dotnet module¶

New in version 3.6.0.

The dotnet module allows you to create more fine-grained rules for .NET files by using attributes and features of the .NET file format. Let's see some examples:

import "dotnet"

rule not_exactly_five_streams
{
    condition:
        dotnet.number_of_streams != 5
}

rule blop_stream
{
    condition:
        for any i in (0..dotnet.number_of_streams - 1):
            (dotnet.streams[i].name == "#Blop")
}

Reference¶

version¶

The version string contained in the metadata root.

Example: dotnet.version == "v2.0.50727"

module_name¶

The name of the module.

Example: dotnet.module_name == "axs"

number_of_streams¶: The number of streams in the file.

streams¶

A zero-based array of stream objects, one for each stream contained in the file. Individual streams can be accessed by using the [] operator. Each stream object has the following attributes:

name¶: Stream name.

offset¶: Stream offset.

size¶: Stream size.

Example: dotnet.streams[0].name == "#~"

number_of_guids¶: The number of GUIDs in the guids array.

guids¶

A zero-based array of strings, one for each GUID. Individual guids can be accessed by using the [] operator.

Example: dotnet.guids[0] == "99c08ffd-f378-a891-10ab-c02fe11be6ef"

number_of_classes¶
The number of classes in the file.¶

classes¶

An array of .NET classes stored in the metadata. Individual classes can be accessed¶

using the [] operator. Each class object contains the following attributes:¶

fullname¶
Class full name.¶

name¶
Class name.

namespace¶
Class namespace.¶

visibility¶
Class visibility specifier, options are:¶: private public protected internal private protected protected internal

type¶
Type of the object, options are:: class interface

abstract¶
Boolean representing if class is abstract.¶

sealed¶
Boolean representing if class is sealed.¶

number_of_generic_parameters¶
Number of generic parameters.¶

generic_parameters¶
A zero-based array of generic parameters name. Individual parameters can be accessed using the [] operator.¶

number_of_base_types¶
Number of the base types.¶

base_types¶
A zero-based array of base types name. Individual base types can be accessed using the [] operator.

number_of_methods¶
Number of the methods.¶

methods¶

A zero-based array of method objects. Individual methods can be accessed by¶

using the [] operator. Each object contains following attributes:¶

name
Method name.

visibility
Method visibility specifier, options are:: private public protected internal private protected protected internal

static¶
Boolean representing if method is static.¶

virtual¶
Boolean representing if method is virtual.¶

final¶
Boolean representing if method is final.¶

abstract
Boolean representing if method is abstract.

return_type¶
Method return type name.

number_of_parameters¶
Number of the method parameters.

parameters¶

A zero-based array of method parameters. Individual parameters can be accessed by using the [] operator.

name
Parameter name.

type
Parameter type.¶

number_of_generic_parameters
Number of the method generic parameters.

generic_parameters
A zero-based array of method generic parameters. Individual parameters can be accessed by using the [] operator.

Example: dotnet.classes[0].fullname == "Launcher.Program"

number_of_resources¶: The number of resources in the .NET file. These are different from normal PE resources.

resources¶

A zero-based array of resource objects, one for each resource the .NET file has. Individual resources can be accessed by using the [] operator. Each resource object has the following attributes:

offset¶: Offset for the resource data.

length¶: Length of the resource data.

name¶: Name of the resource (string).

Example: uint16be(dotnet.resources[0].offset) == 0x4d5a

assembly¶

Object for .NET assembly information.

version¶

An object with integer values representing version information for this assembly. Attributes are:

major minor build_number revision_number

name¶: String containing the assembly name.

culture¶: String containing the culture (language/country/region) for this assembly.

Example: dotnet.assembly.name == "Keylogger"

Example: dotnet.assembly.version.major == 7 and dotnet.assembly.version.minor == 0

number_of_modulerefs¶: The number of module references in the .NET file.

modulerefs¶

A zero-based array of strings, one for each module reference the .NET file has. Individual module references can be accessed by using the [] operator.

Example: dotnet.modulerefs[0] == "kernel32"

typelib¶: The typelib of the file.

number_of_constants¶: The number of constants in the .NET file.

constants¶: A zero-based array of strings, one for each constant the .NET file has. Individual constants can be accessed by using the [] operator.

number_of_assembly_refs¶: The number of objects for .NET assembly reference information.

assembly_refs¶

Object for .NET assembly reference information.

version¶

An object with integer values representing version information for this assembly. Attributes are:

major minor build_number revision_number

name¶: String containing the assembly name.

public_key_or_token¶: String containing the public key or token which identifies the author of this assembly.

number_of_user_strings¶: The number of user strings in the file.

user_strings¶: An zero-based array of user strings, one for each stream contained in the file. Individual strings can be accessed by using the [] operator.

number_of_field_offsets¶: The number of fields in the field_offsets array.

field_offsets¶

A zero-based array of integers, one for each field. Individual field offsets can be accessed by using the [] operator.

Example: dotnet.field_offsets[0] == 8675309

is_dotnet¶

New in version 4.2.0.

Function returning true if the PE is indeed .NET.

Example: dotnet.is_dotnet