Greetings,
It seems the script incorrectly labels "AnyCPU (MSIL)" .NET binaries as "i386" when in fact they are "AnyCPU (MSIL)".
Example:
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools> ./corflags.exe "C:\Users\aschwarz\Desktop\notes\<REDACTED>\<REDACTED>.dll"
Microsoft (R) .NET Framework CorFlags Conversion Tool. Version 4.8.3928.0 Copyright (c) Microsoft Corporation. All rights reserved. Version : v4.0.30319
CLR Header: 2.5
PE : PE32
CorFlags : 0x1
ILONLY : 1
32BITREQ : 0
32BITPREF : 0
Signed : 0
And when using "Get-PESecurity.psm1" on the file, it returns that it's i386, which is not accurate. A PE32 PE format in the header does not imply that it's a "32-bit only" assembly.
Important:
ILONLY: 1 -> only contains MSIL (no native machine code)
32BITREQ : 0 -> Not restricted to run in 32-bit mode
32BITPREF: 0 -> Does not prefer 32-bit, uses 64-bit when possible
Thus, if a 64-bit CLR hosts the assembly/DLL, the JIT system will use 64-bit, despite the PE header showing the assembly as i386/32-bit.
Recommendation: When a CLR header is present, inspect the CorFlags in the CLR header instead of relying solely on the PE header for each .NET binary and check the CorFlags header fields under the "Important" note above. I could modify the script to make these changes if approved by the repo owner/author.
Thank you
-Alex
Greetings,
It seems the script incorrectly labels "AnyCPU (MSIL)" .NET binaries as "i386" when in fact they are "AnyCPU (MSIL)".
Example:
And when using "Get-PESecurity.psm1" on the file, it returns that it's i386, which is not accurate. A PE32 PE format in the header does not imply that it's a "32-bit only" assembly.
Important:
ILONLY: 1 -> only contains MSIL (no native machine code)
32BITREQ : 0 -> Not restricted to run in 32-bit mode
32BITPREF: 0 -> Does not prefer 32-bit, uses 64-bit when possible
Thus, if a 64-bit CLR hosts the assembly/DLL, the JIT system will use 64-bit, despite the PE header showing the assembly as i386/32-bit.
Recommendation: When a CLR header is present, inspect the CorFlags in the CLR header instead of relying solely on the PE header for each .NET binary and check the CorFlags header fields under the "Important" note above. I could modify the script to make these changes if approved by the repo owner/author.
Thank you
-Alex