Skip to content

Instantly share code, notes, and snippets.

@rmi1974
Last active April 12, 2023 21:24
Show Gist options
  • Save rmi1974/fe0a93d2341c749c0e79c41dd0e24b61 to your computer and use it in GitHub Desktop.
Save rmi1974/fe0a93d2341c749c0e79c41dd0e24b61 to your computer and use it in GitHub Desktop.
How to find .NET Framework version dependencies #wine #debug #dotnet #commandlinefu

How to find .NET Framework version dependencies

The .NET metadata pointed by CLR/CLI header always starts with BSJB signature.

Metadata Header Storage Signature:

0x424a5342 Signature (hex for "BSJB" (only backwards due to endianness))
0x0001 Major Version
0x0001 Minor Version
0x00000000 Extra Data Offset
0x0000000c Version String Length
'v2.0.50727' Version String

Using some shell wizardry we scan through all local assemblies to find the .NET Framework versions required:

$ find . -type f \( -iname "*.dll" -or -iname "*.exe" \) | \
    xargs -i file {} | grep assembly | cut -f1 -d: | \
    xargs -IX sh -c "echo \"X\" && (hexdump -C \"X\" | grep BSJB -B0 -C2)"
...
./Haufe.Common.UI.ProgressBar.dll
00000c70  50 41 44 50 b4 00 00 00  42 53 4a 42 01 00 01 00  |PADP....BSJB....|
00000c80  00 00 00 00 0c 00 00 00  76 34 2e 30 2e 33 30 33  |........v4.0.303|
00000c90  31 39 00 00 00 00 05 00  6c 00 00 00 84 09 00 00  |19......l.......|
./AxInterop.RenesisXLib.dll
00000460  42 53 4a 42 01 00 01 00  00 00 00 00 0c 00 00 00  |BSJB............|
00000470  76 32 2e 30 2e 35 30 37  32 37 00 00 00 00 05 00  |v2.0.50727......|
00000480  6c 00 00 00 88 03 00 00  23 7e 00 00 f4 03 00 00  |l.......#~......|

Using Wine's winedump tool as shown in Wine Bugzilla #47304.

$ winedump -j clr Athena\'s\ MH3U\ Charm\ Table\ Search\ v0.35b.exe 
Contents of Athena's MH3U Charm Table Search v0.35b.exe: 982528 bytes

CLR Header
  Header Size                        0x48           72
  Required runtime version           2.05
  Flags                              0x3
    ILONLY
    32BITREQUIRED
  EntryPointToken                    0x6000ed4      100667092

CLR Data Directory
  MetaData                rva: 0x6b540     size: 0x83f5c   
  Resources               rva: 0x67804     size: 0x3d38    
  StrongNameSignature     rva: 0x0         size: 0x0       
  CodeManagerTable        rva: 0x0         size: 0x0       
  VTableFixups            rva: 0x0         size: 0x0       
  ExportAddressTableJumps rva: 0x0         size: 0x0       
  ManagedNativeHeader     rva: 0x0         size: 0x0       

Done dumping Athena's MH3U Charm Table Search v0.35b.exe

Links

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment