The COR20 header starts after 8 bytes of the .text section and contains basic information about the .NET file, as you can see in the following screenshot:
Figure 2: CLR header (COR20 header) and CLR streams
The values of this structure are as follows:
- cb: Represents the size of the header (always 0x48)
- MajorRuntimeVersion and MinorRuntimeVersion: Always with values of 2 and 5 (even with runtime 4)
- Metadata address and size: Contains all the CLR streams, which will be described later
- EntryPointToken (or RVA): Represents the entry point and contains 2 values (0x6000012):
- 0x06: Represents the sixth table in the first stream, that is, Methods (we will talk about streams in detail later)
- 0x12 (18): Represents the method ID in the methods table, as you can see in the following screenshot:
Figure 3: The entry point method in the methods table in the first stream, #~
This header points to the metadata structure that contains all the information about classes, methods...