Determining if a file is managed code or not

Question

How can I quickly tell if a EXE or DLL I have is managed code or not?

I spent some time recently trying to disassemble a file and then later learned through some traces in the code that I could have skipped all that work and just used ILspy. How can I avoid repeating that experience in the future?

Answer 1

A managed DLL / Application will have a primary dependency on MSCOREE.dll... So, if you open the DLL in Dependency Walker you have no problems in telling a managed library from an unmanaged one.

    http://www.dependencywalker.com/

Quoted from here.

Other useful MSDN links:

• How to tell if a function is managed code?
• Exploring pe file headers using managed code

Answer 2

Check the dword at offset 0xE8 (32-bit) or 0xF8 (64-bit) in the PE header. If it's non-zero, it's the pointer to the CLR header. That's a managed file (you can't put random data there because direct .NET parsing support is built into XP and later, so the file won't load if the data aren't valid). The presence of mscoree.dll is not enough in itself, because the application might be doing things with managed files but not be managed itself.

Answer 3

Checking DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].VirtualAddress in the data directory portion of the PE header for a nonzero value is probably the fastest way.

#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14 // COM Runtime descriptor

References:

• IMAGE_DATA_DIRECTORY structure
• Anatomy of a .NET Assembly – PE Headers

Answer 4

Manually, i prefer to observe the following signs in the PE header:

1- Presence of mscoree!_CorExeMain in the import table.

2- VirtualAddress and Size of the CLR Header/*Com Descriptor* data directory are set. Size set to 0x48.

3- Size of the Base Relocation data directory set to 0x0C i.e. Only one fixup.

Also, one minor sign is:

4- SectionAlignment set to 0x2000.

Answer 5

Try opening it in ILSpy first. It should tell you if the assembly isn't managed.

Answer 6

In addition to peter ferries answer, some python code to check for the same:

import sys

def unpack(byte):
    return sum([
        ord(b) << (8 * i) for i, b in enumerate(byte)
    ])

if len(sys.argv) == 1:
    print >> sys.stderr, "No input file given!"
else:
    myfile = sys.argv[1]

    with open(myfile, "r") as f:
        f.seek(0x3c)
        peoffset = unpack(f.read(2))
        optoffset = peoffset + 24
        f.seek(optoffset)
        magic = f.read(2)
        offset = -1
        if magic == '\x0b\x01':
            offset = 208 + optoffset
        else:
            offset = 224 + optoffset
        f.seek(offset)
        clr_address = unpack(f.read(4))
        if clr_address == 0:
            print "no managed executable"
        else:
            print "managed executable"

Answer 7

The fastest heuristic method I found so far was to check whether it imports mscoree.dll.

In the version resource of mscoree.dll Microsoft calls it: Microsoft .NET Runtime Execution Engine.

Answer 8

CorFlags.exe is a utility that ships with the Windows SDK. Execute that passing in the name of the file in question and if it is a managed file it will tell you what version of the Dotnet framework it uses and whether the file is all managed code or mixed mode, whether it is signed, and a few other useful bits of info.

Answer 9

Cross-platform C# solution

Use PEReader.HasMetadata:

using System;
using System.Linq;
using System.IO;
using System.Reflection.PortableExecutable;

public class Program
{
    public static void Main()
    {
        Console.WriteLine(Environment.OSVersion);
        
        var currentAssemblyIsManaged = IsManaged(typeof(Program).Assembly.Location) ?? false;
        Console.WriteLine($"The currently executing assembly is {(currentAssemblyIsManaged ? "" : "not ")}managed");
        
        Console.WriteLine("Here are some unmanaged assemblies:");
        var unmanagedAssemblies = ((string)AppContext.GetData("TRUSTED_PLATFORM_ASSEMBLIES"))
            .Split(OperatingSystem.IsWindows() ? ';' : ':')
            .Select(path => Path.GetDirectoryName(path))
            .Distinct()
            .SelectMany(directory => Directory.GetFiles(directory))
            .Where(file => IsManaged(file) == false);
        foreach (var path in unmanagedAssemblies)
        {
            Console.Write('\t');
            Console.WriteLine(path);
        }
    }
    
    static bool? IsManaged(string path)
    {
        try
        {
            using var stream = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.Read);
            using var peReader = new PEReader(stream);
            return peReader.HasMetadata;
        }
        catch
        {
            // Probably not an assembly, but maybe the file is merely inaccessible at the moment?
            return null;
        }
    }
}

.NET Fiddle

Output from .NET Fiddle:

Unix 5.15.0.1024
The currently executing assembly is managed
Here are some unmanaged assemblies:
    /usr/share/dotnet/shared/Microsoft.NETCore.App/7.0.5/libmscordbi.so
    /usr/share/dotnet/shared/Microsoft.NETCore.App/7.0.5/libcoreclrtraceptprovider.so
    /usr/share/dotnet/shared/Microsoft.NETCore.App/7.0.5/libcoreclr.so
    /usr/share/dotnet/shared/Microsoft.NETCore.App/7.0.5/libmscordaccore.so
    /usr/share/dotnet/shared/Microsoft.NETCore.App/7.0.5/libSystem.IO.Compression.Native.so
    /usr/share/dotnet/shared/Microsoft.NETCore.App/7.0.5/libclrgc.so
    /usr/share/dotnet/shared/Microsoft.NETCore.App/7.0.5/libclrjit.so

Output on a Windows machine:

Microsoft Windows NT 10.0.22621.0
The currently executing assembly is managed
Here are some unmanaged assemblies:
        C:\Users\____\bin\Debug\net7.0\ConsoleApp22.exe
        C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.5\clretwrc.dll
        C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.5\clrgc.dll
        C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.5\clrjit.dll
        C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.5\coreclr.dll
        C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.5\createdump.exe
        C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.5\hostpolicy.dll
        C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.5\Microsoft.DiaSymReader.Native.amd64.dll
        C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.5\mscordaccore.dll
        C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.5\mscordaccore_amd64_amd64_7.0.523.17405.dll
        C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.5\mscordbi.dll
        C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.5\mscorrc.dll
        C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.5\msquic.dll
        C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.5\System.IO.Compression.Native.dll