警告：本系列文章为本人原创，只作技术研究之用，您可以引用链接传播，禁止其它的转载方式，禁止用于商业或非法目的， 对于造成的一切后果本人概不负责

FieldDef非常的简单, Partition II Metadata中描述为:

22.15    Field : 0x04
The Field table has the following columns:
•    Flags (a 2-byte bitmask of type FieldAttributes, §23.1.5)
•    Name (an index into the String heap)
•    Signature (an index into the Blob heap)

其中Flags 字段是一个位掩码, 描述了字段的属性
corhdl.h中有它的定义
typedef enum CorFieldAttr
{
    // member access mask - Use this mask to retrieve accessibility information.
    fdFieldAccessMask           =   0x0007,
    fdPrivateScope              =   0x0000,     // Member not referenceable.
    fdPrivate                   =   0x0001,     // Accessible only by the parent type.
    fdFamANDAssem               =   0x0002,     // Accessible by sub-types only in this Assembly.
    fdAssembly                  =   0x0003,     // Accessibly by anyone in the Assembly.
    fdFamily                    =   0x0004,     // Accessible only by type and sub-types.
    fdFamORAssem                =   0x0005,     // Accessibly by sub-types anywhere, plus anyone in assembly.
    fdPublic                    =   0x0006,     // Accessibly by anyone who has visibility to this scope.
    // end member access mask

    // field contract attributes.
    fdStatic                    =   0x0010,     // Defined on type, else per instance.
    fdInitOnly                  =   0x0020,     // Field may only be initialized, not written to after init.
    fdLiteral                   =   0x0040,     // Value is compile time constant.
    fdNotSerialized             =   0x0080,     // Field does not have to be serialized when type is remoted.

    fdSpecialName               =   0x0200,     // field is special.  Name describes how.

    // interop attributes
    fdPinvokeImpl               =   0x2000,     // Implementation is forwarded through pinvoke.

    // Reserved flags for runtime use only.
    fdReservedMask              =   0x9500,
    fdRTSpecialName             =   0x0400,     // Runtime(metadata internal APIs) should check name encoding.
    fdHasFieldMarshal           =   0x1000,     // Field has marshalling information.
    fdHasDefault                =   0x8000,     // Field has default.
    fdHasFieldRVA               =   0x0100,     // Field has RVA.
} CorFieldAttr;

可以通过如下程序得到所有Field的属性, t为FieldDef表

for(DWORD i = 0; i < t.Rows; ++i)
{
    row = t.Address + t.RowSize * index;

    // Flags
    flags = *((USHORT *)row);
    row += 2;

    // Name
    if(t.HeapSizes & 0x01)
    {
        name = *((ULONG *)row);
        row += 4;
    }
    else
    {
        name = *((USHORT *)row);
        row += 2;
    }

    // Signature
    if(t.HeapSizes & 0x04)
    {
        signature = *((ULONG *)row);
        row += 4;
    }
    else
    {
        signature = *((USHORT *)row);
        row += 2;
    }
}

MethodDef 表在Partition II Metadata中描述为:
22.26    MethodDef : 0x06
The MethodDef table has the following columns:
•    RVA (a 4-byte constant)
•    ImplFlags (a 2-byte bitmask of type MethodImplAttributes, §23.1.10)
•    Flags (a 2-byte bitmask of type MethodAttributes, §23.1.10)
•    Name (an index into the String heap)
•    Signature (an index into the Blob heap)
•    ParamList (an index into the Param table).  It marks the first of a contiguous run of Parameters owned by this method.  The run continues to the smaller of:
o    the last row of the Param table
o    the next run of Parameters, found by inspecting the ParamList of the next row in the MethodDef  table

