DLL starting with DCD

Question

Today I was investigating an issue with a Microsoft DLL, mscordacwks.dll, which is part of the .NET framework. I've seen it many times before and it always was a regular PE file, meaning that it started with the magic MZ.

However, the file today starts with DCD in ASCII. I could only find a reference to ELF binaries that use DCD in the disassembled code. However, this is about DCD as the first three bytes of the file.

Here's the start of the DLL:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  44 43 44 01 38 01 EE 42 00 00 0A 00 50 41 33 30  DCD.8.îB....PA30
00000010  80 16 D7 D5 DE B1 9D 01 B0 4E 10 D0 C7 04 0C C4  €.×ÕÞ±..°N.ÐÇ..Ä
00000020  84 D6 08 01 42 01 04 00 88 FB 17 32 00 00 00 00  „Ö..B...ˆû.2....
00000030  00 00 08 7D DE D3 AA 02 A0 2C AA AA AA AA AA AA  ...}ÞÓª. ,ªªªªªª
00000040  AA AA AA AA AA 1A AA AA AA 1A AA AA AA AA A1 01  ªªªªª.ªªª.ªªªª¡.
00000050  20 D2 A1 AA AA AA AA AA AA AA AA AA 22 2A AA AA   Ò¡ªªªªªªªªª"*ªª
00000060  AA AA A1 8D 09 00 FF 3F 00 1C F4 3F 00 F0 FF 51  ªª¡...ÿ?..ô?.ðÿQ
00000070  00 F0 04 00 FF 01 74 50 66 80 88 D0 1A 00 68 68  .ð..ÿ.tPf€ˆÐ..hh
00000080  44 33 33 00 00 00 00 00 30 65 97 00 50 67 64 96  D33.....0e—.Pgd–
00000090  28 6E 66 90 71 23 8E E3 B8 26 E2 54 1A 62 12 23  (nf.q#Žã¸&âT.b.#
000000A0  12 8B C5 20 63 92 18 44 C4 71 1A 44 E2 C4 48 48  .‹Å c’.DÄq.DâÄHH
000000B0  1D CB 63 C7 6D EC 36 96 D8 21 26 91 10 93 88 EB  .ËcÇmì6–Ø!&‘.“ˆë
000000C0  9A C4 B1 3C 76 0C 2A 31 22 B5 E3 C4 24 4E 24 A4  šÄ±<v.*1"µãÄ$N$¤
000000D0  31 00 88 53 23 71 EC 38 91 39 76 10 93 D8 42 E2  1.ˆS#qì8‘9v.“ØBâ
000000E0  98 D4 6E 6A 22 69 52 8B 91 04 47 3E BC 36 2D CD  ˜Ônj"iR‹‘.G>¼6-Í
000000F0  E8 4A AB 6F 99 12 6D C3 B2 61 5E 86 8E 0E 43 A7  èJ«o™.mòa^†Ž.C§

Usually, these DLLs are ~1.7MB in size. However, this one is only 3kB. I found it in the folder C:\Windows\WinSxS\amd64_netfx-mscordacwks_b03f5f7f11d50a3a_10.0.17134.1_none_a06aa12b896d6ba9

What file format is that? And, if it's simple to answer, how is Windows able to load it?

I found more files of this kind with up to 51kB in size and it seems that the PA30 part is also common.

Some background information on why I'm working with the file: mscordacwks.dll is MS for Microsoft, COR for the .NET framework, DAC for data access control and WKS for workstation. When debugging a .NET application, it's that DLL that can give information about the memory layout of .NET objects etc. Usually it's used along with the SOS extension for WinDbg. Sometimes, developers have a wrong version of mscordacwks.dll, which makes SOS complain about the wrong version. So I was looking on my PC whether I could find a version that matches.

Answer 1

Looks like these files use a variation of the delta compression format (MSDelta) used previously for the Windows Update packages.

I found a project which claims to decompress such files:

Supported file types

• DCN v1
• DCM v1
• DCS v1
• DCD v1

Type descriptions

• Header Sign: 0x44 0x43 0x4E 0x01, DCN 01 (packed IPD PA30)
• Header Sign: 0x44 0x43 0x4D 0x01, DCM 01 (packed IPD PA30, source manifest required, wcp)
• Header Sign: 0x44 0x43 0x53 0x01, DCS 01 (packed LZMS, can have multiple blocks)
• Header Sign: 0x44 0x43 0x44 0x01, DCD 01 (packed IPD PA30, delta, source file required)
• Header Sign: 0x44 0x43 0x48 0x01, DCH 01 (not packed, header only)
• Header Sign: 0x44 0x43 0x58 0x01, DCX 01 (unknown, only supported by Windows 10)

...but could not get it working so far.

Answer 2

I just came across the same problem. I found the source DCN file in C:\Windows\WinSxS\Backup and using the mentioned tool I was able to get a dll. Afterwards I used the /d option with the DCD to get the changed dll.

Answer 3

These file are created using PatchAPI and MSDelta API: Link to MSDN article on subject