AssemblyAnalyzer
Namespace: Dotsider.Core.Analysis
Assembly: Dotsider.Core.dll
Core analyzer that reads a .NET assembly and extracts PE, metadata, IL, and string information. Uses PEReader and MetadataReader from the BCL.
public sealed class AssemblyAnalyzer : IDisposableInheritance
Section titled “Inheritance”Object → AssemblyAnalyzer
Implements
Section titled “Implements”Constructors
Section titled “Constructors”AssemblyAnalyzer(byte[], string, string?, string?)
Section titled “AssemblyAnalyzer(byte[], string, string?, string?)”Creates an analyzer from raw bytes in memory. Used for bundle-extracted assemblies and as a last-resort fallback when disk I/O is unavailable after a save operation.
Parameters:
bytes(Byte[]): The raw assembly bytes.filePath(String): On-disk path for physical operations (tracing, save checks).sourceBundlePath(String): If this assembly was extracted from a single-file bundle, the path to the bundle file. Used for assembly resolution context.displayName(String): Logical name of the analyzed artifact for UI display (e.g. “SelfContainedConsole.dll” when the entry assembly is extracted from a bundle). If null, defaults to the file name portion of filePath.
public AssemblyAnalyzer(byte[] bytes, string filePath, string? sourceBundlePath = null, string? displayName = null)AssemblyAnalyzer(string)
Section titled “AssemblyAnalyzer(string)”Opens and analyzes the specified .NET assembly file.
Parameters:
filePath(String): Absolute path to the assembly file.
public AssemblyAnalyzer(string filePath)Properties
Section titled “Properties”Architecture
Section titled “Architecture”The PE architecture description (e.g., “AnyCPU”, “x64”, “ARM64”).
Returns: String
public string Architecture { get; }AssemblyName
Section titled “AssemblyName”The assembly simple name, or null if the file has no assembly manifest.
Returns: String
public string? AssemblyName { get; }AssemblyRefs
Section titled “AssemblyRefs”Gets the AssemblyRef metadata table entries.
Returns: IReadOnlyList<AssemblyRefInfo>
public IReadOnlyList<AssemblyRefInfo> AssemblyRefs { get; }AssemblyVersion
Section titled “AssemblyVersion”The assembly version string, or null.
Returns: String
public string? AssemblyVersion { get; }CanSaveInPlace
Section titled “CanSaveInPlace”Whether in-place hex save is supported. Returns false for bundle-backed analyzers
because writing extracted entry bytes back over the bundle would corrupt it.
Returns: Boolean
public bool CanSaveInPlace { get; }ClrHeader
Section titled “ClrHeader”The parsed CLR header, or null if not a .NET assembly.
Returns: ClrHeader
public ClrHeader? ClrHeader { get; }CreatedTime
Section titled “CreatedTime”The creation time in UTC.
Returns: DateTime
public DateTime CreatedTime { get; }Culture
Section titled “Culture”The assembly culture, or null for culture-neutral assemblies.
Returns: String
public string? Culture { get; }CustomAttributes
Section titled “CustomAttributes”Gets the custom attributes applied to metadata entities.
Returns: IReadOnlyList<CustomAttributeInfo>
public IReadOnlyList<CustomAttributeInfo> CustomAttributes { get; }DisplayName
Section titled “DisplayName”Logical display name for the analyzed artifact. For bundle-backed analyzers this is the entry assembly file name (e.g. “SelfContainedConsole.dll”) while FilePath points to the bundle executable on disk. For file-backed analyzers, equals FileName.
Returns: String
public string DisplayName { get; }FieldDefs
Section titled “FieldDefs”Gets the FieldDef metadata table entries.
Returns: IReadOnlyList<FieldDefInfo>
public IReadOnlyList<FieldDefInfo> FieldDefs { get; }FileName
Section titled “FileName”The file name without directory path.
Returns: String
public string FileName { get; }FilePath
Section titled “FilePath”The full path to the analyzed assembly file.
Returns: String
public string FilePath { get; }FileSize
Section titled “FileSize”The file size in bytes.
Returns: Int64
public long FileSize { get; }HasMetadata
Section titled “HasMetadata”Whether the PE file contains .NET metadata.
