dnfile

Warnings

• breaking Starting with version 0.14.0, `dnfile` requires Python 3.8 or newer. Attempts to use it with older Python versions will result in `ImportError` or other compatibility issues.
  Fix: Ensure your project environment uses Python 3.8 or a newer compatible version.
• breaking In version 0.15.0, the behavior of heap stream's `.get()` method changed. It now returns a `HeapItem` object (e.g., `HeapItemString`, `HeapItemBinary`) instead of raw bytes.
  Fix: If you were expecting `bytes`, you'll now need to access the `.value` attribute of the returned `HeapItem` (e.g., `item.value`). Be aware that `HeapItemString.value` can be `None` if decoding fails.
• breaking As of version 0.10.0, structure attributes no longer exist by default, and objects' attributes always exist but may be `None`. This means direct access to fields might require checks or use of the `.struct` attribute for raw values.
  Fix: When accessing specific fields, be prepared for attributes to be `None` or use the `.struct` attribute (e.g., `pe.net.struct.MajorRuntimeVersion`) to access raw structure values directly. Validate attribute existence and non-`None` values before use.
• gotcha dnfile is designed to parse as much as possible, even if the .NET executable is partially malformed. This means that parsing a corrupted file might result in a `dnPE` object with incomplete or `None` attributes rather than raising an immediate error.
  Fix: Always check for the existence and validity of attributes (e.g., `if hasattr(pe, 'net') and pe.net:`) after parsing, especially when dealing with untrusted or potentially malformed input files.

Install

• pip install dnfile Install stable version

Imports

• dnPE

  from dnfile import dnPE

  The primary entry point for parsing a .NET executable file.
• dnfile

  import dnfile

  Commonly imported directly to access top-level functions and classes like dnfile.dnPE, dnfile.stream, etc.

Quickstart

This quickstart demonstrates how to load and parse a .NET executable file using `dnfile`. It shows how to access the CLR header and iterate through some basic metadata streams. For a real use case, `filepath` should point to an actual .NET executable.

import sys
import dnfile

# For demonstration, create a dummy file or use a path to a real .NET exe
# Replace 'dummy.exe' with a path to an actual .NET executable for real parsing
# For a runnable quickstart, we'll simulate a file existence check.
filepath = "path/to/your/dotnet_executable.exe" # Placeholder

try:
    # In a real scenario, you'd ensure filepath points to a valid file.
    # For this example, we'll just demonstrate the parsing attempt.
    # A real application would handle FileNotFoundError or similar.
    pe = dnfile.dnPE(filepath)
    
    # Check if the .NET header exists
    if hasattr(pe, "net") and pe.net:
        print(f"Successfully parsed .NET executable: {filepath}")
        print(f"CLR Runtime Header Version: {pe.net.struct.MajorRuntimeVersion}.{pe.net.struct.MinorRuntimeVersion}")
        
        # Accessing metadata tables (example)
        if hasattr(pe.net, "mdtables") and pe.net.mdtables:
            print(f"Number of Metadata Tables: {len(pe.net.mdtables.tables_list)}")
            # Example: Iterate through some streams
            for s in pe.net.metadata.streams_list:
                print(f"  Stream Name: {s.name}, Size: {s.size}")
    else:
        print(f"File {filepath} does not appear to be a .NET executable or parsing failed.")

except Exception as e:
    print(f"An error occurred: {e}")