From 99fa1c961d394f50491ad8f4a8f38c34cd2a2bd2 Mon Sep 17 00:00:00 2001
From: himeshsameera <himeshsameera@gmail.com>
Date: Fri, 8 Sep 2023 22:57:50 +0530
Subject: [PATCH] Reliable detection of CLR dlls is added.

---
 ClrPhlib/include/ClrPhlib.h |  3 +++
 ClrPhlib/src/managed/PE.cpp | 10 ++++++++++
 2 files changed, 13 insertions(+)

diff --git a/ClrPhlib/include/ClrPhlib.h b/ClrPhlib/include/ClrPhlib.h
index 8fde4478..79091cf7 100644
--- a/ClrPhlib/include/ClrPhlib.h
+++ b/ClrPhlib/include/ClrPhlib.h
@@ -159,6 +159,9 @@ namespace Dependencies {
 
             // Check if the PE is 32-bit
             bool IsArm32Dll();
+            
+            // Check if the PE is a dot net
+            bool IsClrDll();
 
             // return the processorArchiture of PE
             String^ GetProcessor();
diff --git a/ClrPhlib/src/managed/PE.cpp b/ClrPhlib/src/managed/PE.cpp
index 7a0429f5..46e6cb34 100644
--- a/ClrPhlib/src/managed/PE.cpp
+++ b/ClrPhlib/src/managed/PE.cpp
@@ -201,6 +201,16 @@ bool PE::IsArm32Dll()
   return ((Properties->Machine & 0xffff) == IMAGE_FILE_MACHINE_ARMNT);
 }
 
+bool PE::IsClrDll()
+{
+    PIMAGE_DATA_DIRECTORY dataDirectory;
+    if (NT_SUCCESS(PhGetMappedImageDataEntry( &m_Impl->m_PvMappedImage, IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR, &dataDirectory)))
+    {
+        return dataDirectory->VirtualAddress != 0;
+    }
+    return false;
+}
+
 String^ PE::GetProcessor()
 {
   if ((Properties->Machine & 0xffff) == IMAGE_FILE_MACHINE_I386)