This will also prevent loading in Reflector. This happens because inside Tables we have 2 modules while we should have only one (the second one is bad)!
Module Table it's a one row table representing the current assembly.
Columns:
• Generation (2-byte value, reserved, shall be zero)
• Name (index into String heap), can be a word or a dword
• Mvid (index into Guid heap; simply a Guid used to distinguish between two versions of the same module)
• EncId (index into Guid heap, reserved, shall be zero)
• EncBaseId (index into Guid heap, reserved, shall be zero)
What must be done:
A. We load the file inside CFF Explorer, and we go at Metadata Stream->Tables->Module.
We go at second module (the one which must be cleaned) and we note the offset of first member (I’ve note this value1)
We go at last table (usualy Nested Classes) and at last member from this, we add 2 (the size of this member) to offset of him and we keep this value (I’ve note this value2). This is the file offset where Tables ends.
The module table can have the size: (I’ve note this size_of_module_table)
- 0C if Name is an dword (in most cases)
- 0A if Name is an word
We have two options for removing bad module table:
a. We load the file inside WinHex and we copy the hole block between value1 and value2 at the file offset (value1-size_of_module_table)
or b. We load the file inside WinHex and we add zero bytes equals whit the size of module table (0C) at file offset value2 (at the end of Tables).
We delete the table of second module (the table of course has the size 0C).
B. We search for the ASCII string '#Blob'
Now after that will come some other string which starts whit ‘#’, as exemple ‘#US’, ‘#GUID’.
At start of last string which starts whit '#' +020 (we are talking about hexazecimal numbers) is the number of modules (the old value is 2) - set number of modules to 1
发表于 2011-7-21 08:28
