Can a .NET assembly be verified independently of any other assemblies it might reference?
https://stackoverflow.com/questions/8110677
italiano
english
français
española
中国
日本の
العربية
Deutsch
한국어
Português
RussianQuestion
In other words: For a .NET assembly to be verified, do any of the referenced assembly need to be read and analyzed too? What does PEVerify tool do?
Solution
Short answer: yes, PEVerify needs to load referenced assemblies.
The assembly format is pretty self contained. But there's indeed a few things that PEVerify needs to check in referenced assemblies.
Generic instantiations
In the assembly, when you use a generic type or a generic method, the original generic arity is not preserved, and you have to load the definition of the type or of the method to properly verify the instantiation, both for arity (does the instantiation have the proper number of generic arguments?) and for constraints (does the generic argument satisfy the generic constraint specified on the generic parameter?). The verification will fail if PEVerify can not find the referenced assemblies.
Referenced members accessibility
If you call a method or manipulate a field defined in another assembly, PEVerify will try to load the assembly defining the member to check that the member has an appropriate visibility.
It will fail to verify if it can not find the assembly, with an “Unable to resolve token” error otherwise.
There's a couple of other cases where to properly read a piece of metadata you have to resolve a reference to a type, and thus, load its containing assembly, but I don't think PEVerify checks them:
Custom Attribute instantiation containing enums:
For instance:
[AttributeUsage (AttributeTargets.Field)]
You have to load the definition of AttributeTargets to know that it's backed by an int32 spanning over 4 bytes in the serialized custom attribute form.
Fields whose values are serialized in a binary form:
Some compiler may decide to store a constant value in a binary form in the assembly. In the case where the type of the constant is not a known primitive, you have to resolve the reference to this type to know its size.
But then again, I don't think PEVerify checks those cases. I'm actually pretty sure it doesn't check the encoding of custom attributes, for the second item, I'm not so sure.
