corflags

How does CorFlags.exe /32BIT+ work?

This isn’t well documented in any place I know of, I can only point you to a relevant MSDN article. Yes, your assumption is correct, the loader in Windows XP and up has awareness of managed executables. It automatically loads the .NET loader shim (c:\windows\system32\mscoree.dll), the relevant entrypoint is _CorValidateImage(). The Remarks section in the … Read more

Interpreting the CorFlags flags

Microsoft .NET 4.5 introduced a new option, Any CPU 32-bit Preferred. In the new version of CorFlags.exe, the 32BIT flag no longer exists, instead, two new flags were added, 32BITREQ and 32BITPREF. Somewhere based on the below explanation, we can interpret new CorFlags as follows. CPU Architecture PE 32BITREQ 32BITPREF ———————— —– ——– ——— x86 … Read more