I am developing a C# program that will load files and get information such as loaded file created date, modification date, size etc. Another thing that I need to know is whether the loaded file (executable.exe
) is linked with the LARGEADDRESSAWARE
flag. The FileInfo class doesn't provide this information.
Does anyone know how in C# can I find out whether a given executable.exe is linked with the LARGEADDRESSAWARE
flag (to handle addresses larger than 2 GB)?
Open the "Visual Studio Command Prompt (2010)" console from the start menu, and CD into C:\Program Files\Microsoft Visual Studio 10.0\Common7\IDE (adjust for your own system if you have changed the installation directory or run 64-bit Windows).
Large Address Aware (LAA) is a technique available in 64-bit Windows operating systems to allow 32-bit programs use all 4Gb (typically 2Gb user + 2Gb system space) of its potential memory space, rather than be limited by the default (typically 2Gb, but sometimes 3Gb if using special techniques).
Here is some code that checks for the Large Address Aware flag. All you have to do is pass a stream that is pointed to the start of an executable.
IsLargeAware("some.exe");
static bool IsLargeAware(string file)
{
using (var fs = File.OpenRead(file))
{
return IsLargeAware(fs);
}
}
/// <summary>
/// Checks if the stream is a MZ header and if it is large address aware
/// </summary>
/// <param name="stream">Stream to check, make sure its at the start of the MZ header</param>
/// <exception cref=""></exception>
/// <returns></returns>
static bool IsLargeAware(Stream stream)
{
const int IMAGE_FILE_LARGE_ADDRESS_AWARE = 0x20;
var br = new BinaryReader(stream);
if (br.ReadInt16() != 0x5A4D) //No MZ Header
return false;
br.BaseStream.Position = 0x3C;
var peloc = br.ReadInt32(); //Get the PE header location.
br.BaseStream.Position = peloc;
if (br.ReadInt32() != 0x4550) //No PE header
return false;
br.BaseStream.Position += 0x12;
return (br.ReadInt16() & IMAGE_FILE_LARGE_ADDRESS_AWARE) == IMAGE_FILE_LARGE_ADDRESS_AWARE;
}
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With