Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
How can I quickly tell if a EXE or DLL I have is managed code or not?
I spent some time recently trying to disassemble a file and then later learned through some traces in the code that I could have skipped all that work and just used ILspy. How can I avoid repeating that experience in the future?
A managed DLL / Application will have a primary dependency on MSCOREE.dll... So, if you open the DLL in Dependency Walker you have no problems in telling a managed library from an unmanaged one.
http://www.dependencywalker.com/
Quoted from here.
Other useful MSDN links:
Check the dword at offset 0xE8 (32-bit) or 0xF8 (64-bit) in the PE header. If it's non-zero, it's the pointer to the CLR header. That's a managed file (you can't put random data there because direct .NET parsing support is built into XP and later, so the file won't load if the data aren't valid). The presence of mscoree.dll is not enough in itself, because the application might be doing things with managed files but not be managed itself.
Checking DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].VirtualAddress in the data directory portion of the PE header for a nonzero value is probably the fastest way.
#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14 // COM Runtime descriptor
References:
Manually, i prefer to observe the following signs in the PE header:
1- Presence of mscoree!_CorExeMain in the import table.
2- VirtualAddress and Size of the CLR Header/*Com Descriptor* data directory are set. Size set to 0x48.
3- Size of the Base Relocation data directory set to 0x0C i.e. Only one fixup.
Also, one minor sign is:
4- SectionAlignment set to 0x2000.
Try opening it in ILSpy first. It should tell you if the assembly isn't managed.
The fastest heuristic method I found so far was to check whether it imports mscoree.dll.
In the version resource of mscoree.dll Microsoft calls it: Microsoft .NET Runtime Execution Engine.
mscoree.dll could be linked by any compiler (just create a C++ prj) without it becoming a CLR binary.The inverse is also true, some .NET binaries do not have a link to mscoree.dll. And apparently, it may be mscoreei.dll in some cases. I'm not sure about reference assemblies. I'd rely on PE headers, which will give you the .NET version info and CLR.
procexp64.exe, which has a reference to mscoree.dll but is not a CLI assembly. Everything else follows the rule "if it has mscoree.dll, then it is .NET".
In addition to peter ferries answer, some python code to check for the same:
import sys
def unpack(byte):
return sum([
ord(b) << (8 * i) for i, b in enumerate(byte)
])
if len(sys.argv) == 1:
print >> sys.stderr, "No input file given!"
else:
myfile = sys.argv[1]
with open(myfile, "r") as f:
f.seek(0x3c)
peoffset = unpack(f.read(2))
optoffset = peoffset + 24
f.seek(optoffset)
magic = f.read(2)
offset = -1
if magic == '\x0b\x01':
offset = 208 + optoffset
else:
offset = 224 + optoffset
f.seek(offset)
clr_address = unpack(f.read(4))
if clr_address == 0:
print "no managed executable"
else:
print "managed executable"
CorFlags.exe is a utility that ships with the Windows SDK. Execute that passing in the name of the file in question and if it is a managed file it will tell you what version of the Dotnet framework it uses and whether the file is all managed code or mixed mode, whether it is signed, and a few other useful bits of info.
