How to know if a ".exe" process was written with C++ or C#?

Question

Possible Duplicate:
How do I tell if a win32 application uses the .NET runtime

There is a way to manually recognize if a specific ".exe" process was written with C++(unmanaged code) or with C#(managed code)?

I can already say that there is a way, since Process Explorer does that. Now we have to find how :p — Kevin Gosse, Dec 08 '11 at 15:14
Try hitting the exe with [Reflector][1] to see what turns up. [1]: http://stackoverflow.com/questions/214764/best-free-decompiler-for-c-sharp-with-vs-integration — , Dec 08 '11 at 15:15
Note that programs written in VB.NET generate the same "type" of executable as those written in C#, and you can only guess what was used to create the unmanaged application. As the others mentioned, you can distinguish unmanaged from managed code. — C.Evenhuis, Dec 08 '11 at 15:16
Are you looking to do this programmatically or as a manual operation? — Lynn Crumbling, Dec 08 '11 at 15:17
I don't know, so this is not an answer. Is it possible to check the dependancies? I would guess if there are .NET runtime dependancies, then it must be C#? — John Dibling, Dec 08 '11 at 15:19
Duplicate of [How do I tell if a win32 application uses the .NET runtime](http://stackoverflow.com/questions/751254/how-do-i-tell-if-a-win32-application-uses-the-net-runtime), [How to check if program is using .net](http://stackoverflow.com/questions/2080046/how-to-check-if-a-program-is-using-net), [How do I determine if a process is managed](http://stackoverflow.com/questions/4997987/how-do-i-determine-if-a-process-is-managed-in-c), [Identifying a process or module as managed/native](http://stackoverflow.com/questions/7880606/identifying-a-process-or-a-module-as-managed-native) — BlueRaja - Danny Pflughoeft, Dec 08 '11 at 16:53

score 9 · Accepted Answer · edited May 23 '17 at 11:47

9

If you're trying to determine if a process is a .NET process, I can suggest a solution inspired from Dave Van den Eynde's answer in this topic: How do I tell if a win32 application uses the .NET runtime

"An application is a .NET executable if it requires mscoree.dll to run.".

Given that, you check the process' modules to see if mscoree is listed.

        foreach (var process in Process.GetProcesses())
        {
            if (process.Modules.OfType<ProcessModule>().Any(m => m.ModuleName.Equals("mscoree.dll", StringComparison.OrdinalIgnoreCase)))
            {
                Console.WriteLine("{0} is a .NET process", process.ProcessName);
            }
        }

edited May 23 '17 at 11:47

Community

1
1

answered Dec 08 '11 at 15:22

Kevin Gosse

38,392
3
78
94

Does "mscoree.dll" is the main dll resource of a C# managed code binnary? Can I trust that there is no C++ binary that uses the same dll? – Diogo Dec 08 '11 at 19:23
It is not a managed library, but everything in this dll is related to the .NET Framework. It does not guarantee that the process is a pure .NET application, but at the very least it's hosting some .NET code. For instance, if you load a .NET add-in in Microsoft Word, this dll will appear in the modules, even though Word isn't a .NET application by itself. – Kevin Gosse Dec 08 '11 at 20:09
1

Why a console app written in C# doesn't show as a managed app when using this way to check? – dragonfly02 Feb 24 '17 at 10:05
While this is a good answer but comparing string using `==` can be misleading because some process module name is `MSCOREE.DLL`. Changing `==` to `m.ModuleName.Equals("mscoree.dll", StringComparison.InvariantCultureIgnoreCase)` is a safer choice. – dragonfly02 Feb 27 '17 at 11:19
your example code it self is .Net c# and is using mscoree.dll, also if it is using COM that is written in .Net will also load mscoree.dll, etc... Only way I see is to examine process image and check if PE IMAGE HEADER and has IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR descriptor set. see answer from HABJAN – SoLaR Oct 25 '18 at 22:13

score 5 · Answer 2 · answered Dec 08 '11 at 15:18

5

Here you can find details how it can be done: Determining Whether a DLL or EXE Is a Managed Component

answered Dec 08 '11 at 15:18

HABJAN

9,212
3
35
59

Link describes proper way – SoLaR Oct 25 '18 at 22:13

score 2 · Answer 3 · answered Dec 08 '11 at 15:14

You can run peverify or ildasm (available from the Visual Studio Command Line environment) on the file and it will give you an error if it's not managed code. Note that this will fail in some cases where they use a protection system that encrypts the IL and hides the CLR bootloader, but most programs don't have this protection.

score 1 · Answer 4 · answered Dec 08 '11 at 15:29

If it's a .NET .exe (or .dll for that matter), it will have a dependency on mscoree.dll which you can see by examining it with Dependency Walker or something similar.

If you want to do so programatically, you could take this VB project as a starting point.

This won't tell you the language for sure though. You can't tell a C# from a VB.NET (or other .NET language) program or a C++ from a C program (or other non .NET language). There are some things that can rule one or the other out as being the only language used, or make one or the other more likely. There could even be unmanaged code making use of mscoree.dll in some weird way.

How to know if a ".exe" process was written with C++ or C#?

4 Answers4