Sunday, January 31, 2010

How To: View The Header of an EXE/DLL

At times we may want to know the target platform (i.e. x86 or x64) of an EXE/DLL. Visual studio provides a corflags.exe tool to identify the target platform.

    * Launch visual Studio command prompt in admin mode
    * Type CorFlags Assembly File Path and press enter
    * Example

      C:\Windows\system32>corflags "C:\Program Files\Microsoft Information Security\Microsoft Code Analysis Tool for .NET (CAT.NET) v2.0\FxCopCmd.exe"
      Microsoft (R) .NET Framework CorFlags Conversion Tool.  Version  3.5.21022.8
      Copyright (c) Microsoft Corporation.  All rights reserved.

      Version      : v4.0.21008
      CLR Header: 2.5
      PE              : PE32
      CorFlags     : 3
      ILONLY       : 1
      32BIT         : 1
      Signed       : 1
    * The PE and 32BIT flags gives details about type of the assembly;
      Any CPU : PE = PE32 and 32BIT = 0
      x86         : PE = PE32 and 32BIT = 1
      x64         : PE = PE32+ and 32BIT = 0

Read more: MS Information Security Team