How do I find out if a .NET assembly contains unmanaged code?

Question

.NET assemblies that contain a mixture of managed and unmanaged code cannot be ILMerged with other assemblies.

How can I verify if a given .NET assembly contains purely managed code, or a mix of managed and unmanaged code?

Answer 1

I'll have to double check this but I am pretty sure you can find that out with Reflector by redgate.

Answer 2

ILMerge only merges managed assemblies, here, to quote from their download page, 'ILMerge is a utility for merging multiple .NET assemblies into a single .NET assembly'.

I have not seen an managed assembly merged with a native binary. Technically, you could have them merged per se, by including the unmanaged binary as a embedded resource, but the loading of the embedded resource into memory as a binary code - I have not seen this before. I have tried that technique using memory maps but failed.

The other way of checking is to look in the binary itself, if it has the 15th entry in the data directory, and is non-zero then it is a .NET binary, native binaries do not have this. See here where I posted this answer to a similar question.

Hope this helps, Best regards, Tom.

Answer 3

I think you should use .NET reflection to go through all types and methods in assembly.

Answer 4

Run ildasm from a Visual Studio Command Prompt as follows:

ildasm file.exe /headers /noil /text

Towards the end of the output you will see the following:

// ----- CLR Header:
// Header size: ...
// Major runtime version: ...
// Minor runtime version: ...
// ...
// Flags: 0x00000000

If Flags has the lowest bit set (e.g. 0x00000001) then the assembly is pure CLR; if not (e.g. 0x00000000) then the assembly is mixed mode. Note that other flags may be present, so it's only the lowest bit you're interested in (so if the last digit is 1, 3, 5, 7, 9, b, d or f then it's pure CLR).

(Edit: You can also run ildasm graphically, open the executable file in question, and choose Headers from the View menu to see the same information.)

Answer 5

Run the PEVerify tool against your assembly.

It comes with the .NET framework, e.g. C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\peverify.exe.

Answer 6

As suggested by nobugz, an easier way to see the CLR Flags is using the corflags utility, which is part of the .NET 2.0 SDK.

If no options are specified, the flags for the given image are displayed:

C:\>corflags Foo.dll
Version   : v2.0.50727
CLR Header: 2.5
PE        : PE32
CorFlags  : 9
ILONLY    : 1
32BIT     : 0
Signed    : 1

The "ILONLY" bit indicates whether this is a pure managed assemby, or a mixed assembly.

Note that the comment from user 'nobugz' suggests these flags are not guaranteed to be correct, so this method may not be foolproof.