对了, 别忘了Property(属性实际上就是get_和set_方法)
其中Flags标记保存Method的一些可访问性及其它属性
corhdr.h 中有它的定义
typedef enum CorMethodAttr
{
    // member access mask - Use this mask to retrieve accessibility information.
    mdMemberAccessMask          =   0x0007,
    mdPrivateScope              =   0x0000,     // Member not referenceable.
    mdPrivate                   =   0x0001,     // Accessible only by the parent type.
    mdFamANDAssem               =   0x0002,     // Accessible by sub-types only in this Assembly.
    mdAssem                     =   0x0003,     // Accessibly by anyone in the Assembly.
    mdFamily                    =   0x0004,     // Accessible only by type and sub-types.
    mdFamORAssem                =   0x0005,     // Accessibly by sub-types anywhere, plus anyone in assembly.
    mdPublic                    =   0x0006,     // Accessibly by anyone who has visibility to this scope.
    // end member access mask

    // method contract attributes.
    mdStatic                    =   0x0010,     // Defined on type, else per instance.
    mdFinal                     =   0x0020,     // Method may not be overridden.
    mdVirtual                   =   0x0040,     // Method virtual.
    mdHideBySig                 =   0x0080,     // Method hides by name+sig, else just by name.

    // vtable layout mask - Use this mask to retrieve vtable attributes.
    mdVtableLayoutMask          =   0x0100,
    mdReuseSlot                 =   0x0000,     // The default.
    mdNewSlot                   =   0x0100,     // Method always gets a new slot in the vtable.
    // end vtable layout mask

    // method implementation attributes.
    mdCheckAccessOnOverride     =   0x0200,     // Overridability is the same as the visibility.
    mdAbstract                  =   0x0400,     // Method does not provide an implementation.
    mdSpecialName               =   0x0800,     // Method is special.  Name describes how.

    // interop attributes
    mdPinvokeImpl               =   0x2000,     // Implementation is forwarded through pinvoke.
    mdUnmanagedExport           =   0x0008,     // Managed method exported via thunk to unmanaged code.

    // Reserved flags for runtime use only.
    mdReservedMask              =   0xd000,
    mdRTSpecialName             =   0x1000,     // Runtime should check name encoding.
    mdHasSecurity               =   0x4000,     // Method has security associate with it.
    mdRequireSecObject          =   0x8000,     // Method calls another method containing security code.

} CorMethodAttr;

值得说明的是ParamList字段
它记录了Param表的记录索引,  指明所属方法的参数的开始位置, 结束于下一个方法参数的开始
程序如下, t为MethodDef表
for(DWORD i = 0; i < t.Rows; ++i)
{
    row = t.Address + t.RowSize * index;

    // RVA
    rva = *((DWORD *)row);
    row += 4;

    // ImplFlags
    implFlags = *((USHORT *)row);
    row += 2;

    // Flags
    flags = *((USHORT *)row);
    row += 2;

    // Name
    if(t.HeapSizes & 0x01)
    {
        nameIndex = *((ULONG *)row);
        row += 4;
        wcscpy(lBuffer, pView->StringTableEntry(nameIndex).c_str());
    }
    else
    {
        nameIndex = *((USHORT *)row);
        row += 2;
        wcscpy(lBuffer, pView->StringTableEntry(nameIndex).c_str());
    }

    // Signature
    if(t.HeapSizes & 0x04)
    {
        signature = *((DWORD *)row);
        row += 4;
    }
    else
    {
        signature = *((USHORT *)row);
        row += 2;
    }

    // ParamList
    if(t.IndexSizes & 0x10)
    {
        params = *((DWORD *)row);

        if(index < t.Rows - 1)
            endparams = *((DWORD *)(row + t.RowSize));
        else
            endparams = 0;
        row += 4;
    }
    else
    {
        params = *((USHORT *)row);

        if(index < t.Rows - 1)
            endparams = *((USHORT *)(row + t.RowSize));
        else
            endparams = 0;
        row += 2;
    }
}

        // Flags
        flags = *((DWORD *)row);
        row += 4;

        // Name
        if(t.HeapSizes & 0x01)
        {
                nameIndex = *((ULONG *)row);
                row += 4;
                nameSpaceIndex = *((ULONG *)row);
                row += 4;
        }
        else
        {
                nameIndex = *((USHORT *)row);
                row += 2;
                nameSpaceIndex = *((USHORT *)row);
                row += 2;
        }
        //nameIndex 和nameSpaceIndex 为在String表中的索引

