3

How to differentiate between .NET DLL and C++ dll without looking at the code. Can we identify it by looking at the export table or other section of DLL after looking into DLL from any PE file explorer?

Sergey K.
  • 24,894
  • 13
  • 106
  • 174
gaurav pawaskar
  • 65
  • 1
  • 1
  • 3
  • Try and call the .dll using reflection (.NET) if exceptions are thrown (catch them) then it is most likely C++ (if these are your only two possibilities). Then try PInvoke and the C++ methodology. – MoonKnight May 17 '12 at 11:22
  • Your definition is lacking, a .NET assembly can contain native C++ code. – Hans Passant May 17 '12 at 12:16

2 Answers2

1

You might be able to use corflags

For a .NET c# DLL I get

Microsoft (R) .NET Framework CorFlags Conversion Tool. Version 4.0.30319.1 Copyright (c) Microsoft Corporation. All rights reserved.

Version : v4.0.30319 CLR Header: 2.5 PE : PE32 CorFlags : 1 ILONLY : 1 32BIT : 0 Signed : 0

For a C++ DLL I get

corflags : error CF008 : The specified file does not have a valid managed header

**** UPDATE ****

I might have misunderstood the question. This is a good SO question on a similar problem. How can I test a Windows DLL file to determine if it is 32 bit or 64 bit?

Community
  • 1
  • 1
Mike Miller
  • 16,195
  • 1
  • 20
  • 27
0

As a matter of fact, this is clearly indicated by looking at the Image file and is documented by the Portable Executable format specification. Should the Directory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR] be present (not EMPTY), the image is Managed (.NET) otherwise the image is unmanaged.

mox
  • 6,084
  • 2
  • 23
  • 35
  • You can also take a look at the import libraries table, since .NET image only import mscoree.dll – mox Jul 02 '12 at 15:57
  • The fact that the image is NOT managed, does not yet tell you that it has been built using C++.This is another story. This can be detected using other fields of the PE headers... – mox Jul 02 '12 at 15:59