In my earlier post, I discussed how PEs in .NET can target different platforms and the subtle differences between them.
In this post, I’ll discuss how one can determine the platform (architecture) that a managed .NET PE targets.
For this, we’ll use a tool called CorFlags which come automatically installed with Visual Studio IDE. We’ll use the Visual Studio Developer Command Prompt to use this tool.
Syntax
CorFlags.exe assembly [options]
For more details on the options, refer to the MSDN link.
Now, based on the way in which the PE has been compiled, we can determine the platform affinity as follows:
| CPU Architecture | PE | 32BITREQ | 32BITPREF |
| x86(32-bit) | PE32 | 1 | 0 |
| x64(64-bit) | PE32+ | 0 | 0 |
| Any CPU | PE32 | 0 | 0 |
| Any CPU 32-bit preferred | PE32 | 0 | 1 |
The default case in Visual Studio IDE is Any CPU with 32-bit preferred.
Hence, if we run CorFlags tool in this case, we’ll get…
<code>E:\Dev\Projects\TestApp\TestApp\bin\Debug>corflags TestApp.exe
Microsoft (R) .NET Framework CorFlags Conversion Tool. Version 4.6.1055.0
Copyright (c) Microsoft Corporation. All rights reserved.
Version : v4.0.30319
CLR Header: 2.5
PE : PE32
CorFlags : 0x20003
ILONLY : 1
32BITREQ : 0
32BITPREF : 1
Signed : 0
</code>
As can be seen above, this is the case whereby the exe targets the default option of Any CPU with 32-bit preferred.
Similarly, as shown in the table, we can determine the platform affinity for other managed DLLs too.
Hope this was useful!
Abbreviations
PE: Process Executables (EXEs and DLLs)
References
The post Determine platform affinity 32 bit, 64 bit or Any CPU for a managed .NET PE appeared first on Sundeep Kamath's blog.
