Method parseMetadataStream

src/fileformat/file_format/pe/pe_format.cpp:2341–2545

* Parses .NET metadata stream. * @param baseAddress Base address of .NET metadata header. * @param offset Offset of metadata stream. * @param size Size of stream. */

 * @param size Size of stream.
 */
void PeFormat::parseMetadataStream(std::uint64_t baseAddress, std::uint64_t offset, std::uint64_t size)
{
	const std::uint64_t metadataStreamHeaderSize = 24;
	if (size <= metadataStreamHeaderSize)
	{
		return;
	}

	metadataStream = std::make_unique<MetadataStream>(offset, size);
	auto address = baseAddress + offset;

	std::uint64_t majorVersion, minorVersion, heapOffsetSizes, valid, sorted;
	if (!get1Byte(address + 4, majorVersion)
		|| !get1Byte(address + 5, minorVersion)
		|| !get1Byte(address + 6, heapOffsetSizes)
		|| !get8Byte(address + 8, valid)
		|| !get8Byte(address + 16, sorted))
	{
		return;
	}

	metadataStream->setMajorVersion(majorVersion);
	metadataStream->setMinorVersion(minorVersion);

	// 'heapOffsetSizes' define whether we should use std::uint16_t or dstd::uint16_t for indexes into different streams
	metadataStream->setStringStreamIndexSize(heapOffsetSizes & 0x01 ? 4 : 2);
	metadataStream->setGuidStreamIndexSize(heapOffsetSizes & 0x02 ? 4 : 2);
	metadataStream->setBlobStreamIndexSize(heapOffsetSizes & 0x04 ? 4 : 2);

	// Tables that are present in the stream are marked with bit 1 in 'valid' attribute
	// At first we need to create all tables with their sizes because we don't know how many of them is there,
	// so we don't know where to start to parse table content.
	std::uint64_t currentAddress = address + metadataStreamHeaderSize;
	for (std::size_t i = 0; i < 64; ++i)
	{
		if ((valid >> i) & 1)
		{
			std::uint64_t tableSize;
			if (!get4Byte(currentAddress, tableSize))
			{
				return;
			}

			// If the size of the metadata table would be larger than there are data available, we just end. This must be corrupted.
			if (tableSize > getLoadedFileLength())
			{
				return;
			}

			metadataStream->addMetadataTable(static_cast<MetadataTableType>(i), tableSize);
			currentAddress += 4;
		}
	}
	// ExtraData flags means there is extra 4 bytes at the end Rows array that contaisn the rows sizes
	// I don't see anything about in at ECMA-335, but I can see in real samples and in IlSpy source
	// that understands it and correctly decompiles, sample: 5b5817fe2d4f0989501802b0e2bb4451583ff27fd0723f40bb7f8b0417dd7c58
	if (heapOffsetSizes & 0x40)
	{