First, one must locate the marker by searching for 0x8b1202b96a612038727b930214d7a03213f5b9e6efae3318ee3b2dce24b36aae, then stepping back 8 bytes from the start of the market
At this location, reading a long (little endian) will give one the absolute file offset to the single file bundle header.
If the read value is 0, then it is not a single file bundle.
| offset | size | value |
|---|---|---|
| 0x00 | 0x4 (D.W.) | major version |
| 0x04 | 0x4 (D.W.) | minor version |
| 0x08 | 0x4 (D.W.) | embedded file count |
| 0x0C | 0x1 (B) | bundle id length |
| 0x0D | above value | bundle id |
| 0x0D + bdl id length | 0x8 (Q.W.) | deps json offset |
| 0x15 + bdl id length | 0x8 (Q.W.) | deps json size |
| 0x1D + bdl id length | 0x8 (Q.W.) | runtime json offset |
| 0x25 + bdl id length | 0x8 (Q.W.) | runtime json size |
| 0x2D + bdl id length | 0x8 (Q.W.) | flags |
After this, there is (embedded file count)x file entries
| offset | size | value |
|---|---|---|
| 0x00 | 0x8 (Q.W) | absolute offset of file |
| 0x08 | 0x8 (Q.W) | size of file |
| 0x10 | 0x8 (Q.W) | compressed size1. |
| 0x18 | 0x1 (B) | type |
| 0x19 | 0x1 (B) | name size |
| 0x1A | above value | file name |
| value | meaning |
|---|---|
| 0x00 | unknown file type |
| 0x01 | .net assemblies (il/r2r) |
| 0x02 | native binary |
| 0x03 | .deps.json config |
| 0x04 | .runtimeconfig.json config |
| 0x05 | pdb symbols |
https://github.com/dotnet/runtime/tree/main/src/native/corehost/apphost
https://www.jetbrains.com/decompiler/
Compiled by Sascha_T.
Footnotes
-
If this field reads 0, then the embedded file is not compressed. ↩