Introduction
Microsoft .NET CLR executables are different from typical Windows executables in that they carry not only code and data, but also metadata. A Windows executable EXE or DLL file must follows the file format called PE file format, which is the darivative of Common Object File Format (COFF). Through these formats the Windows OS knows how to load and execute the EXE and DLLs .
.Net PE File is different from standard PE File . Here are the structures of both types of PE files.
Standard PE File
Layers from bottom
Layer1: Native Image Sections ( .data, .ndata, .rsrc,.text )
Layer2: Optional Header
Layer3: PE/COFF Header
Layer4: MS DOS Header
-----------------------------------------------------------------------
.Net PE file Format
From Bottom
Layer1:Native Image Sections ( .data, .ndata, .rsrc,.text )
Layer2:CLR Data ( MetaData , IL (Code) )
Layer3:CLR Header
Layer4:PE/COFF Header
As you seen in above .Net PE file includes the layers CLR Data and CLR headers to support the CLR Functionality.The CLR uses
metadata to determine how to load classes and uses the IL code to turn into native code for execution.The CLR Header mainly stores the relative virtual addresses (RVA) that holds the informations that are helpful for CLR managed execution.The CLR data portion contains metadata and IL code, both of which determine how the program will be executed.
---> dumpbin.exe is utility which dumps the content of PE File into readable text.
for example write this on command prompt
dumpbin.exe hello.exe /all | more
it will shows the content the PE file in page wise manner.
Here are all the options which you can use with dumpbin.exe utility
Option Descripton
---------------------------------------------------------------
/all Displays all the information from the PE File.
/exports Displays all the exports from the PE file.
/header Displays the header information from the PE File.
/clrheader Display the .NET Framework header information for an image built with /clr .
/imports Displays all imports for the PE file.
--------------------------------------------------------------------------------------------
Summary
PE File is an important file of .Net Framework , so its good to know its structure. This article is just an introduction , search on google to find more about the .Net PE File.
Thanks
Gaurav Sharma
|
No responses found. Be the first to respond and make money from revenue sharing program.
|