How To: View The Header of an EXE/DLL

  • Article

Syed Aslam Basha here. I am a tester on the Information Security Tools Team.

At times we may want to know the target platform (i.e. x86 or x64) of an EXE/DLL. Visual studio provides a corflags.exe tool to identify the target platform.

  • Launch visual Studio command prompt in admin mode

  • Type CorFlags Assembly File Path and press enter

  • Example

    C:\Windows\system32>corflags "C:\Program Files\Microsoft Information Security\Microsoft Code Analysis Tool for .NET (CAT.NET) v2.0\FxCopCmd.exe"
    Microsoft (R) .NET Framework CorFlags Conversion Tool.  Version  3.5.21022.8
    Copyright (c) Microsoft Corporation.  All rights reserved.

    Version      : v4.0.21008
    CLR Header: 2.5
    PE              : PE32
    CorFlags     : 3
    ILONLY       : 1
    32BIT         : 1
    Signed       : 1

  • The PE and 32BIT flags gives details about type of the assembly;
    Any CPU : PE = PE32 and 32BIT = 0
    x86         : PE = PE32 and 32BIT = 1
    x64         : PE = PE32+ and 32BIT = 0

-Syed Aslam Basha ( syedab@microsoft.com )

Microsoft Information Security Tools (IST) Team

Test Lead