.NET assembly file format: metadata tables

How to read the layouts

A table is a run of fixed-size rows; a row is its columns one after another, little-endian, with no padding. A column is a fixed integer (1, 2 or 4 bytes), a heap index (#Strings, #GUID, #Blob: 2 bytes, or 4 when the HeapSizes bit for that heap is set), a table index (a row number from 1; 2 bytes, or 4 when the table it names has more than 65,535 rows), or a coded index (a table number and a row number in one value; see coded indexes). A list column such as FieldList holds the first row of a run that ends where the next row’s list begins. The rows of a table that is searched by key must be sorted by that key (the Sorted vector says so).

Every layout below was read by the explorer and by Microsoft’s System.Reflection.Metadata over the same files, and the row sizes and offsets of every table agreed in every file of the test (see the overview). The tables AssemblyProcessor, AssemblyOS, AssemblyRefProcessor and AssemblyRefOS are obsolete, and Microsoft’s reader does not accept them, so those four rest on the specification alone.

0x00 Module

One row: the module itself.

Column	Size	Holds
Generation	2	Reserved, zero.
Name	#Strings	The module’s file name.
Mvid	#GUID	The module version ID: a GUID made for each build (a hash of the content in reproducible builds).
EncId, EncBaseId	#GUID, #GUID	Edit-and-continue generation IDs, normally 0.

0x01 TypeRef

A type defined elsewhere.

Column	Size	Holds
ResolutionScope	coded	Where to find it: Module, ModuleRef, AssemblyRef or TypeRef (for a nested type).
TypeName, TypeNamespace	#Strings ×2	The name and namespace.

0x02 TypeDef

A type defined in this module. Row 1 is the pseudo-type <Module> that holds global functions and fields.

Column	Size	Holds
Flags	4	TypeAttributes.
TypeName, TypeNamespace	#Strings ×2	The name (List`1 for a generic with one parameter) and namespace; empty namespace for a nested type.
Extends	coded	TypeDefOrRef: the base type, or 0.
FieldList	index	The first Field row of this type; the run ends at the next type’s FieldList.
MethodList	index	The first MethodDef row, likewise.

0x03 FieldPtr

Only in an uncompressed (#-) stream: one column, Field (index), redirecting the numbering of the Field table.

0x04 Field

Column	Size	Holds
Flags	2	FieldAttributes.
Name	#Strings	The field name.
Signature	#Blob	A field signature.

0x05 MethodPtr

Uncompressed streams only: one column, Method (index into MethodDef).

0x06 MethodDef

Column	Size	Holds
RVA	4	The RVA of the method body (a CIL method header and code), or 0 for an abstract, extern or runtime-implemented method.
ImplFlags	2	MethodImplAttributes.
Flags	2	MethodAttributes.
Name	#Strings	The name (`.ctor`, `.cctor`, `get_Name`, …).
Signature	#Blob	A method signature.
ParamList	index	The first Param row.

0x07 ParamPtr

Uncompressed streams only: one column, Param.

0x08 Param

Column	Size	Holds
Flags	2	ParamAttributes.
Sequence	2	1 for the first parameter; 0 describes the return value.
Name	#Strings	The parameter name.

0x09 InterfaceImpl

Column	Size	Holds
Class	index	The TypeDef row that implements the interface; the table is sorted by it.
Interface	coded	TypeDefOrRef: the interface (a TypeSpec for a generic interface).

0x0A MemberRef

A field or method defined elsewhere, or a call site of a vararg method.

Column	Size	Holds
Class	coded	MemberRefParent: TypeDef, TypeRef, ModuleRef, MethodDef or TypeSpec.
Name	#Strings	The member name.
Signature	#Blob	A field or method signature.

0x0B Constant

The default value of a field, parameter or property.

Column	Size	Holds
Type	1	An element type: 0x02 bool, 0x03 char, 0x04 to 0x0B integers, 0x0C float, 0x0D double, 0x0E string, 0x12 null.
Padding	1	Zero.
Parent	coded	HasConstant: Field, Param or Property; sorted by it.
Value	#Blob	The value in its natural width (a string is UTF-16 without a length prefix).

0x0C CustomAttribute

Column	Size	Holds
Parent	coded	HasCustomAttribute: any of 22 tables; sorted by it.
Type	coded	CustomAttributeType: the constructor, a MethodDef or MemberRef.
Value	#Blob	The encoded arguments: prolog `0x0001`, the fixed arguments by the constructor’s signature, then named arguments. The explorer shows it as bytes.

