dotnet update: emit enclosing class information for nested classes

capa/features/extractors/dnfile/helpers.py

@@ -108,6 +108,10 @@ def get_dotnet_managed_imports(pe: dnfile.dnPE) -> Iterator[DnType]:
             TypeName (index into String heap)
             TypeNamespace (index into String heap)
     """
+    #typeref_table = get_typeref_table(pe)
+    #typeref_class_names = []
+    #typeref_assembled_class_names = {}
+
     for rid, member_ref in iter_dotnet_table(pe, dnfile.mdtable.MemberRef.number):
         assert isinstance(member_ref, dnfile.mdtable.MemberRefRow)
 
@@ -131,6 +135,9 @@ def get_dotnet_managed_imports(pe: dnfile.dnPE) -> Iterator[DnType]:
             # remove get_/set_ from MemberRef name
             member_ref_name = member_ref_name[4:]
 
+        #typeref_class_names.append((member_ref.Class.row.TypeName, member_ref.Class.row.TypeNamespace))
+        #member_ref.Class.row.TypeNamespace, member_ref.Class.row.TypeName, typeref_assembled_class_names = is_nested_helper(rid, typeref_table, typeref_class_names, member_ref.Class.row, typeref_assembled_class_names, False)
+
         yield DnType(
             token,
             member_ref.Class.row.TypeName,
@@ -188,6 +195,10 @@ def get_dotnet_managed_methods(pe: dnfile.dnPE) -> Iterator[DnType]:
             TypeNamespace (index into String heap)
             MethodList (index into MethodDef table; it marks the first of a contiguous run of Methods owned by this Type)
     """
+    #nested_class_table = get_nested_class_table(pe)
+    #typedef_class_names = []
+    #typedef_assembled_class_names = {}
+
     accessor_map: Dict[int, str] = {}
     for methoddef, methoddef_access in get_dotnet_methoddef_property_accessors(pe):
         accessor_map[methoddef] = methoddef_access
@@ -211,6 +222,9 @@ def get_dotnet_managed_methods(pe: dnfile.dnPE) -> Iterator[DnType]:
                 # remove get_/set_
                 method_name = method_name[4:]
 
+            #typedef_class_names.append((method_name, typedef.TypeNamespace))
+            #typedef.TypeNamespace, typedef.TypeName, typedef_assembled_class_names = is_nested_helper(idx, nested_class_table, typedef_class_names, typedef, typedef_assembled_class_names, True)
+
             yield DnType(token, typedef.TypeName, namespace=typedef.TypeNamespace, member=method_name, access=access)
 
 
@@ -236,6 +250,9 @@ def get_dotnet_fields(pe: dnfile.dnPE) -> Iterator[DnType]:
                 logger.debug("TypeDef[0x%X] FieldList[0x%X] row is None", rid, idx)
                 continue
             token: int = calculate_dotnet_token_value(field.table.number, field.row_index)
+
+            # Do here as well
+
             yield DnType(token, typedef.TypeName, namespace=typedef.TypeNamespace, member=field.row.Name)
 
 
@@ -299,22 +316,93 @@ def get_dotnet_unmanaged_imports(pe: dnfile.dnPE) -> Iterator[DnUnmanagedMethod]
         # like kernel32.CreateFileA
         yield DnUnmanagedMethod(token, module, method)
 
+def get_nested_class_table(pe):
+    nested_class_table = {}
+
+    # Used to find nested classes in typedef
+    for rid, nestedclass in iter_dotnet_table(pe, dnfile.mdtable.NestedClass.number):
+        assert isinstance(nestedclass, dnfile.mdtable.NestedClassRow)
+        nested_class_table[nestedclass.NestedClass.row_index] = nestedclass.EnclosingClass.row_index
+
+    return nested_class_table
 
