Metadata contains five sections that are similar to the PE file sections, but they are called streams. The streams' names start with # and are as follows:
- #~: This stream contains all the tables that store information about classes, namespaces (classes containers), events, methods, attributes, and so on. Each table has a unique ID (for example, the Methods table has an ID of 0x6).
- #Strings: This stream includes all the strings that are used in the #~ section. This includes the methods' names, classes' names, and so on. The structure of this stream is the following: each item starts with its length, followed by the string, and then the next item length followed by the string, and so on.
- #US: This stream is similar to the #Strings stream, but it contains the strings that are used by the application itself, like in the following screenshot (with the same structure of item length followed by the string):
Figure 4: #US unicode string started with the length...