0x0D FieldMarshal

Column	Size	Holds
Parent	coded	HasFieldMarshal: Field or Param.
NativeType	#Blob	A marshalling descriptor (bytes here).

0x0E DeclSecurity

Column	Size	Holds
Action	2	The security action (1 Request, 2 Demand, 3 Assert, 4 Deny, 5 PermitOnly, 6 LinkDemand, 7 InheritanceDemand, 8 RequestMinimum, 9 RequestOptional, 10 RequestRefuse, …).
Parent	coded	HasDeclSecurity: TypeDef, MethodDef or Assembly.
PermissionSet	#Blob	XML text (older files) or a binary permission set (bytes here).

0x0F ClassLayout

Column	Size	Holds
PackingSize	2	The `Pack` value (0, 1, 2, 4, 8, 16, …).
ClassSize	4	The `Size` value, or 0.
Parent	index	The TypeDef.

0x10 FieldLayout

Column	Size	Holds
Offset	4	The field’s offset in an explicit-layout type.
Field	index	The Field row.

0x11 StandAloneSig

A signature that stands alone: the locals of a method (referenced by its body header) or the call site of a calli. One column, Signature (#Blob).

0x12 EventMap

Column	Size	Holds
Parent	index	The TypeDef that has events.
EventList	index	The first Event row of the type; the run ends at the next map row’s.

0x13 EventPtr

Uncompressed streams only: one column, Event.

0x14 Event

Column	Size	Holds
EventFlags	2	EventAttributes.
Name	#Strings	The event name.
EventType	coded	TypeDefOrRef: the delegate type.

0x15 PropertyMap

Column	Size	Holds
Parent	index	The TypeDef that has properties.
PropertyList	index	The first Property row.

0x16 PropertyPtr

Uncompressed streams only: one column, Property.

0x17 Property

Column	Size	Holds
Flags	2	PropertyAttributes.
Name	#Strings	The property name.
Type	#Blob	A property signature (header 0x08, plus 0x20 for an instance property): the parameters are the index parameters.

0x18 MethodSemantics

Ties accessor methods to the property or event they belong to.

Column	Size	Holds
Semantics	2	MethodSemanticsAttributes: 1 setter, 2 getter, 4 other, 8 add, 0x10 remove, 0x20 fire.
Method	index	The MethodDef.
Association	coded	HasSemantics: an Event or Property.

0x19 MethodImpl

An explicit interface or base method implementation.

Column	Size	Holds
Class	index	The TypeDef.
MethodBody	coded	MethodDefOrRef: the implementing method.
MethodDeclaration	coded	MethodDefOrRef: the method it implements.

0x1A ModuleRef

One column, Name (#Strings): another module of the assembly, or a native library named by P/Invoke.

0x1B TypeSpec

A constructed type used where a type is needed (a generic instance, an array). One column, Signature (#Blob): a bare type with no calling convention byte.

0x1C ImplMap

Platform invoke: a method or field implemented by a native function.

Column	Size	Holds
MappingFlags	2	PInvokeAttributes: character set, calling convention, last-error.
MemberForwarded	coded	MemberForwarded: Field or MethodDef.
ImportName	#Strings	The exported function name (`EntryPoint`).
ImportScope	index	The ModuleRef naming the library.

0x1D FieldRVA

Column	Size	Holds
RVA	4	Where the field’s initial data is (static array initialisers, `.data`).
Field	index	The Field row.

0x1E ENCLog and 0x1F ENCMap

Edit-and-continue deltas. ENCLog: Token (4) and FuncCode (4, not interpreted here). ENCMap: Token (4). Shown as rows, not interpreted.

0x20 Assembly

One row: the assembly manifest. Absent in a module (.netmodule).

Column	Size	Holds
HashAlgId	4	The algorithm for file hashes: 0x8004 SHA1 in every assembly read here (0x8003 MD5, 0x800C SHA256, 0x800D SHA384, 0x800E SHA512).
MajorVersion, MinorVersion, BuildNumber, RevisionNumber	2 ×4	The version.
Flags	4	AssemblyFlags.
PublicKey	#Blob	The public key (160 bytes for a 1024-bit RSA key), or empty.
Name, Culture	#Strings ×2	The simple name; the culture (empty is neutral).

