Disassembling a custom attribute gives you a blob of raw bytes – what do they mean? Here is an example from the output from ildasm:
01 00 04 49 74 65 6d 00 00
) // …Item..
This represents a DefaultMemberAttribute(“Item”) which is autgenerated by C# when your class has an indexer. The word “Item” is definitely in there – but what does the rest of the data mean? A google search doesn’t give any useful answer from what I could find. I ended up looking in the Ecma Standard (page 267). This diagram gives an overview of the structure:
The prolog is always 0x0010 and little-endian encoded. The FixedArgs are the arguments to the constructor and the NamedArgs are properties. A string is encoded as a SerString, which is a single byte length called a PackedLen followed by a UTF8 string. NumNamed is also a little-endian encoded integer containing the number of properties being set (named arguments).
So in this case the data can be broken down as:
01 00: The Prolog (0x0010 in little-endian) 04: The string is 4 characters long 49 74 65 6d: "Item" 00 00: We have 0 properties