        // Extends
        if(t.IndexSizes & 0x08)
        {
                extends = *((DWORD *)row);
                row += 4;
        }
        else
        {
                extends = *((USHORT *)row);
                row += 2;
        }
        extendsTable = (BYTE)(extends & 0x3);
        extendsIndex = extends = extends >> 2;
        switch(extendsTable)
        {
        case 0:
                // TypeDef
                extends |= 0x02 << 24;
                break;
        case 1:
                // TypeRef
                extends |= 0x01 << 24;
                break;
        case 2:
                // TypeSpec
                extends |= 0x1b << 24;
                break;
        }
        // 现在extends 为Extends转成token的格式

        // FieldList
        if(t.IndexSizes & 0x08)
        {
                fields = *((DWORD *)row);
                if(index < t.Rows - 1)
                        endFields = *((DWORD *)(row + t.RowSize));
                else
                        endFields = 0;
                row += 4;
        }
        else
        {
                fields = *((USHORT *)row);
                if(index < t.Rows - 1)
                        endFields = *((USHORT *)(row + t.RowSize));
                else
                        endFields = 0;
                row += 2;
        }
        // fields 为该类型FieldList的起始索引, endFields 为结束索引

        // MethodList
        if(t.IndexSizes & 0x08)
        {
                methods = *((DWORD *)row);
                if(index < t.Rows - 1)
                        endMethods = *((DWORD *)(row + t.RowSize));
                else
                        endMethods = 0;
                row += 4;
        }
        else
        {
                methods = *((USHORT *)row);
                if(index < t.Rows - 1)
                        endMethods = *((USHORT *)(row + t.RowSize));
                else
                        endMethods = 0;
                row += 2;
        }
        // methods 为该类型MethodList的起始索引, endMethods 为结束索引

警告：本系列文章为本人原创，只作技术研究之用，您可以引用链接传播，禁止其它的转载方式，禁止用于商业或非法目的， 对于造成的一切后果本人概不负责

一般的.net程序都是从一个静态的Main方法开法运行的，下面我将演示如何指定程序集中的另一个方法作为入口方法

假设有如下程序,我们要修改程序集让NewMain先运行
using System;
public class Program
{
 public static void Main()
 {
  Console.WriteLine("Program::Main()");
 }

 public static void NewMain()
 {
  Console.WriteLine("Program::NewMain()");
 }
}

回想一下IMAGE_COR20_HEADER的格式，字段EntryPointToken指定了程序入口

在Partition II Metadata中写道：
Entry point metadata token
The entry point token (§15.4.1.2) is always a MethodDef token (§22.26) or File token (§22.19 ) when the entry point for a multi-module assembly is not in the manifest assembly.  The signature and implementation flags in metadata for the method indicate how the entry is run

它的值不是一个地址，而是一个元数据Token
这个Token的格式是，前1个字节是元数据表的编号，最后一个字节是记录的索引
比如Token为0x06000001，0x06指Method表，0x01指Method表的第一个记录，这通常指向到Main方法
在元数据中大量使用了这种Token的方式，来引用其它表或流的项目

我们只需要修改此Token就能指定新的入口方法，在我们这个演示中改为NewMain方法的Token，即0x06000002

程序如下：
pCorHeader->EntryPointToken = _htoi(szNewEntryPointToken);

用ildasm打开后观察
.method public hidebysig static void  NewMain() cil managed
{
  .entrypoint
  // 代码大小       13 (0xd)
  .maxstack  8
  IL_0000:  nop
  IL_0001:  ldstr      "Program::NewMain()"
  IL_0006:  call       void [mscorlib]System.Console::WriteLine(string)
  IL_000b:  nop
  IL_000c:  ret
} // end of method Program::NewMain

可以看到.entrypoint伪指令已经在我们指定的NewMain方法中了