1

When I look at a .Net compiled DLL that is supposed to conform to ECMA-335, I see the PE Header well defined up to 0x1EF, but there seems to be block between 0x1F0 and 0x208 which is mainly 00's that is not referenced in the spec, the closest I get to is thinking it's the IT or IAT, but the document says it should be 40bytes long not the 28 I see.

The specific version of the DLL's CB is Major 2, Minor 5 - which is also missing from the spec.

Any thoughts? Or pointers to research content, please?

|improve this question
  • 40 decimal is 0x28 in hex, could this be the source of misunderstanding? – Igor Skochinsky♦ Nov 12 '18 at 17:51
  • It's possible that the author of ECMA-335 got confused. When I look at the DLL with some tools, it looks like they jump the 12 bytes. – Hmm Right Nov 12 '18 at 21:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.