“~”中排序的位向量字段的用途是什么? .NET 程序集中的元数据标头?
根据 Partition II 元数据,它说有效字段是一个位掩码,用于记录 .NET 可执行文件中存在哪些 CLR 元数据表 - 但我无法弄清楚“已排序”字段的用途 -它的意义是什么?在创建我自己的 .NET 可移植可执行映像时,我应该向该字段发送什么内容?
According to the Partition II metadata, it says that the valid field is a bitmask that notes which CLR metadata tables are present in a .NET executable--but what I can't figure out is what the "sorted" field is for--what is its significance, and what should I emit into this field when creating my own .NET portable executable images?
如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱,如果其他用户或者作者回复了您的评论,将不能在第一时间通知您!
发布评论
评论(2)
我认为排序字段只是暗示特定元数据表是否已排序(它是一个位字段,就像有效一样)。
这将允许运行时的实现直接从内存映射的数据对表进行二分搜索。
I think the sorted field is just hinting if the specific metadata table is sorted or not (it's a bitfield just like valid).
This would allow an implemenation of a runtime to do a binary search on the table directly from the memmapped data.
编辑:这不是答案,我误读了这个问题,认为它是关于“有效”字段而不是“排序”字段,但我将其留在这里,以防它与答案相关
“有效”您正在谈论的字段在 第二部分,§24.2.6,相关部分如下:
第 22 节从第 22.2 节开始的每个小节都描述一个表,并给出其位索引。例如,§22.2 的标题为“Assembly:0x20”。这意味着,当且仅当您的 PE 中存在第 22.2 节中描述的汇编表时,才必须在
Valid
字段中设置位 0x20。请注意,这NOT并不意味着Valid & 0x20 == 0x20
,表示必须设置Valid
的第0x20位(即第32位),即Valid & 0x20
。 (1 << 0x20) == (1 << 0x20)。有一段时间我不确定它是 0 索引还是 1 索引,所以我假设 0 索引。但我现在确定它是 0 索引的,因为模块表是表 0x00。
EDIT: This isn't an answer, I misread the question as being about the Valid field rather than the Sorted field, but I am leaving it here in case it is related to the answer
The "Valid" field you are talking about is described in Partition II, §24.2.6, with the relevant part as follows:
Each subsection of section 22 starting with §22.2 describes one table, and gives its bit index. For example, §22.2 is titled "Assembly: 0x20". This means that, if and only if the Assembly table described in §22.2 is present in your PE, then bit 0x20 must be set in the
Valid
field. Note that this does NOT mean thatValid & 0x20 == 0x20
, it means that the 0x20th (ie, the 32nd) bit ofValid
must be set, which is to sayValid & (1 << 0x20) == (1 << 0x20)
.For a while I wasn't sure if it was 0-indexed or 1-indexed, so I assumed 0-indexed. But I now know for sure that it is 0-indexed, because the Module table is table 0x00.