repository·master·Indexed 22 days ago
https://github.com/washi1337/asmresolverA powerful library for reading, modifying, and reconstructing Portable Executable (PE) files. It provides specialized support for native Windows binaries and .NET managed metadata, including AppHost/SingleFileHost bundles and ReadyToRun (R2R) binaries. Key features include PE manipulation, an intuitive .NET metadata API, cross-platform PDB and PortablePdb symbol support, and Win32 resource handling. It is compatible with .NET Framework 3.5+, .NET Standard 2.0, .NET Core, and Mono.
AsmResolver is a library designed for reading, modifying, and reconstructing Portable Executable (PE) files. It supports both native Windows PE images and images containing managed (.NET) metadata.
Key Capabilities:
System.Reflection. It supports managed, native, and dynamic method bodies, metadata importing/cloning, and managed resource file serialization/deserialization. It also supports AppHost/SingleFileHost bundles and ReadyToRun (R2R) binaries.AsmResolver provides support for handling .NET single-file deployment binaries (AppHost / SingleFileHost bundles). These binaries run natively via a platform-specific bootstrapper and do not contain traditional .NET metadata headers.
You can use AsmResolver to:
RuntimeContext.All relevant functionality is located in the AsmResolver.DotNet.Bundles namespace.
The RT_VERSIONINFO resource type stores metadata like product names, version numbers, and copyright holders for a Portable Executable (PE) file. In AsmResolver, this is represented by the VersionInfoResource class.
To use these features, include the following namespace:
using AsmResolver.PE.Win32Resources.Version;A RuntimeContext mimics the lifetime of a .NET process by implementing assembly resolution and management logic similar to an AppDomain or AssemblyLoadContext. It maintains metadata caches to allow for fast lookup and traversal of external references (e.g., DLLs referenced by an assembly).
Key characteristics:
TypeReference) into actual definitions (like TypeDefinition).RuntimeContext.AssemblyDefinition is added to a context, it cannot be removed.In v6.0, SignatureComparer.Default does not resolve forwarded types (e.g., types using the TypeForwardedTo attribute). This means types that are logically the same but reside in different assemblies (like System.Object in System.Runtime vs System.Private.CoreLib) will be treated as distinct.
To restore the v5.x behavior where forwarded types are treated as equal, you must initialize a SignatureComparer with a RuntimeContext.
// v6.0: Default behavior (returns false for forwarded types)
bool equal = SignatureComparer.Default.Equals(t1, t2);
// v6.0: Behavior with RuntimeContext (returns true for forwarded types)
var context = new RuntimeContext(DotNetRuntimeInfo.NetCoreApp(10, 0));
var comparer = context.SignatureComparer; // or new SignatureComparer(context)
bool equal = comparer.Equals(t1, t2);The PE file layer provides the lowest level of abstraction for the Portable Executable (PE) format. Use this layer when you need to read or write raw executable files directly from or to the disk.
Key capabilities include:
PEFile class.BinaryStreamReader instance.Note on Abstraction: This layer is designed for raw data access and leaves data interpretation to the user. It does not provide high-level models for complex structures like the import directory. For interpreted models (e.g., parsing imports), use the PEImage class in the layer above.
// Use PEFile for raw header and section access
// Use PEImage for interpreted data like importsThere are two primary ways to inspect or traverse a TypeSignature:
.BaseType property to get the immediate underlying type. For example, if you have an array signature, .BaseType returns the element type.ITypeSignatureVisitor<TResult> interface. This allows you to perform strongly-typed traversals and handle specific signature types (like ArrayTypeSignature or BoxedTypeSignature) in a type-safe manner.// 1. Simple traversal
var arrayElementType = arrayTypeSig.BaseType; // returns System.Int32
// 2. Visitor pattern traversal
public class MyVisitor : ITypeSignatureVisitor<TResult>
{
public TResult VisitArrayType(ArrayTypeSignature signature)
{
/* ... handle array types ... */
return signature.AcceptVisitor(this);
}
public TResult VisitBoxedType(BoxedTypeSignature signature)
{
/* ... handle boxed types ... */
return signature.AcceptVisitor(this);
}
// ... other methods ...
}
TypeSignature signature = ...;
var result = signature.AcceptVisitor(new MyVisitor());The Contents property of a DebugDataEntry implements IDebugDataSegment. The specific implementation depends on the type of debug data:
CodeViewDataSegment).CustomDebugDataSegment, which exposes the raw contents as an ISegment.Currently, AsmResolver has rich support specifically for CodeView debug data.
A CilMethodBody object is composed of three primary building blocks:
Instructions: The sequence of CIL instructions to be executed.LocalVariables: The collection of local variables defined within the method.ExceptionHandlers: A collection of regions protected by exception handling logic.In v5.x, referencing external metadata required explicit calls to a ReferenceImporter (e.g., .ImportWith(module.DefaultImporter)). In v6.0, most importing is performed automatically at build-time.
While calling ImportWith is still valid, it is often redundant and can cause unnecessary allocations. You only need to manually import if you are using custom ReferenceImporter logic (like MemberCloner).
// v6.0: Importing is now automatic; no explicit call needed
var method = module.CorLibFactory.CorLibScope
.CreateTypeReference("System", "Console")
.CreateMemberReference("WriteLine", MethodSignature.CreateStatic(factory.Void, [factory.String]));Metadata resolution in v6.0 requires a RuntimeContext to manage assembly and metadata caches. The IMemberDescriptor.Resolve() method now accepts this context as a parameter.
You can obtain a RuntimeContext from an existing ModuleDefinition or create one manually to specify environment parameters like the .NET runtime version.
// Using context from an existing module
RuntimeContext context = module.RuntimeContext;
TypeDefinition definition = reference.Resolve(context);
// Creating a manual context
var context = new RuntimeContext(DotNetRuntimeInfo.NetCoreApp(3, 1));
TypeDefinition definition = reference.Resolve(context);