.NET Assembly File Format – Manifest and references

The assembly identity

The Assembly table has at most one row. Its name, four-part version, culture and public key make up the identity of the assembly. A module (.netmodule) has no row and is added to an assembly by that assembly’s File table. The explorer’s Assembly section shows the name, version, culture, public key (its length and its token), hash algorithm and flags.

The public key token is the last 8 bytes of the SHA-1 hash of the public key, in reverse order. The explorer computes it with its own SHA-1; it gives b77a5c561934e089 for the 16-byte ECMA key 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00, the token every standard library assembly of the runtime references, and the SHA-1 itself agrees with Node’s crypto library on test inputs.

Assembly references

Each AssemblyRef row names an assembly this one uses, with the version wanted, the culture, the public key token (or full key when the PublicKey flag is set) and an optional hash. A file for .NET Framework refers to mscorlib; a .NET Standard or .NET (Core) file refers to netstandard or System.Runtime and others (reference assemblies that forward to the real implementation). The list therefore also says which platform a file was built for.

Other files and exported types

A multi-module assembly lists its other files in the File table and the types they define in ExportedType. The same table holds type forwarders: a row whose Implementation is an AssemblyRef says where a type moved to. The explorer lists both in one section.

Managed resources

Each ManifestResource row names a resource. If its Implementation is 0 the resource is embedded: Offset is a byte offset into the resources block of the CLR header, where the resource is a 4-byte length followed by that many bytes. The explorer lists the name, visibility, offset and length, and flags an offset outside the block or a length that runs past it. The content (a .resources file, which starts with 0xBEEFCACE, or any file) is not decoded yet.

Strong name

A strong-named assembly has a public key in its Assembly row (flag PublicKey 0x1), the CLR header flag STRONGNAMESIGNED (0x8), and a signature block pointed to by the CLR header, 128 bytes for a 1024-bit key. A delay-signed or public-signed assembly has the key and room for the signature but not the flag. The explorer shows the key length and token, the signature block, and whether the flag is set; it does not verify the signature.

Not described

Known, not yet covered

• Viewer: the public key blob (algorithm ids, modulus size) is shown by its length only; the strong name signature is not verified; the contents of the resources are not decoded; custom assembly attributes (target framework, version, company) are bytes until the custom attribute encoding is decoded.

Links