How does Windows differentiate between a regular EXE and a .NET exe?

Question

I was asked in an interview as to how Windows OS differentiate between a regular EXE and a .NET EXE.

My reply was, when a .NET exe is build, the compiler puts some information into the header. The information is PE32 or PE32+. Windows verifies the header to determine if it needs to load MSCOREE.dll which loads the CLR and executes the EXE.

Is my answer correct?

Answer 1

I think that the following two links are a good resource to get an understanding the PE file structure and the Windows loader.

• An In-Depth Look into the Win32 Portable Executable File Format (MSDN Mag Feb 2002)
• An In-Depth Look into the Win32 Portable Executable File Format, Part 2 (MSDN Mag Mar 2002)

The exact quote from the March 2002 article, which I believe answers your question, is:

The primary purpose of a .NET executable is to get the .NET-specific information such as metadata and intermediate language (IL) into memory. In addition, a .NET executable links against MSCOREE.DLL. This DLL is the starting point for a .NET process. When a .NET executable loads, its entry point is usually a tiny stub of code. That stub just jumps to an exported function in MSCOREE.DLL (_CorExeMain or _CorDllMain). From there, MSCOREE takes charge, and starts using the metadata and IL from the executable file. This setup is similar to the way apps in Visual Basic (prior to .NET) used MSVBVM60.DLL.