[SOLVED] What kind of format does custom attribute blobs(strings) use?

What kind of format does custom attribute blobs(strings) use?

So, I'm trying to figure out exactly how custom attributes with blobs work. The binary format seems very... odd.

Example from ildasm

.custom instance void [mscorlib]System.Runtime.Versioning.TargetFrameworkAttribute::.ctor(string) = 
       ( 01 00 19 57 69 6E 64 6F 77 73 50 68 6F 6E 65 2C   // ...WindowsPhone,
        56 65 72 73 69 6F 6E 3D 76 38 2E 30 01 00 54 0E   // Version=v8.0..T.
        14 46 72 61 6D 65 77 6F 72 6B 44 69 73 70 6C 61   // .FrameworkDispla
        79 4E 61 6D 65 11 57 69 6E 64 6F 77 73 20 50 68   // yName.Windows Ph
        6F 6E 65 20 38 2E 30 )                            // one 8.0

What kind of format is this in? I can't quite tell if this is true UTF-8 and why are the first two bytes 0x01 and 0x00? Also, a decompiler will pick pick this up as the attribute:

[assembly: TargetFramework("WindowsPhone,Version=v8.0", FrameworkDisplayName = "Windows Phone 8.0")]

How exactly does all of this work?

Solution

The format of this is laid out in the ECMA Common Language Infrastructure standard, specifically section II.22.10 titled "CustomAttribute : 0x0C" (page 216).

It starts the "This contains informative text only" section with:

All binary values are stored in little-endian format...

And continues in point 6 with:

The following rules apply to the overall structure of the Value 'blob' (§II.23.3):

Prolog shall be 0x0001 [ERROR]

This is why you see the first bytes of [ 0x01, 0x00 ].

The rest of the text goes on to specify how the rest is laid out, but it's all in the spec.

There's also an in-depth analysis which shows how it's represented in the CLR and how that impacts the storage of the attribute blob.