How can I detect the type of a dll? (COM, .NET, WIN32)

Question

I need to process a number of dll's and exe files in a folder and determine what type of file I am dealing with: .NET, COM, Win32 or some other alien life form.

I've been trying to determine the easiest way to detect the type of a DLL, what do you think of this:

1. COM dll => I do a LoadLibrary, then GetProcAddress for "DllRegisterServer". If I get a valid return, it's a COM file.

2. .NET dll => If the dll depends on MSCOREE.DLL it's always a .NET dll?

3. Win32 dll => If both the above tests fail, it's a Win32 dll?

Surely there must be a better way to detect what type of dll we are dealing with. The above is very clunky, and won't work for EXE files? There must be some other way that I am not thinking of.

Ideally I'd like to be able to make the parser determine what compiler the file was compiled with, and what features it uses such as MFC, Atl, Stl etc... But I doubt that's possible in the pre-reflection era?

Answer 1

You must check the PE Header of these files. All DLL and executables, Win32 and .NET, have a PE header.

An In-Depth Look into the Win32 Portable Executable File Format

The .NET File Format

Portable Executable

Bye.

Answer 2

I don't see a better way of doing it. However, at 2., actually the answer is no. Runtime hosts will almost certainly also depend on mscoree.dll, and those are not necessarily .Net assemblies.

.Net dlls have a COM descriptor, which you can find using dumpbin. I don't know how to get this information from code.

If you are programming in .Net, one way of determining if the assembly is a .Net assembly is by trying to call Assembly.LoadFrom(...).

Well, this isn't a real answer, but a set of tips of things I'd look into.

Answer 3

DllRegisterServer is not required, the only required export for a COM dll is DllGetClassObject

Answer 4

you can use dumpbin.exe, which is part of the Windows Software Development Kit (SDK). You can also download peparser.dll from www.winitor.net/en/pestudio.html.