How Windows CRT Checks For Managed Module
While debugging an issue I came across an interesting piece of code in Windows CRT source. So far I have been using the code below to determine if an executable is managed or native. Basically I am just checking for the presence of IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR Data Directory entry in PE headers.
int CheckCLRHeader(PBYTE pbFile) { PIMAGE_DOS_HEADER pDOSHeader; PIMAGE_NT_HEADERS pNTHeader; PIMAGE_OPTIONAL_HEADER32 pNTHeader32; PIMAGE_OPTIONAL_HEADER64 pNTHeader64; PIMAGE_DATA_DIRECTORY pDataDirectory; if(NULL == pbFile) { cout << "Invalid file" << endl; return 0; } pDOSHeader = reinterpret_cast < PIMAGE_DOS_HEADER >(pbFile); if(IMAGE_DOS_SIGNATURE != pDOSHeader->e_magic) { cout << "Cannot find DOS header. Not an executable file" << endl; return 0; } pNTHeader = ImageNtHeader(pbFile); if(NULL == pNTHeader) { cout << "Cannot find PE header. Invalid or corrupt file" << endl; return 0; } if(IMAGE_NT_SIGNATURE != pNTHeader->Signature) { cout << "Cannot fine PE signature. Invalid or corrupt file" << endl; return 0; } switch(pNTHeader->OptionalHeader.Magic) { case IMAGE_NT_OPTIONAL_HDR32_MAGIC: pNTHeader32 = reinterpret_cast < PIMAGE_OPTIONAL_HEADER32 >(&pNTHeader->OptionalHeader); if(pNTHeader32->NumberOfRvaAndSizes <= IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR) { cout << "No CLR Data Dictionary. Not a Managed Assembly" << endl; return 0; } pDataDirectory = pNTHeader32->DataDirectory; break; case IMAGE_NT_OPTIONAL_HDR64_MAGIC: pNTHeader64 = reinterpret_cast < PIMAGE_OPTIONAL_HEADER64 >(&pNTHeader->OptionalHeader); if(pNTHeader64->NumberOfRvaAndSizes <= IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR) { cout << "No CLR Data Dictionary. Not a Managed Assembly" << endl; return 0; } pDataDirectory = pNTHeader64->DataDirectory; break; default: cout << "Invalid NT header. Invalid or corrupt file" << endl; return 0; } if(NULL == pDataDirectory) { cout << "Cannot find data directories. Invalid or corrupt file" << endl; return 0; } if(0 == pDataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].VirtualAddress || 0 == pDataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].Size) { cout << "COM Data Directory not found. Not a Managed Assembly" << endl; return 0; } cout << "Managed Assembly" << endl; return 1; }
The code for check_managed_app function in crtexe.c is similar but slightly different in how it checks for the same IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR but only checks for presence of VirtualAddress.
/*** *check_managed_app() - Check for a managed executable * *Purpose: * Determine if the EXE the startup code is linked into is a managed app * by looking for the COM Runtime Descriptor in the Image Data Directory * of the PE or PE+ header. * *Entry: * None * *Exit: * 1 if managed app, 0 if not. * *Exceptions: * *******************************************************************************/ static int __cdecl check_managed_app ( void ) { PIMAGE_DOS_HEADER pDOSHeader; PIMAGE_NT_HEADERS pPEHeader; PIMAGE_OPTIONAL_HEADER32 pNTHeader32; PIMAGE_OPTIONAL_HEADER64 pNTHeader64; pDOSHeader = (PIMAGE_DOS_HEADER)&__ImageBase; if ( pDOSHeader->e_magic != IMAGE_DOS_SIGNATURE ) return 0; pPEHeader = (PIMAGE_NT_HEADERS)((char *)pDOSHeader + pDOSHeader->e_lfanew); if ( pPEHeader->Signature != IMAGE_NT_SIGNATURE ) return 0; pNTHeader32 = (PIMAGE_OPTIONAL_HEADER32)&pPEHeader->OptionalHeader; switch ( pNTHeader32->Magic ) { case IMAGE_NT_OPTIONAL_HDR32_MAGIC: /* PE header */ /* prefast assumes we are overflowing __ImageBase */ #pragma warning(push) #pragma warning(disable:26000) if ( pNTHeader32->NumberOfRvaAndSizes <= IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR ) return 0; #pragma warning(pop) return !! pNTHeader32 -> DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR] . VirtualAddress; case IMAGE_NT_OPTIONAL_HDR64_MAGIC: /* PE+ header */ pNTHeader64 = (PIMAGE_OPTIONAL_HEADER64)pNTHeader32; if ( pNTHeader64->NumberOfRvaAndSizes <= IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR ) return 0; return !! pNTHeader64 -> DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR] . VirtualAddress; } /* Not PE or PE+, so not managed */ return 0; }
I came across this code while debugging past the main() function. I thought this might be a new piece of code in CRT source that comes with VS2008 only to be proven wrong when searching through the CRT source that comes with all versions of Visual Studio starting from VS2002. Another interesting discovery (at least for me) is that similar code is in various CRT source files. In VS2008 CRT source the files crt0dat.c, crt0.c and crtexe.c contain check_managed_app function in Win32 CRT and crt0dat.c in WinCE CRT. In VS2005 the same function is in crt0.c, crt0dat.c and crtexe.c. In VS2003 and VS2002 it is in crt0.c and crtexe.c. There are other gems of code in CRT source waiting to be discovered!
