Where can I find a reference for what every bit of the CorFlags value means?

Question

I'm messing around with some rather low level things and trying to determine why I get different outputs with the CorFlags.exe utility. For reference, the outputs are as so:

$ corflags test2.exe
Microsoft (R) .NET Framework CorFlags Conversion Tool.  Version  4.0.30319.17929
Copyright (c) Microsoft Corporation.  All rights reserved.

Version   : v4.0.30319
CLR Header: 2.5
PE        : PE32
CorFlags  : 0x1
ILONLY    : 1
32BITREQ  : 0
32BITPREF : 0
Signed    : 0

$ corflags test.exe
Microsoft (R) .NET Framework CorFlags Conversion Tool.  Version  4.0.30319.17929
Copyright (c) Microsoft Corporation.  All rights reserved.

Version   : v4.0.30319
CLR Header: 2.5
PE        : PE32
CorFlags  : 0x20003
ILONLY    : 1
32BITREQ  : 0
32BITPREF : 1
Signed    : 0

I'm trying to figure out what the other bits in the CorFlags value mean that aren't exposed in the CorFlags utility. Where is a reference for this?

Burundi

Out of curiosity, why is CorFlags important? – Closemouthed

@ErikPhilips well, it's how some things detect if an exe/dll is a mixed-mode or IL-only assembly. – Burundi

Two canonicals are How can I determine if a .NET assembly was built for x86 or x64? (contains information about CorFlags, its output, and interpretation) and Interpreting the CorFlags flags (has been updated for the new flags 32BITREQ and 32BITPREF). – Purge

Answer 1

You are actually seeing a blend of info from the PE32 header (PE field) and the header of the manifest embedded in the assembly (the rest). This is all described in the Windows SDK, you'll need version 8 to get the new 32BITPREF flag. Use C:\Program Files (x86)\Windows Kits\8.0\Include\um\CorHdr.h, lots of comments in this file that describe the declarations.

I'll copy the section that describes the IMAGE_COR20_HEADER.Flags values:

COMIMAGE_FLAGS_ILONLY               =0x00000001,
COMIMAGE_FLAGS_32BITREQUIRED        =0x00000002,
COMIMAGE_FLAGS_IL_LIBRARY           =0x00000004,
COMIMAGE_FLAGS_STRONGNAMESIGNED     =0x00000008,
COMIMAGE_FLAGS_NATIVE_ENTRYPOINT    =0x00000010,
COMIMAGE_FLAGS_TRACKDEBUGDATA       =0x00010000,
COMIMAGE_FLAGS_32BITPREFERRED       =0x00020000,

So a displayed value of 0x20003 breaks down into 32BITPREFERRED (0x20000) plus 32BITREQUIRED (0x00002) plus ILONLY (0x00001)

Gwyn

Wow, well that covers my questions. Why is this not documented somewhere other than some obscure header file though!? – Burundi

What makes you think it is obscure? It is in plain sight on any VS install and has been for many years. Look around some more, the SDK headers are a gold mine of info. – Gwyn

Answer 2

The flags interpretation:

Any CPU: PE = PE32 and 32BIT = 0

x86: PE = PE32 and 32BIT = 1

64-bit: PE = PE32+ and 32BIT = 0

Oversee

There's no 32BIT in his output. I think you mean 32BITREQ. – Paregoric

@Wes: You are correct. The answer is for an earlier version of CorFlags. It depends on the version of CorFlags - "32BIT" was replaced by "32BITREQ" and "32BITPREF". – Purge