Returns: Boolean
public bool HasMetadata { get; }IsBundleBacked
Section titled “IsBundleBacked”Whether this analyzer was created from bytes extracted from a single-file bundle.
Returns: Boolean
public bool IsBundleBacked { get; }IsReadOnly
Section titled “IsReadOnly”Whether the file is read-only on disk.
Returns: Boolean
public bool IsReadOnly { get; }LastModified
Section titled “LastModified”The last modification time in UTC.
Returns: DateTime
public DateTime LastModified { get; }LaunchPath
Section titled “LaunchPath”The path to launch when tracing this assembly. For bundle-backed analyzers this is the bundle executable; for file-backed analyzers this is FilePath.
Returns: String
public string LaunchPath { get; }MemberRefs
Section titled “MemberRefs”Gets the MemberRef metadata table entries.
Returns: IReadOnlyList<MemberRefInfo>
public IReadOnlyList<MemberRefInfo> MemberRefs { get; }MethodDefs
Section titled “MethodDefs”Gets the MethodDef metadata table entries.
Returns: IReadOnlyList<MethodDefInfo>
public IReadOnlyList<MethodDefInfo> MethodDefs { get; }PeHeaders
Section titled “PeHeaders”The parsed PE headers.
Returns: PeHeaders
public PeHeaders? PeHeaders { get; }PreferredRuntimePack
Section titled “PreferredRuntimePack”The preferred .NET runtime pack for this assembly, detected from its assembly references. Returns “Microsoft.WindowsDesktop.App” for WPF/WinForms assemblies, “Microsoft.AspNetCore.App” for ASP.NET Core assemblies, or “Microsoft.NETCore.App” otherwise.
Returns: String
public string PreferredRuntimePack { get; }PublicKeyToken
Section titled “PublicKeyToken”The public key token as a hex string, or null.
Returns: String
public string? PublicKeyToken { get; }RawBytes
Section titled “RawBytes”Gets the raw bytes of the file for hex editor display.
Returns: ReadOnlyMemory<Byte>
public ReadOnlyMemory<byte> RawBytes { get; }Resources
Section titled “Resources”Gets the manifest resources defined in the assembly.
Returns: IReadOnlyList<ResourceInfo>
public IReadOnlyList<ResourceInfo> Resources { get; }Sections
Section titled “Sections”Gets the PE sections.
Returns: IReadOnlyList<SectionInfo>
public IReadOnlyList<SectionInfo> Sections { get; }SourceBundlePath
Section titled “SourceBundlePath”If this assembly was loaded from a single-file bundle, the path to the bundle file. Used as resolution context when probing for referenced assemblies.
Returns: String
public string? SourceBundlePath { get; }TargetFramework
Section titled “TargetFramework”The target framework moniker (e.g., ”.NETCoreApp,Version=v10.0”), or null.
Returns: String
public string? TargetFramework { get; }TypeDefs
Section titled “TypeDefs”Gets the TypeDef metadata table entries.
Returns: IReadOnlyList<TypeDefInfo>
public IReadOnlyList<TypeDefInfo> TypeDefs { get; }TypeRefs
Section titled “TypeRefs”Gets the TypeRef metadata table entries.
Returns: IReadOnlyList<TypeRefInfo>
public IReadOnlyList<TypeRefInfo> TypeRefs { get; }Methods
Section titled “Methods”Dispose()
Section titled “Dispose()”Performs application-defined tasks associated with freeing, releasing, or resetting unmanaged resources.
public void Dispose()GetMetadataReader()
Section titled “GetMetadataReader()”Gets the underlying MetadataReader for advanced queries. Returns null if the file has no .NET metadata.
Returns: MetadataReader
public MetadataReader? GetMetadataReader()GetMethodBody(MethodDefInfo)
Section titled “GetMethodBody(MethodDefInfo)”Gets the method body bytes for IL disassembly. Returns null if the method has no IL body (abstract, extern, or native).
Parameters:
method(MethodDefInfo): The method definition to get the body for.
Returns: MethodBodyBlock
The method body block, or null.
public MethodBodyBlock? GetMethodBody(MethodDefInfo method)IsFrameworkAssembly(AssemblyProvenance, AssemblyRefInfo, string?, string?)
