Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How can I detect the type of a dll? (COM, .NET, WIN32)

Tags:

.net

file

dll

com

I need to process a number of dll's and exe files in a folder and determine what type of file I am dealing with: .NET, COM, Win32 or some other alien life form.

I've been trying to determine the easiest way to detect the type of a DLL, what do you think of this:

  1. COM dll => I do a LoadLibrary, then GetProcAddress for "DllRegisterServer". If I get a valid return, it's a COM file.

  2. .NET dll => If the dll depends on MSCOREE.DLL it's always a .NET dll?

  3. Win32 dll => If both the above tests fail, it's a Win32 dll?

Surely there must be a better way to detect what type of dll we are dealing with. The above is very clunky, and won't work for EXE files? There must be some other way that I am not thinking of.

Ideally I'd like to be able to make the parser determine what compiler the file was compiled with, and what features it uses such as MFC, Atl, Stl etc... But I doubt that's possible in the pre-reflection era?

like image 991
Stein Åsmul Avatar asked Sep 14 '09 10:09

Stein Åsmul


People also ask

How do I identify a DLL?

You can list function names for a specific DLL, such as user32. dll, by running a variety of command-line tools. For example, you can use dumpbin /exports user32. dll or link /dump /exports user32.

How can I tell if a DLL is 32 bit?

Launch depends.exe, go to File, click Open... and open the desired DLL file. In the Module section find the Module with the name of the DLL that you opened. The CPU column tells if the file was compiled for 32 bits or 64 bits.

How do I find the path of a DLL?

If the DLL is listed in the Windows registry in the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\KnownDLLs key, Windows searches for the DLL in the following locations in order: The %SystemRoot%\SYSTEM32 directory. The .exe file directory. The current directory.

What is the difference between exe and DLL in C#?

EXE is an extension used for executable files while DLL is the extension for a dynamic link library. 2.An EXE file can be run independently while a DLL is used by other applications. 3. A DLL file can be reused by other applications while an EXE cannot.


2 Answers

You must check the PE Header of these files. All DLL and executables, Win32 and .NET, have a PE header.

An In-Depth Look into the Win32 Portable Executable File Format

The .NET File Format

Portable Executable

like image 160
RRUZ Avatar answered Sep 30 '22 07:09

RRUZ


DllRegisterServer is not required, the only required export for a COM dll is DllGetClassObject

like image 22
Anders Avatar answered Sep 30 '22 05:09

Anders