プロデル、調査 その22

概要

プロデルが、CLRらしいので、調べて見た。
exeファイルのpeヘッダー読んでみた。

CSCでコンパイルした場合

>pe1
Inspecting PE header for:
C:\Users\ore\csc\a0.exe

[Import Table Names]
mscoree.dll

[Detected Microsoft Visual C++ Runtime]
No runtime detected

32bits executable

mindでコンパイルした場合

>pe1
Inspecting PE header for:
C:\Users\ore\csc\moji1.exe

[Import Table Names]
KERNEL32.dll

[Detected Microsoft Visual C++ Runtime]
No runtime detected

32bits executable

プロデルでコンパイルした場合

>pe1
Inspecting PE header for:
C:\Users\ore\csc\run0.exe

[Import Table Names]
mscoree.dll

[Detected Microsoft Visual C++ Runtime]
No runtime detected

32bits executable

サンプルコード

using System;
using System.Collections.Generic;

namespace peheader
{
	class Program {
		enum VcRuntime { 
			none, 
			msvcrt, 
			msvc_2008, 
			msvc_2010, 
			msvc_2012, 
			msvc_2013, 
			msvc_2015, 
			msvc_2017, 
			universal 
		};
		static string VcRuntimeDescription(VcRuntime runtime) {
			switch(runtime)
			{
			case VcRuntime.none:
				return "";
			case VcRuntime.msvcrt:
				return "Microsoft VC Runtime 5.0 / 6.0";
			case VcRuntime.msvc_2008:
				return "Microsoft VC Runtime 2008";
			case VcRuntime.msvc_2010:
				return "Microsoft VC Runtime 2010";
			case VcRuntime.msvc_2012:
				return "Microsoft VC Runtime 2012";
			case VcRuntime.msvc_2013:
				return "Microsoft VC Runtime 2013";
			case VcRuntime.msvc_2015:
				return "Microsoft VC Runtime 2015";
			case VcRuntime.msvc_2017:
				return "Microsoft VC Runtime 2017";
			case VcRuntime.universal:
				return "Microsoft VC Universal Runtime, as of VS 2015";
			default:
				return runtime.ToString();
			}
		}
		static void Main(string[] args) {
			string filename;
			//filename = @"c:\windows\system32\notepad.exe";
			filename = @"C:\Users\ore\csc\a0.exe";
			//filename = @"C:\Users\ore\csc\run0.exe";
			//filename = @"C:\Users\ore\csc\moji1.exe";
			Console.WriteLine("Inspecting PE header for:");
			Console.WriteLine(filename);
			PeHeaderReader reader = new PeHeaderReader(filename);
			Console.WriteLine();
			Console.WriteLine("[Import Table Names]");
			Dictionary<VcRuntime, bool> found = new Dictionary<VcRuntime, bool>();
			foreach (var name in reader.ImportTableNames)
			{
				var lower = name.ToLowerInvariant();
				VcRuntime runtime = VcRuntime.none;
				Console.Write(name);
				if (lower == "msvcrt.dll") 
					runtime = VcRuntime.msvcrt;
				if (lower == "msvcr90.dll" || lower == "msvcp90.dll") 
					runtime = VcRuntime.msvc_2008;
				else if (lower == "msvcr100.dll" || lower == "msvcp100.dll" || lower == "vcruntime100.dll") 
					runtime = VcRuntime.msvc_2010;
				else if (lower == "msvcr110.dll" || lower == "msvcp110.dll" || lower == "vcruntime110.dll") 
					runtime = VcRuntime.msvc_2012;
				else if (lower == "msvcr120.dll" || lower == "msvcp120.dll" || lower == "vcruntime120.dll") 
					runtime = VcRuntime.msvc_2013;
				else if (lower == "msvcr140.dll" || lower == "msvcp140.dll" || lower == "vcruntime140.dll") 
					runtime = VcRuntime.msvc_2015;
				else if (lower == "msvcr150.dll" || lower == "msvcp150.dll" || lower == "vcruntime150.dll") 
					runtime = VcRuntime.msvc_2017;
				else if (lower.StartsWith("api-ms-win-core-winrt-l")) 
					runtime = VcRuntime.universal;
				if (runtime != VcRuntime.none && !found.ContainsKey(runtime))
				{
					found.Add(runtime, true);
					Console.WriteLine("  [" + VcRuntimeDescription(runtime) + "]");
				}
				else
				{
					Console.WriteLine();
				}
			}
			Console.WriteLine();
			Console.WriteLine("[Detected Microsoft Visual C++ Runtime]");
			if (found.Count == 0)
			{
				Console.WriteLine("No runtime detected");
			}
			else
			{
				foreach(var item in found)
				{
					Console.WriteLine(VcRuntimeDescription(item.Key));
				}
			}
			Console.WriteLine();
			if (reader.Is32BitHeader)
			{
				Console.WriteLine("32bits executable");
			}
			else
			{
				Console.WriteLine("64bits executable");
			}
			Console.ReadKey();
		}
	}
}

以上。