的
在Partition II Metadata有描述：
The HeapSizes field is a bitvector that encodes the width of indexes into the various heaps.  If bit 0 is set, indexes into the “#String” heap are 4 bytes wide; if bit 1 is set, indexes into the “#GUID” heap are 4 bytes wide; if bit 2 is set, indexes into the “#Blob” heap are 4 bytes wide.  Conversely, if the HeapSize bit for a particular heap is not set, indexes into that heap are 2 bytes wide.
Heap size flag Description
0x01 Size of “#String” stream >= 216.
0x02 Size of “#GUID” stream >= 216.
0x04 Size of “#Blob” stream >= 216.

这些信息正好是ildasm对.assembly 伪指令的输出，比如
.assembly CountDown
{ .hash algorithm 32772
  .ver 1:0:0:0
}

于是我们就可以求得总的行大小（Assembly表只有这一行）
  bytes = 4;
  bytes += 8;
  bytes += 4;
  bytes += (heapSizes & 0x04) ? 4 : 2;
  bytes += (heapSizes & 0x01) ? 4 : 2;
  bytes += (heapSizes & 0x01) ? 4 : 2;

现在我们改一下主版本号，注意我用的是内存映射文件
 PMETA_ASSEMBLY_TABLE assemblyTable = (PMETA_ASSEMBLY_TABLE)(tables[TableType::Assembly].Address);
 WORD* pVersion = &(assemblyTable->MajorVersion);
 *pVersion = atoi(szBuffer);

用ildasm看已经修改过来了：
.assembly query
{
  .ver 8:0:0:0
}

但是... ....