The .NET metadata pointed by CLR/CLI header always starts with BSJB signature.
Metadata Header Storage Signature:
0x424a5342 Signature (hex for "BSJB" (only backwards due to endianness))
0x0001 Major Version
0x0001 Minor Version
0x00000000 Extra Data Offset
0x0000000c Version String Length
'v2.0.50727' Version String
Using some shell wizardry we scan through all local assemblies to find the .NET Framework versions required:
$ find . -type f \( -iname "*.dll" -or -iname "*.exe" \) | \
xargs -i file {} | grep assembly | cut -f1 -d: | \
xargs -IX sh -c "echo \"X\" && (hexdump -C \"X\" | grep BSJB -B0 -C2)"
...
./Haufe.Common.UI.ProgressBar.dll
00000c70 50 41 44 50 b4 00 00 00 42 53 4a 42 01 00 01 00 |PADP....BSJB....|
00000c80 00 00 00 00 0c 00 00 00 76 34 2e 30 2e 33 30 33 |........v4.0.303|
00000c90 31 39 00 00 00 00 05 00 6c 00 00 00 84 09 00 00 |19......l.......|
./AxInterop.RenesisXLib.dll
00000460 42 53 4a 42 01 00 01 00 00 00 00 00 0c 00 00 00 |BSJB............|
00000470 76 32 2e 30 2e 35 30 37 32 37 00 00 00 00 05 00 |v2.0.50727......|
00000480 6c 00 00 00 88 03 00 00 23 7e 00 00 f4 03 00 00 |l.......#~......|
Using Wine's winedump
tool as shown in Wine Bugzilla #47304.
$ winedump -j clr Athena\'s\ MH3U\ Charm\ Table\ Search\ v0.35b.exe
Contents of Athena's MH3U Charm Table Search v0.35b.exe: 982528 bytes
CLR Header
Header Size 0x48 72
Required runtime version 2.05
Flags 0x3
ILONLY
32BITREQUIRED
EntryPointToken 0x6000ed4 100667092
CLR Data Directory
MetaData rva: 0x6b540 size: 0x83f5c
Resources rva: 0x67804 size: 0x3d38
StrongNameSignature rva: 0x0 size: 0x0
CodeManagerTable rva: 0x0 size: 0x0
VTableFixups rva: 0x0 size: 0x0
ExportAddressTableJumps rva: 0x0 size: 0x0
ManagedNativeHeader rva: 0x0 size: 0x0
Done dumping Athena's MH3U Charm Table Search v0.35b.exe
Links