Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to interpret the CorFlags flags?

Tags:

corflags

People also ask

What is Corflags?

Corflags is the inbuilt tool of Visual Studio which can be used to find out the type of .dll i.e 32 bit, 64 bit or any CPU in .Net application . This tool is available in Visual studio 2005 onward.

Where is Corflags installed?

It could also be under the x86 folder if the 32bit Windows SDK installer used: C:\Program Files (x86)\Microsoft SDKs\Windows .

How do I get Corflags EXE?

Download and install the latest “. NET Framework Developer Pack" from the following link: https://dotnet.microsoft.com/download/visual-studio-sdks. Once installed, search the PC for the corflags.exe file. Navigate to the corflags.exe file and open a command prompt window.


Microsoft .NET 4.5 introduced a new option, Any CPU 32-bit Preferred. In the new version of CorFlags.exe, the 32BIT flag no longer exists, instead, two new flags were added, 32BITREQ and 32BITPREF.

Somewhere based on the below explanation, we can interpret new CorFlags as follows.

CPU Architecture           PE      32BITREQ   32BITPREF
------------------------   -----   --------   ---------
x86 (32-bit)               PE32           1           0
x64 (64-bit)               PE32+          0           0
Any CPU                    PE32           0           0
Any CPU 32-Bit Preferred   PE32           0           1

Flags displayed by the CorFlags.exe located at C:\Program Files (x86)\Microsoft SDKs\Windows\v8.1A\bin\NETFX 4.5.1 Tools

Version   : Assembly's target framework.
Header    : 2.0/2.5 (Must have version of 2.5 or greater to run natively)
PE        : PE32 (32-bit)/PE32+ (64-bit)
CorFlags  : Hexadecimal value, computed based on below 4 flags.
ILONLY    : 1 if MSIL otherwise 0
32BITREQ  : 1 if 32-bit x86 only assembly otherwise 0
32BITPREF : 1 if 32-bit x86 only preferred in Any CPU architecture otherwise 0
Signed    : 1 if signed with strong name otherwise 0

The following example illustrates the output of C:\Program Files (x86)\Microsoft SDKs\Windows\v8.1A\bin\NETFX 4.5.1 Tools\CorFlags.exe for different assemblies.

PresentationCore.dll from GAC_32

CorFlags.exe "C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\PresentationCore.dll"

Version   : v4.0.30319
CLR Header: 2.5
PE        : PE32
CorFlags  : 0xb
ILONLY    : 1
32BITREQ  : 1
32BITPREF : 0
Signed    : 1

System.Data.dll from GAC_64

CorFlags.exe "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll"

Version   : v4.0.30319
CLR Header: 2.5
PE        : PE32+
CorFlags  : 0x18
ILONLY    : 0
32BITREQ  : 0
32BITPREF : 0
Signed    : 1

System.dll from GAC_MSIL

CorFlags.exe "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll"

Version   : v4.0.30319
CLR Header: 2.5
PE        : PE32
CorFlags  : 0x9
ILONLY    : 1
32BITREQ  : 0
32BITPREF : 0
Signed    : 1

To know more about Any CPU 32-bit Preferred assemblies refer What AnyCPU Really Means As Of .NET 4.5 and Visual Studio 11


Open the Visual Studio Command Prompt (In Windows: menu Start/Programs/Microsoft Visual
Studio/Visual Studio Tools/Visual Studio 2010 Command Prompt)

CD to the directory containing the DLL in question

Run corflags like this:

corflags MyAssembly.dll 

The output looks like this:

Microsoft (R) .NET Framework CorFlags Conversion Tool.  Version  4.0.30319.1

Copyright (c) Microsoft Corporation.  All rights reserved.

Version   : v4.0.30319
CLR Header: 2.5
PE        : PE32
CorFlags  : 1
ILONLY    : 1
32BIT     : 0
Signed    : 0

The flags interpretation:

Any CPU: PE = PE32 and 32BIT = 0

x86: PE = PE32 and 32BIT = 1

64-bit: PE = PE32+ and 32BIT = 0

To add more detail to the other answers, the actual important value is the hexadecimal CorFlags value since it carries the most information. Here's the list of bits that comprise it:

[Flags]
public enum CorFlags
{
    ILOnly           = 0x00000001,
    Requires32Bit    = 0x00000002,
    ILLibrary        = 0x00000004,
    StrongNameSigned = 0x00000008,
    NativeEntryPoint = 0x00000010,
    TrackDebugData   = 0x00010000,
    Prefers32Bit     = 0x00020000,
}

Corflags outputs the four bits of this value separately (ILONLY, 32BITREQ, 32BITPREF and Signed). However the full CorFlags value also contains information about whether the assembly is strong-name signed or delay signed (0x8 bit) as well as ILLibrary, NativeEntryPoint and TrackDebugData bits (I don't know what those mean).

Note that CorFlags output Signed is not exactly the StrongNameSigned bit. It will print Signed 1 if the assembly is either delay-signed or fully signed, whereas StrongNameSigned bit is set if the assembly is fully signed only.


You can also use this table:

     CPU    | PE    | 32BIT
  ----------|-------|------
  x86       | PE32  |  1   
  Any CPU   | PE32  |  0   
  x64       | PE32+ |  0