{"record":{"id":"29237d988b56f45c","repo":"icsharpcode/ILSpy","slug":"invalid-metadata-token-for-ldtoken-instruction","errorCode":null,"errorMessage":"Invalid metadata token for ldtoken instruction.","messagePattern":"Invalid metadata token for ldtoken instruction\\.","errorType":"exception","errorClass":"BadImageFormatException","httpStatus":null,"severity":"error","filePath":"ICSharpCode.Decompiler/IL/ILReader.cs","lineNumber":2188,"sourceCode":"\t\t\t}\r\n\t\t\tforeach (var p in method.Parameters)\r\n\t\t\t{\r\n\t\t\t\tcall.Arguments.Add(Ldarg(call.Arguments.Count));\r\n\t\t\t}\r\n\t\t\treturn new Leave(mainContainer, call);\r\n\t\t}\r\n\r\n\t\tILInstruction LdToken(EntityHandle token)\r\n\t\t{\r\n\t\t\tif (token.Kind.IsTypeKind())\r\n\t\t\t\treturn new LdTypeToken(module.ResolveType(token, genericContext));\r\n\t\t\tif (token.Kind.IsMemberKind())\r\n\t\t\t{\r\n\t\t\t\tvar entity = module.ResolveEntity(token, genericContext);\r\n\t\t\t\tif (entity is IMember member)\r\n\t\t\t\t\treturn new LdMemberToken(member);\r\n\t\t\t}\r\n\t\t\tthrow new BadImageFormatException(\"Invalid metadata token for ldtoken instruction.\");\r\n\t\t}\r\n\t}\r\n}\r\n","sourceCodeStart":2170,"sourceCodeEnd":2192,"githubUrl":"https://github.com/icsharpcode/ILSpy/blob/60c08fcb74fcc183130f73c861ed35cf944d0bf1/ICSharpCode.Decompiler/IL/ILReader.cs#L2170-L2192","documentation":"BadImageFormatException thrown by LdToken when the ldtoken instruction's operand handle kind is neither a type kind nor a member kind. ldtoken accepts only type/m member tokens (TypeDefinition, MethodDefinition, FieldDefinition, and the reference/spec variants the resolver folds in); any other handle kind is invalid.","triggerScenarios":"An ldtoken operand whose token resolves to a handle that is neither type nor member (e.g. a StandaloneSignature, GenericParameter, or AssemblyReference token); corrupt or hand-edited IL.","commonSituations":"Obfuscated binaries that rewrite ldtoken operands; truncated/damaged metadata; IL produced by a faulty generator emitting the wrong table for the ldtoken operand.","solutions":["Catch BadImageFormatException around decompilation and report the method as unreadable.","Validate that the ldtoken operand's token table is TypeDef/MethodDef/FieldDef (or the permitted reference kinds) before decompiling when preprocessing.","Re-acquire an untampered copy of the assembly."],"exampleFix":"// before\nvar code = decompiler.DecompileTypeAsString(typeName);\n\n// after\ntry\n{\n    var code = decompiler.DecompileTypeAsString(typeName);\n}\ncatch (BadImageFormatException ex) when (ex.Message.Contains(\"ldtoken\"))\n{\n    logger.Warn($\"Invalid ldtoken operand in {typeName}: {ex.Message}\");\n}","handlingStrategy":"try-catch","validationCode":"void VerifyLdtokenTokens(string path)\n{\n    using var pe = new PEReader(File.OpenRead(path));\n    var md = pe.GetMetadataReader();\n    // ldtoken operands must be TypeDef(0x02)/MethodDef(0x06)/FieldDef(0x04) (+ ref/spec); flag others\n}","typeGuard":null,"tryCatchPattern":"try { var code = decompiler.DecompileTypeAsString(typeName); }\ncatch (BadImageFormatException ex) when (ex.Message.Contains(\"ldtoken\")) { logger.Warn($\"Invalid ldtoken operand: {ex.Message}\"); }","preventionTips":["Catch BadImageFormatException and report the method as unreadable.","When preprocessing, validate ldtoken operands resolve to a type or member handle.","Use a clean, untampered assembly when one is available."],"tags":["il-reader","metadata-token","ldtoken","bad-image"],"backgroundTag":null,"analyzedSha":"60c08fcb74fcc183130f73c861ed35cf944d0bf1","analyzedAt":"2026-08-13T11:34:51.223Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}