How To: View header of EXE/DLL

  • Article

Syed Aslam Basha here from the Information Security Tools Team.

At times we may want to know the target platform (i.e. x86 or x64) of EXE/DLL. Visual studio provides corflags.exe tool to identify the target platform as;

    • Launch visual Studio command prompt in admin mode
    • Type CorFlags Assembly File Path and press enter
    • Example

C:\Windows\system32>corflags "C:\Program Files\Microsoft Information Security\Microsoft Code Analysis Tool for .NET (CAT.NET) v2.0\FxCopCmd.exe"
Microsoft (R) .NET Framework CorFlags Conversion Tool.  Version  3.5.21022.8
Copyright (c) Microsoft Corporation.  All rights reserved.

Version      : v4.0.21008
CLR Header: 2.5
PE              : PE32
CorFlags     : 3
ILONLY       : 1
32BIT         : 1
Signed       : 1

  • The PE and 32BIT flags gives details about type of the assembly;
    Any CPU : PE = PE32 and 32BIT = 0
    x86         : PE = PE32 and 32BIT = 1
    x64         : PE = PE32+ and 32BIT = 0

-Syed Aslam Basha ( syedab@microsoft.com )

Microsoft Information Security Tools (IST) Team

Test Lead

---------------------------------------------------------

Please leave a comment if the blog post has helped you.