dotscope 0.6.0

A high-performance, cross-platform framework for analyzing and reverse engineering .NET PE executables
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150

//! `AssemblyRefOS` table binary reader implementation
//!
//! Provides binary parsing implementation for the `AssemblyRefOS` metadata table (0x25) through
//! the [`crate::metadata::tables::RowReadable`] trait. This module handles the low-level
//! deserialization of `AssemblyRefOS` table entries from the metadata tables stream.
//!
//! # Binary Format Characteristics
//!
//! The `AssemblyRefOS` table has a mixed binary format:
//! - **Fixed-size fields**: OS platform and version fields (12 bytes total)
//! - **Variable-size index**: Assembly reference table index (2 or 4 bytes)
//! - **Total size**: 14-16 bytes per row depending on table index size
//!
//! # Row Layout
//!
//! `AssemblyRefOS` table rows have this binary structure:
//! - `os_platform_id` (4 bytes): Operating system platform identifier
//! - `os_major_version` (4 bytes): Major OS version number
//! - `os_minor_version` (4 bytes): Minor OS version number
//! - `assembly_ref` (2/4 bytes): Table index into `AssemblyRef` table
//!
//! # Architecture
//!
//! This implementation provides zero-copy parsing by reading data directly from the
//! metadata tables stream. The `AssemblyRef` table index is preserved for later
//! resolution during the dual variant phase.
//!
//! # Thread Safety
//!
//! All parsing operations are stateless and safe for concurrent access. The reader
//! does not modify any shared state during parsing operations.
//!
//! # Integration
//!
//! This reader integrates with the metadata table infrastructure:
//! - [`crate::metadata::tables::MetadataTable`]: Table container for parsed rows
//! - [`crate::metadata::tables::AssemblyRefOsRaw`]: Raw `AssemblyRefOS` data structure
//! - [`crate::metadata::loader`]: High-level metadata loading system
//!
//! # Reference
//! - [ECMA-335 II.22.7](https://ecma-international.org/wp-content/uploads/ECMA-335_6th_edition_june_2012.pdf) - `AssemblyRefOS` table specification

use crate::{
    metadata::{
        tables::{AssemblyRefOsRaw, RowReadable, TableId, TableInfoRef},
        token::Token,
    },
    utils::{read_le_at, read_le_at_dyn},
    Result,
};

impl RowReadable for AssemblyRefOsRaw {
    const TABLE_ID: TableId = TableId::AssemblyRefOS;

    fn row_read(data: &[u8], offset: &mut usize, rid: u32, sizes: &TableInfoRef) -> Result<Self> {
        Ok(AssemblyRefOsRaw {
            rid,
            token: Token::new(0x2500_0000 + rid),
            offset: *offset,
            os_platform_id: read_le_at::<u32>(data, offset)?,
            os_major_version: read_le_at::<u32>(data, offset)?,
            os_minor_version: read_le_at::<u32>(data, offset)?,
            assembly_ref: read_le_at_dyn(data, offset, sizes.is_large(TableId::AssemblyRef))?,
        })
    }
}

#[cfg(test)]
mod tests {
    use std::sync::Arc;

    use super::*;
    use crate::metadata::tables::{MetadataTable, TableId, TableInfo};

    #[test]
    fn crafted_short() {
        let data = vec![
            0x01, 0x01, 0x01, 0x01, // os_platform_id
            0x02, 0x02, 0x02, 0x02, // os_major_version
            0x03, 0x03, 0x03, 0x03, // os_minor_version
            0x04, 0x04, // assembly_ref
        ];

        let sizes = Arc::new(TableInfo::new_test(
            &[(TableId::AssemblyRefOS, 1)],
            false,
            false,
            false,
        ));
        let table = MetadataTable::<AssemblyRefOsRaw>::new(&data, 1, sizes).unwrap();

        let eval = |row: AssemblyRefOsRaw| {
            assert_eq!(row.rid, 1);
            assert_eq!(row.token.value(), 0x25000001);
            assert_eq!(row.os_platform_id, 0x01010101);
            assert_eq!(row.os_major_version, 0x02020202);
            assert_eq!(row.os_minor_version, 0x03030303);
            assert_eq!(row.assembly_ref, 0x0404);
        };

        {
            for row in table.iter() {
                eval(row);
            }
        }

        {
            let row = table.get(1).unwrap();
            eval(row);
        }
    }

    #[test]
    fn crafted_long() {
        let data = vec![
            0x01, 0x01, 0x01, 0x01, // os_platform_id
            0x02, 0x02, 0x02, 0x02, // os_major_version
            0x03, 0x03, 0x03, 0x03, // os_minor_version
            0x04, 0x04, 0x04, 0x04, // assembly_ref
        ];

        let sizes = Arc::new(TableInfo::new_test(
            &[(TableId::AssemblyRefOS, 1)],
            true,
            true,
            true,
        ));
        let table = MetadataTable::<AssemblyRefOsRaw>::new(&data, 1, sizes).unwrap();

        let eval = |row: AssemblyRefOsRaw| {
            assert_eq!(row.rid, 1);
            assert_eq!(row.token.value(), 0x25000001);
            assert_eq!(row.os_platform_id, 0x01010101);
            assert_eq!(row.os_major_version, 0x02020202);
            assert_eq!(row.os_minor_version, 0x03030303);
            assert_eq!(row.assembly_ref, 0x0404);
        };

        {
            for row in table.iter() {
                eval(row);
            }
        }

        {
            let row = table.get(1).unwrap();
            eval(row);
        }
    }
}