Reading raw attribute constructor data

Disassembling a custom attribute gives you a blob of raw bytes – what do they mean? Here is an example from the output from ildasm:

.custom instance void [mscorlib]System.Reflection.DefaultMemberAttribute::.ctor(string) = (
 01 00 04 49 74 65 6d 00 00
)                      // …Item..

This represents a DefaultMemberAttribute("Item") which is autgenerated by C# when your class has an indexer. The word "Item" is definitely in there – but what does the rest of the data mean? A google search doesn't give any useful answer from what I could find. I ended up looking in the Ecma Standard (page 267). This diagram gives an overview of the structure:

The prolog is always 0x0010 and little-endian encoded. The FixedArgs are the arguments to the constructor and the NamedArgs are properties. A string is encoded as a SerString, which is a single byte length called a PackedLen followed by a UTF8 string. NumNamed is also a little-endian encoded integer containing the number of properties being set (named arguments).

So in this case the data can be broken down as:

01 00: The Prolog (0x0010 in little-endian)
04: The string is 4 characters long
49 74 65 6d: "Item"
00 00: We have 0 properties

Leave a Reply

Your email address will not be published. Required fields are marked *