Interpreting the CorFlags flags

Question

How do I interpret the CorFlags flags and how should I use it to determine if a .NET assembly was built for x86 or x64?

Could it be the following?

corflags MyAssembly.dll

Weinhardt

A canonical is How can I determine if a .NET assembly was built for x86 or x64? (contains information about CorFlags, its output, and interpretation), but it hasn't been updated to cover the new flags 32BITREQ and 32BITPREF (as this one has). – Shir

Answer 1

Open the Visual Studio Command Prompt (in Windows: menu Start → Programs → Microsoft Visual Studio → Visual Studio Tools → Visual Studio 2010 Command Prompt)

CD to the directory containing the DLL in question.

Run corflags like this:

corflags MyAssembly.dll

The output looks like this:

Microsoft (R) .NET Framework CorFlags Conversion Tool.  Version  4.0.30319.1

Copyright (c) Microsoft Corporation.  All rights reserved.

Version   : v4.0.30319
CLR Header: 2.5
PE        : PE32
CorFlags  : 1
ILONLY    : 1
32BIT     : 0
Signed    : 0

The flags' interpretation:

Any CPU: PE = PE32 and 32BIT = 0

x86: PE = PE32 and 32BIT = 1

64-bit: PE = PE32+ and 32BIT = 0

Passageway

The answer at https://mcmap.net/q/75679/-interpreting-the-corflags-flags is more up to date than this one. – Pesade

While technically corect for it's time.... the answer below for .NET 4.5 is more accurate/up to date. – Shoplifter

As "Any CPU" compilation, Corflags output is strange for me PE : PE32+ | 32BIT : 0. is this Possible ? – Twana

Answer 2

Microsoft .NET 4.5 introduced a new option, Any CPU 32-bit Preferred. In the new version of CorFlags.exe, the 32BIT flag no longer exists, instead, two new flags were added, 32BITREQ and 32BITPREF.

Somewhere based on the below explanation, we can interpret new CorFlags as follows.

CPU Architecture           PE      32BITREQ   32BITPREF
------------------------   -----   --------   ---------
x86 (32-bit)               PE32           1           0
x64 (64-bit)               PE32+          0           0
Any CPU                    PE32           0           0
Any CPU 32-Bit Preferred   PE32           0           1

Flags displayed by the CorFlags.exe located at C:\Program Files (x86)\Microsoft SDKs\Windows\v8.1A\bin\NETFX 4.5.1 Tools

Version   : Assembly's target framework.
Header    : 2.0/2.5 (Must have version of 2.5 or greater to run natively)
PE        : PE32 (32-bit)/PE32+ (64-bit)
CorFlags  : Hexadecimal value, computed based on below 4 flags.
ILONLY    : 1 if MSIL otherwise 0
32BITREQ  : 1 if 32-bit x86 only assembly otherwise 0
32BITPREF : 1 if 32-bit x86 only preferred in Any CPU architecture otherwise 0
Signed    : 1 if signed with strong name otherwise 0

The following example illustrates the output of C:\Program Files (x86)\Microsoft SDKs\Windows\v8.1A\bin\NETFX 4.5.1 Tools\CorFlags.exe for different assemblies.

PresentationCore.dll from GAC_32

CorFlags.exe "C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\PresentationCore.dll"

Version   : v4.0.30319
CLR Header: 2.5
PE        : PE32
CorFlags  : 0xb
ILONLY    : 1
32BITREQ  : 1
32BITPREF : 0
Signed    : 1

System.Data.dll from GAC_64

CorFlags.exe "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll"

Version   : v4.0.30319
CLR Header: 2.5
PE        : PE32+
CorFlags  : 0x18
ILONLY    : 0
32BITREQ  : 0
32BITPREF : 0
Signed    : 1

System.dll from GAC_MSIL

CorFlags.exe "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll"

Version   : v4.0.30319
CLR Header: 2.5
PE        : PE32
CorFlags  : 0x9
ILONLY    : 1
32BITREQ  : 0
32BITPREF : 0
Signed    : 1

To know more about Any CPU 32-bit Preferred assemblies refer What AnyCPU Really Means As Of .NET 4.5 and Visual Studio 11

Thickknee

Answer 3

To add more detail to the other answers, the actual important value is the hexadecimal CorFlags value since it carries the most information. Here's the list of bits that comprise it:

[Flags]
public enum CorFlags
{
    ILOnly           = 0x00000001,
    Requires32Bit    = 0x00000002,
    ILLibrary        = 0x00000004,
    StrongNameSigned = 0x00000008,
    NativeEntryPoint = 0x00000010,
    TrackDebugData   = 0x00010000,
    Prefers32Bit     = 0x00020000,
}

Corflags outputs the four bits of this value separately (ILONLY, 32BITREQ, 32BITPREF and Signed). However the full CorFlags value also contains information about whether the assembly is strong-name signed or delay signed (0x8 bit) as well as ILLibrary, NativeEntryPoint and TrackDebugData bits (I don't know what those mean).

Note that CorFlags output Signed is not exactly the StrongNameSigned bit. It will print Signed 1 if the assembly is either delay-signed or fully signed, whereas StrongNameSigned bit is set if the assembly is fully signed only.

Roommate

As far as I can tell, CorFlags.ILLibrary is set for the Native Images version of assemblies. – Grammer

Answer 4

You can also use this table:

     CPU    | PE    | 32BIT
  ----------|-------|------
  x86       | PE32  |  1   
  Any CPU   | PE32  |  0   
  x64       | PE32+ |  0   

Erdmann

Also in How to determine if a .NET assembly was built for x86 or x64? – Shir