69

How do I interpret the CorFlags flags and how should I use it to determine if a .NET assembly was built for x86 or x64?

Could it be the following?

corflags MyAssembly.dll
1

4 Answers 4

115

Microsoft .NET 4.5 introduced a new option, Any CPU 32-bit Preferred. In the new version of CorFlags.exe, the 32BIT flag no longer exists, instead, two new flags were added, 32BITREQ and 32BITPREF.

Somewhere based on the below explanation, we can interpret new CorFlags as follows.

CPU Architecture           PE      32BITREQ   32BITPREF
------------------------   -----   --------   ---------
x86 (32-bit)               PE32           1           0
x64 (64-bit)               PE32+          0           0
Any CPU                    PE32           0           0
Any CPU 32-Bit Preferred   PE32           0           1

Flags displayed by the CorFlags.exe located at C:\Program Files (x86)\Microsoft SDKs\Windows\v8.1A\bin\NETFX 4.5.1 Tools

Version   : Assembly's target framework.
Header    : 2.0/2.5 (Must have version of 2.5 or greater to run natively)
PE        : PE32 (32-bit)/PE32+ (64-bit)
CorFlags  : Hexadecimal value, computed based on below 4 flags.
ILONLY    : 1 if MSIL otherwise 0
32BITREQ  : 1 if 32-bit x86 only assembly otherwise 0
32BITPREF : 1 if 32-bit x86 only preferred in Any CPU architecture otherwise 0
Signed    : 1 if signed with strong name otherwise 0

The following example illustrates the output of C:\Program Files (x86)\Microsoft SDKs\Windows\v8.1A\bin\NETFX 4.5.1 Tools\CorFlags.exe for different assemblies.

PresentationCore.dll from GAC_32

CorFlags.exe "C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\PresentationCore.dll"

Version   : v4.0.30319
CLR Header: 2.5
PE        : PE32
CorFlags  : 0xb
ILONLY    : 1
32BITREQ  : 1
32BITPREF : 0
Signed    : 1

System.Data.dll from GAC_64

CorFlags.exe "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll"

Version   : v4.0.30319
CLR Header: 2.5
PE        : PE32+
CorFlags  : 0x18
ILONLY    : 0
32BITREQ  : 0
32BITPREF : 0
Signed    : 1

System.dll from GAC_MSIL

CorFlags.exe "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll"

Version   : v4.0.30319
CLR Header: 2.5
PE        : PE32
CorFlags  : 0x9
ILONLY    : 1
32BITREQ  : 0
32BITPREF : 0
Signed    : 1

To know more about Any CPU 32-bit Preferred assemblies refer What AnyCPU Really Means As Of .NET 4.5 and Visual Studio 11

0
36

Open the Visual Studio Command Prompt (in Windows: menu StartProgramsMicrosoft Visual StudioVisual Studio ToolsVisual Studio 2010 Command Prompt)

CD to the directory containing the DLL in question.

Run corflags like this:

corflags MyAssembly.dll

The output looks like this:

Microsoft (R) .NET Framework CorFlags Conversion Tool.  Version  4.0.30319.1

Copyright (c) Microsoft Corporation.  All rights reserved.

Version   : v4.0.30319
CLR Header: 2.5
PE        : PE32
CorFlags  : 1
ILONLY    : 1
32BIT     : 0
Signed    : 0

The flags' interpretation:

Any CPU: PE = PE32 and 32BIT = 0

x86: PE = PE32 and 32BIT = 1

64-bit: PE = PE32+ and 32BIT = 0
3
  • 12
    The answer at stackoverflow.com/a/23614024/3923734 is more up to date than this one.
    – user145400
    Apr 9, 2015 at 15:38
  • 4
    While technically corect for it's time.... the answer below for .NET 4.5 is more accurate/up to date.
    – John Rocha
    May 9, 2016 at 18:14
  • As "Any CPU" compilation, Corflags output is strange for me PE : PE32+ | 32BIT : 0. is this Possible ? Aug 8, 2017 at 12:20
10

To add more detail to the other answers, the actual important value is the hexadecimal CorFlags value since it carries the most information. Here's the list of bits that comprise it:

[Flags]
public enum CorFlags
{
    ILOnly           = 0x00000001,
    Requires32Bit    = 0x00000002,
    ILLibrary        = 0x00000004,
    StrongNameSigned = 0x00000008,
    NativeEntryPoint = 0x00000010,
    TrackDebugData   = 0x00010000,
    Prefers32Bit     = 0x00020000,
}

Corflags outputs the four bits of this value separately (ILONLY, 32BITREQ, 32BITPREF and Signed). However the full CorFlags value also contains information about whether the assembly is strong-name signed or delay signed (0x8 bit) as well as ILLibrary, NativeEntryPoint and TrackDebugData bits (I don't know what those mean).

Note that CorFlags output Signed is not exactly the StrongNameSigned bit. It will print Signed 1 if the assembly is either delay-signed or fully signed, whereas StrongNameSigned bit is set if the assembly is fully signed only.

1
  • As far as I can tell, CorFlags.ILLibrary is set for the Native Images version of assemblies.
    – Métoule
    Sep 17, 2015 at 13:01
7

You can also use this table:

     CPU    | PE    | 32BIT
  ----------|-------|------
  x86       | PE32  |  1   
  Any CPU   | PE32  |  0   
  x64       | PE32+ |  0   
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.