+def get_typedef_class_table(pe):
+    typedef_class_table = []
+
+    for rid, typedef in iter_dotnet_table(pe, dnfile.mdtable.TypeDef.number):
+        assert isinstance(typedef, dnfile.mdtable.TypeDefRow)
+        typedef_class_table.append((typedef.TypeName, typedef.TypeNamespace))
+
+    return typedef_class_table
+
+def typedef_helper(index, nested_class_table, typedef_class_table, n, name):
+    # Append the current typeref name
+    n.append(name)
+
+    if nested_class_table[index] in nested_class_table:
+        typedef_helper(nested_class_table[index], nested_class_table, typedef_class_table, n, typedef_class_table[nested_class_table[index]-1][0])
+    else:
+        # Document the root enclosing details
+        n.append(typedef_class_table[nested_class_table[index]-1][0])
+        namespace = typedef_class_table[nested_class_table[index]-1][1]
+        n.append(namespace)
+
+    return tuple(n[::-1])
+
+def get_typeref_table(pe):
+    typeref_table = []
+
+    # Used to track values in typeref table
+    for rid, typeref in iter_dotnet_table(pe, dnfile.mdtable.TypeRef.number):
+        assert isinstance(typeref, dnfile.mdtable.TypeRefRow)
+        typeref_table.append((typeref.TypeName, typeref.TypeNamespace, typeref.ResolutionScope.row_index, type(typeref.ResolutionScope.table)))
+
+    return typeref_table
+
+def typeref_helper(index, typeref_table, n, name):
+    # Append the current typeref name
+    n.append(name)
+
+    if typeref_table[index - 1][3] == dnfile.mdtable.TypeRef:
+        # Recursively call helper function with enclosing typeref details
+        typeref_helper(typeref_table[index - 1][2], typeref_table, n, typeref_table[index - 1][0])
+    else:
+        # Document the root enclosing details
+        n.append(typeref_table[index - 1][0])
+        namespace = typeref_table[index - 1][1]
+        n.append(namespace)
+
+    return tuple(n[::-1])
+
 def get_dotnet_types(pe: dnfile.dnPE) -> Iterator[DnType]:
     """get .NET types from TypeDef and TypeRef tables"""
+    nested_class_table = get_nested_class_table(pe)
+    typedef_class_table = get_typedef_class_table(pe)
+
     for rid, typedef in iter_dotnet_table(pe, dnfile.mdtable.TypeDef.number):
         assert isinstance(typedef, dnfile.mdtable.TypeDefRow)
 
+        typedef_name = []
+        if rid in nested_class_table:
+            typedef.TypeName = typedef_helper(rid, nested_class_table, typedef_class_table, typedef_name, typedef.TypeName)
+
         typedef_token: int = calculate_dotnet_token_value(dnfile.mdtable.TypeDef.number, rid)
         yield DnType(typedef_token, typedef.TypeName, namespace=typedef.TypeNamespace)
 
+
+    typeref_table = get_typeref_table(pe)
+
     for rid, typeref in iter_dotnet_table(pe, dnfile.mdtable.TypeRef.number):
         assert isinstance(typeref, dnfile.mdtable.TypeRefRow)
-
+
+        # If the ResolutionScope decodes to a typeRef type, then it is nested
+        n = []
+        if type(typeref.ResolutionScope.table) == dnfile.mdtable.TypeRef:
+            typeref.TypeName = typeref_helper(typeref.ResolutionScope.row_index, typeref_table, n, typeref.TypeName)
+
         typeref_token: int = calculate_dotnet_token_value(dnfile.mdtable.TypeRef.number, rid)
         yield DnType(typeref_token, typeref.TypeName, namespace=typeref.TypeNamespace)
-
-
+
 def calculate_dotnet_token_value(table: int, rid: int) -> int:
     return ((table & 0xFF) << Token.TABLE_SHIFT) | (rid & Token.RID_MASK)
 

capa/features/extractors/dnfile/types.py

@@ -42,15 +42,19 @@ def __repr__(self):
         return str(self)
 
     @staticmethod
-    def format_name(class_: str, namespace: str = "", member: str = ""):
+    def format_name(class_: tuple, namespace: str = "", member: str = ""):
+        if type(class_) == tuple:
+            if len(class_) > 2:
+                class_ = class_[0] + "." + "/".join(class_[1:])
+            else:
+                class_ = f"{class_[0]}.{class_[1]}"
         # like File::OpenRead
         name: str = f"{class_}::{member}" if member else class_
         if namespace:
             # like System.IO.File::OpenRead
             name = f"{namespace}.{name}"
         return name
 
-
 class DnUnmanagedMethod:
     def __init__(self, token: int, module: str, method: str):
         self.token: int = token