How does CorFlags.exe /32BIT+ work?

by

This isn’t well documented in any place I know of, I can only point you to a relevant MSDN article. Yes, your assumption is correct, the loader in Windows XP and up has awareness of managed executables. It automatically loads the .NET loader shim (c:\windows\system32\mscoree.dll), the relevant entrypoint is _CorValidateImage(). The Remarks section in the linked MSDN article describes the mechanism that turns a 32-bit .exe file into a 64-bit process:

In Windows XP and later versions, the operating system loader checks for managed modules by examining the COM Descriptor Directory bit in the common object file format (COFF) header. A set bit indicates a managed module. If the loader detects a managed module, it loads MsCorEE.dll and calls _CorValidateImage, which performs the following actions:

  • Confirms that the image is a valid managed module.
  • Changes the entry point in the image to an entry point in the common language runtime (CLR).
  • For 64-bit versions of Windows, modifies the image that is in memory by transforming it from PE32 to PE32+ format.
  • Returns to the loader when the managed module images are loaded.

For executable images, the operating system loader then calls the
_CorExeMain function, regardless of the entry point specified in the executable. For DLL assembly images, the loader calls the _CorDllMain
function.

_CorExeMain or _CorDllMain performs the following actions:

  • Initializes the CLR.
  • Locates the managed entry point from the assembly’s CLR header.
  • Begins execution.

The loader calls the _CorImageUnloading function when managed module
images are unloaded. However, this function does not perform any
action; it just returns.

More Related Contents:

  1. Casting vs using the ‘as’ keyword in the CLR
  2. Why is stack size in C# exactly 1 MB?
  3. Why Large Object Heap and why do we care?
  4. How to show Page Loading div until the page has finished loading?
  5. Are C# uninitialized variables dangerous?
  6. A definitive guide to API-breaking changes in .NET
  7. Performance surprise with “as” and nullable types
  8. What are the roots?
  9. How to call .NET methods from Excel VBA?
  10. Resolving MSB3247 – Found conflicts between different versions of the same dependent assembly
  11. Try-catch speeding up my code?
  12. What are major differences between C# and Java?
  13. How do the .NET Framework, CLR and Visual Studio version numbers relate to each other?
  14. Interpreting the CorFlags flags
  15. Float vs Double Performance
  16. What’s the method representation in memory?
  17. When is a method eligible to be inlined by the CLR?
  18. How is GetHashCode() implemented for Int32?
  19. How are DLLs loaded by the CLR?
  20. Why does C#/CLR not support method override co/contra-variance?
  21. .NET 4.0 and the dreaded OnUserPreferenceChanged Hang
  22. Why does Random.Next() always return the same number [duplicate]
  23. How to debug System.TypeLoadException errors in .NET?
  24. Is there a way to get the string representation of HRESULT value using win API?
  25. Equivalent of Class Loaders in .NET
  26. Are static indexers not supported in C#? [duplicate]
  27. What is the maximum length of a C#/CLI identifier?
  28. How to see JIT-Compiled code in .NET VM (CLR)
  29. How to call managed code from unmanaged code?
  30. How to use images in css with Webpack

Leave a Comment