Browse Source

Fix "DLL Characteristics" meanings in Optional Header

Made changes to several of the "Meaning" values of the "DLL Characteristics" flags in order to match the official documentation ( https://docs.microsoft.com/en-us/dotnet/api/system.reflection.portableexecutable.dllcharacteristics ):

1. Added definitions for first four values (0x01, 0x02, 0x04, and 0x08); it seems that they are "Reserved" instead of "Unused". I'm not sure if these values will ever be seen, but I figured it best to include the definitions since they seems to exist.
2. Changed wording in option 0x1000 to be "must" instead of "should" as it's both clearer and matches the documentation.
3. For option 0x20, the description here was "ASLR with 64-bit address space", while the documentation has it as "The image can handle a high entropy 64-bit virtual address space". After reviewing https://en.wikipedia.org/wiki/Address_space_layout_randomization I believe it's best to favor the documentation but also include 'ASLR' since that's really what the option pertains to.

Please note that options 0x80 and 0x4000 (copied below) are, for some odd reason, missing from the official documentation. I don't see a reason to remove them as the documentation is not 100% correct and sometimes things are left out. Should we add a comment in the C# code on each of those two lines indicating the disparity? For now I'm not doing that but might not be a bad idea to make it visible there since nobody will ever see this note here:

<0080> Code integrity checks are enforced
<4000> Image supports Control Flow Guard
pull/2147/head
Solomon Rutzky 5 years ago committed by GitHub
parent
commit
5cd228adc4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
  1. 12
      ILSpy/Metadata/OptionalHeaderTreeNode.cs

12
ILSpy/Metadata/OptionalHeaderTreeNode.cs

@ -112,19 +112,19 @@ namespace ICSharpCode.ILSpy.Metadata
{ {
FrameworkElementFactory dataGridFactory = new FrameworkElementFactory(typeof(DataGrid)); FrameworkElementFactory dataGridFactory = new FrameworkElementFactory(typeof(DataGrid));
dataGridFactory.SetValue(DataGrid.ItemsSourceProperty, new[] { dataGridFactory.SetValue(DataGrid.ItemsSourceProperty, new[] {
new { Value = (flags & 0x0001) != 0, Meaning = "<0001> Unused" }, new { Value = (flags & 0x0001) != 0, Meaning = "<0001> Process Init (Reserved)" },
new { Value = (flags & 0x0002) != 0, Meaning = "<0002> Unused" }, new { Value = (flags & 0x0002) != 0, Meaning = "<0002> Process Term (Reserved)" },
new { Value = (flags & 0x0004) != 0, Meaning = "<0004> Unused" }, new { Value = (flags & 0x0004) != 0, Meaning = "<0004> Thread Init (Reserved)" },
new { Value = (flags & 0x0008) != 0, Meaning = "<0008> Unused" }, new { Value = (flags & 0x0008) != 0, Meaning = "<0008> Thread Term (Reserved)" },
new { Value = (flags & 0x0010) != 0, Meaning = "<0010> Unused" }, new { Value = (flags & 0x0010) != 0, Meaning = "<0010> Unused" },
new { Value = (flags & 0x0020) != 0, Meaning = "<0020> ASLR with 64-bit address space" }, new { Value = (flags & 0x0020) != 0, Meaning = "<0020> Image can handle a high entropy 64-bit virtual address space (ASLR)" },
new { Value = (flags & 0x0040) != 0, Meaning = "<0040> DLL can be relocated at load time" }, new { Value = (flags & 0x0040) != 0, Meaning = "<0040> DLL can be relocated at load time" },
new { Value = (flags & 0x0080) != 0, Meaning = "<0080> Code integrity checks are enforced" }, new { Value = (flags & 0x0080) != 0, Meaning = "<0080> Code integrity checks are enforced" },
new { Value = (flags & 0x0100) != 0, Meaning = "<0100> Image is NX compatible" }, new { Value = (flags & 0x0100) != 0, Meaning = "<0100> Image is NX compatible" },
new { Value = (flags & 0x0200) != 0, Meaning = "<0200> Isolation aware, but do not isolate the image" }, new { Value = (flags & 0x0200) != 0, Meaning = "<0200> Isolation aware, but do not isolate the image" },
new { Value = (flags & 0x0400) != 0, Meaning = "<0400> Does not use structured exception handling (SEH)" }, new { Value = (flags & 0x0400) != 0, Meaning = "<0400> Does not use structured exception handling (SEH)" },
new { Value = (flags & 0x0800) != 0, Meaning = "<0800> Do not bind the image" }, new { Value = (flags & 0x0800) != 0, Meaning = "<0800> Do not bind the image" },
new { Value = (flags & 0x1000) != 0, Meaning = "<1000> Image should execute in an AppContainer" }, new { Value = (flags & 0x1000) != 0, Meaning = "<1000> Image must execute in an AppContainer" },
new { Value = (flags & 0x2000) != 0, Meaning = "<2000> Driver is a WDM Driver" }, new { Value = (flags & 0x2000) != 0, Meaning = "<2000> Driver is a WDM Driver" },
new { Value = (flags & 0x4000) != 0, Meaning = "<4000> Image supports Control Flow Guard" }, new { Value = (flags & 0x4000) != 0, Meaning = "<4000> Image supports Control Flow Guard" },
new { Value = (flags & 0x8000) != 0, Meaning = "<8000> Image is Terminal Server aware" }, new { Value = (flags & 0x8000) != 0, Meaning = "<8000> Image is Terminal Server aware" },

Loading…
Cancel
Save