Reliable detection of CLR dlls is added.

himeshsameera · Sep 8, 2023 · 99fa1c9 · 99fa1c9
1 parent f52229c
commit 99fa1c9
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 0 deletions.
diff --git a/ClrPhlib/include/ClrPhlib.h b/ClrPhlib/include/ClrPhlib.h
@@ -159,6 +159,9 @@ namespace Dependencies {
 
             // Check if the PE is 32-bit
             bool IsArm32Dll();
+
+            // Check if the PE is a dot net
+            bool IsClrDll();
 
             // return the processorArchiture of PE
             String^ GetProcessor();

diff --git a/ClrPhlib/src/managed/PE.cpp b/ClrPhlib/src/managed/PE.cpp
@@ -201,6 +201,16 @@ bool PE::IsArm32Dll()
   return ((Properties->Machine & 0xffff) == IMAGE_FILE_MACHINE_ARMNT);
 }
 
+bool PE::IsClrDll()
+{
+    PIMAGE_DATA_DIRECTORY dataDirectory;
+    if (NT_SUCCESS(PhGetMappedImageDataEntry( &m_Impl->m_PvMappedImage, IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR, &dataDirectory)))
+    {
+        return dataDirectory->VirtualAddress != 0;
+    }
+    return false;
+}
+
 String^ PE::GetProcessor()
 {
   if ((Properties->Machine & 0xffff) == IMAGE_FILE_MACHINE_I386)