This is a simple C# program that uses the Reflection API to read metadata information from an assembly. As shown in the figures below, an executable or DLL is loaded into the program and upon clicking the disassamble button, PEManifest reads the metadata and displays it in the text box.
Figure: PEManifest Loading DLL file
PEManifest uses System.Reflection and System.Reflection.Emit to provide the metadata-reading facilities. I won't get into all the code, just the important parts. Upon clicking the Disassemble button, we initialize an ArrayList to hold the manifest details
ArrayList manifestdata = new ArrayList();
Then an Assembly class loads assemblyName as the parameter.
manifestdata.Add("Reading
" + assemblyName + " Metadata...");
Assembly a = Assembly.LoadFrom(assemblyName);
assemblyName holds the filename, which could be an exe or DLL waiting to be explored.
Figure: PEManifest Exploring PEManifest.exe
| PEManifest is developed using SharpDevelop IDE. It's an open source (GPL) free integrated development environment for C# and VB.NET Projects on the Microsoft.NET platform. |
Later we created an array of modules
Module[] modules = a.GetModules();
Iterated them and read their corresponding information then added it into a text area
foreach(Module m in modules)
{
manifestdata.Add ("Module: " + m.Name);
}
After modules, it hits the types
Type[] types = a.GetTypes();
And then iterates types for further data
foreach(Type type in types)
{
manifestdata.Add (": :"+ type);
It iterates each type for the member's information.
foreach(MemberInfo
member in type.GetMembers(BindingFlags.Public|BindingFlags.Instance))
{
manifestdata.Add(": "+ member);
}
}
To display it in the text area, it copies the array to the text area
for (int cnt=0; cnt<manifestdata.Count; cnt++)
ManifestConsole.Text += (cnt+1) +": " + manifestdata[cnt].ToString()+ "";
}
This iteration provides the complete details of an assembly in the text area. If you'll look at the figure above where PEManifest is self-decompiled by itself, you'll see a list of operations that were in the original source but can be back tracked using portable executables.
Figure: PEManifest Loading InterOp assemblyDLL file
The full source of this application can be downloaded with this article. MainForm.cs contains all of the listing of the PEManifest Project
<< Introduction • • Code Obfuscation >>
