0

I've implemented the .Net Profiler callback which allows me to get data about all the functions called in a .NET application. The function callback works great. Starting in the callback, I make a call to

GetModuleMetaData(moduleId, ofRead, IID_IMetaDataImport, (IUnknown**)&metaDataImport);

to which I make a subsequent call to

metaDataImport->EnumParams(&phEnum, (mdMethodDef)metaDataToken, rParams, cMax, &pcTokens);

pcTokens contains an array of parameter reference tokens. I can use those tokens to get the parameter names with the following call.

metaDataImport->GetParamProps(rParams[i], &(mdMethodDef)metaDataToken, &pulSequence, szName3, cchName3, &pchName3, NULL, NULL, NULL, NULL);

I'm stuck at trying to find the type of each parameter. I can't find any documentation that would give me the parameter type. https://learn.microsoft.com/en-us/dotnet/framework/unmanaged-api/metadata/imetadataimport-interface

Any thoughts?

CBaker
  • 830
  • 2
  • 10
  • 25

1 Answers1

1

If you want to receive CorElementType of the parameter, you can do it by signature parsing. Each method has signature with types of all locals and parameters. By GetSigFromToken or GetMethodSpecProps (for methodSpec) you can receive the signature.

After that you can parse the signature and extract the needed information. I recommend you to read I.8.6.1 Signatures of ECMA-355, especially I.8.6.1.5 Method signatures paragraph, to understand the format of the signature.

Here is an example of type parser in c# or c++ parser by David Broman.

Svirin
  • 564
  • 1
  • 7
  • 20
  • Thanks for the response. Any idea if there is a simpler way to just get a string of the type? Basically when enumerating the parameters, I'm just looking to do a quick check if the type is a string or not. – CBaker Mar 01 '21 at 14:07
  • I'm pretty sure there's no easier way. Unfortunately there is no built-in Type-parser in .net profiler API. – Svirin Mar 01 '21 at 18:55
  • Thanks for the info! – CBaker Mar 01 '21 at 22:06
  • Once you are able to parse the function's parameter types, any idea how to determine what sizes they are? I followed the example you sent in which i was able to determine the type of the function parameter. I have the memory address to where the actual parameters lie, but i don't know how to traverse the memory addresses and get each parameter value. Is a ELEMENT_TYPE_STRING 8 bytes? Is a ELEMENT_TYPE_PTR 4 bytes? How would I find out the size of each parameter? Thanks again for any info you can provide. – CBaker Mar 05 '21 at 02:02
  • ELEMENT_TYPE_PTR is a type of the parameter, like ELEMENT_TYPE_I4 or ELEMENT_TYPE_STRING, it is not a size of the parameter. I think this guide can help you to understand more about signatures, how it is represented in a blob, memory and compressed integer for a metadata extracting from the signature. Part 1: https://www.codeproject.com/Articles/42649/NET-File-Format-Signatures-Under-the-Hood-Part-1-o Part2: https://www.codeproject.com/Articles/42655/NET-File-Format-Signatures-under-the-Hood-Part-2-o – Svirin Mar 07 '21 at 11:30
  • In regards to parsing _COR_PRF_FUNCTION_ARGUMENT_INFO structure, the structure has the memory segments which contains the functions parameter values. After parsing the signature to get each parameter type, it seems like I would also need to determine the size of each parameter to extract the parameter data from the memory segments of that structure. – CBaker Mar 07 '21 at 16:00