Section titled “IsFrameworkAssembly(AssemblyProvenance, AssemblyRefInfo, string?, string?)”Classifies whether an assembly belongs to the .NET framework surface regardless of deployment model. Returns true when the node was located through the shared framework or runtime directory, or when its identity matches a well-known Microsoft framework public key token, or when the shared-framework locator recognizes its simple name for the supplied target framework. This classification is used by the TUI framework-filter toggle so framework assemblies shipped inside a self-contained publish or single-file bundle are filtered consistently with framework assemblies loaded from the shared runtime.
Parameters:
provenance(AssemblyProvenance): How the node was located.identity(AssemblyRefInfo): The resolved assembly’s identity.targetFramework(String): The referencing assembly’s target framework moniker.preferredRuntimePack(String): The referencing assembly’s preferred runtime pack.
Returns: Boolean
true if the node represents a framework assembly.
public static bool IsFrameworkAssembly(AssemblyProvenance provenance, AssemblyRefInfo identity, string? targetFramework, string? preferredRuntimePack)ResolveAssembly(string, string, string?, string?, string?)
Section titled “ResolveAssembly(string, string, string?, string?, string?)”Resolves a referenced assembly name to a file on disk or bytes from a bundle. Probes: app-local, runtime directory, source bundle, host process bundle, adjacent bundles, and .NET shared framework.
Parameters:
referencingAssemblyPath(String): Path of the assembly that references the target.assemblyName(String): Assembly name without extension (e.g. “System.Runtime”).targetFramework(String): Target framework moniker for version-matched shared framework probing.preferredRuntimePack(String): Preferred runtime pack to probe first (e.g. “Microsoft.AspNetCore.App”).sourceBundlePath(String): If the referencing assembly came from a bundle, the bundle path.
Returns: ResolvedAssembly
The resolved assembly, or null if not found.
public static ResolvedAssembly? ResolveAssembly(string referencingAssemblyPath, string assemblyName, string? targetFramework = null, string? preferredRuntimePack = null, string? sourceBundlePath = null)ResolveAssemblyByIdentity(string, AssemblyRefInfo, string?, string?, string?, NetFxBindingContext?)
Section titled “ResolveAssemblyByIdentity(string, AssemblyRefInfo, string?, string?, string?, NetFxBindingContext?)”Resolves a referenced assembly by full identity (name, version, culture, public key token). Probes every stage of String) and accepts only candidates whose manifest identity matches the requested identity exactly. If no probe produces a full match but at least one probe produces a simple-name match whose identity differs, returns IdentityMismatch with the path of that candidate — the graph does not expand from mismatched files.
Parameters:
referencingAssemblyPath(String): Path of the assembly that references the target.identity(AssemblyRefInfo): The full identity the caller expects to resolve.targetFramework(String): Target framework moniker for shared-framework probing.preferredRuntimePack(String): Preferred runtime pack name.sourceBundlePath(String): Bundle path, when the referencing assembly came from a bundle.netFxBindingContext(NetFxBindingContext): Per-root .NET Framework binding context, or null for non-net48 roots. When supplied, the resolution routes through NetFxBindingContext) instead of the .NET Core probe chain, faithfully modeling the CLR’s framework unification + machine.config
- publisher policy + app config + GAC + Framework[64] runtime + codeBase + appBase order.
Returns: AssemblyResolution
An AssemblyResolution carrying the resolved assembly, provenance, optional candidate-probe path, and (for net48 roots) the applied policy and loaded identity.
public static AssemblyResolution ResolveAssemblyByIdentity(string referencingAssemblyPath, AssemblyRefInfo identity, string? targetFramework = null, string? preferredRuntimePack = null, string? sourceBundlePath = null, NetFxBindingContext? netFxBindingContext = null)ResolveAssemblyPath(string, string)
Section titled “ResolveAssemblyPath(string, string)”Backward-compatible wrapper that resolves to a file path only.
Returns null for bundle-backed results.
Parameters:
Returns: String
public static string? ResolveAssemblyPath(string referencingAssemblyPath, string assemblyName)ResolveToken(int)
Section titled “ResolveToken(int)”Resolves a metadata token to a human-readable name.
Parameters:
token(Int32): The metadata token to resolve.
Returns: String
A display string for the token.
public string ResolveToken(int token)