0x21 AssemblyProcessor, 0x22 AssemblyOS

Obsolete; the specification says compilers must not write them. AssemblyProcessor: Processor (4). AssemblyOS: OSPlatformID, OSMajorVersion, OSMinorVersion (4 each).

0x23 AssemblyRef

Column	Size	Holds
MajorVersion, MinorVersion, BuildNumber, RevisionNumber	2 ×4	The version wanted.
Flags	4	AssemblyFlags: PublicKey (0x1) says the next column is a full key, not a token.
PublicKeyOrToken	#Blob	The 8-byte public key token (or the key).
Name, Culture	#Strings ×2	The simple name and culture.
HashValue	#Blob	A hash of the referenced assembly, usually empty.

0x24 AssemblyRefProcessor, 0x25 AssemblyRefOS

Obsolete. AssemblyRefProcessor: Processor (4), AssemblyRef (index). AssemblyRefOS: OSPlatformID, OSMajorVersion, OSMinorVersion (4 each), AssemblyRef (index).

0x26 File

A file of a multi-module assembly or a resource file.

Column	Size	Holds
Flags	4	0 ContainsMetaData, 1 ContainsNoMetaData.
Name	#Strings	The file name.
HashValue	#Blob	The hash of the file.

0x27 ExportedType

A type that this assembly makes visible but that is defined in another file or assembly (a multi-module type, or a type forwarder).

Column	Size	Holds
Flags	4	TypeAttributes (0x200000 here marks a forwarder).
TypeDefId	4	A TypeDef token hint in the other module.
TypeName, TypeNamespace	#Strings ×2	The name and namespace.
Implementation	coded	Implementation: a File, an AssemblyRef (a forwarder) or an ExportedType (nested).

0x28 ManifestResource

Column	Size	Holds
Offset	4	The offset of the resource in the resources block of the CLR header (for an embedded resource).
Flags	4	1 Public, 2 Private.
Name	#Strings	The resource name.
Implementation	coded	Implementation: 0 when embedded in this file; a File or an AssemblyRef otherwise.

0x29 NestedClass

Column	Size	Holds
NestedClass	index	The nested TypeDef; the table is sorted by it.
EnclosingClass	index	The enclosing TypeDef.

0x2A GenericParam

Column	Size	Holds
Number	2	The parameter’s position, from 0.
Flags	2	GenericParamAttributes: variance and constraints.
Owner	coded	TypeOrMethodDef: the generic type or method.
Name	#Strings	The parameter name (`T`).

0x2B MethodSpec

Column	Size	Holds
Method	coded	MethodDefOrRef: the generic method.
Instantiation	#Blob	A signature starting 0x0A, a count and the type arguments.

0x2C GenericParamConstraint

Column	Size	Holds
Owner	index	The GenericParam row.
Constraint	coded	TypeDefOrRef: a type the parameter must derive from or implement.

0x30 to 0x37: the portable PDB tables

These tables occur only in a portable PDB (or the debug metadata embedded in an assembly). Columns that name MethodDef or other type system tables are sized by the row counts in the #Pdb stream.

Table	Columns
0x30 Document	Name (#Blob: the path, split by a separator), HashAlgorithm (#GUID), Hash (#Blob), Language (#GUID)
0x31 MethodDebugInformation	Document (index), SequencePoints (#Blob: compressed sequence points)
0x32 LocalScope	Method (index), ImportScope (index), VariableList (index), ConstantList (index), StartOffset (4), Length (4)
0x33 LocalVariable	Attributes (2), Index (2), Name (#Strings)
0x34 LocalConstant	Name (#Strings), Signature (#Blob)
0x35 ImportScope	Parent (index), Imports (#Blob)
0x36 StateMachineMethod	MoveNextMethod (index), KickoffMethod (index)
0x37 CustomDebugInformation	Parent (coded HasCustomDebugInformation), Kind (#GUID), Value (#Blob)

Not described

Known, not yet covered

Reference: the meaning of the blob columns beyond signatures (custom attribute values, marshalling descriptors, permission sets, sequence points, import blobs, the Document name encoding) is not described; Viewer: these blobs show as bytes.
Reference: the rules that make a table valid (sort order, the ranges of list columns, uniqueness) are only partly stated here; Viewer: it reports an index outside its table and a stream cut short, not an unsorted table or a duplicate row.

.NET Assembly File Format – Tables