Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>This isn't well documented in any place I know of, I can only point you to a relevant MSDN article. Yes, your assumption is correct, the loader in Windows XP and up has awareness of managed executables. It automatically loads the .NET loader shim (c:\windows\system32\mscoree.dll), the relevant entrypoint is <a href="http://msdn.microsoft.com/en-us/library/4ce9k7xb%28v=vs.90%29.aspx" rel="noreferrer">_CorValidateImage()</a>. The Remarks section in the linked MSDN article describes the mechanism that turns a 32-bit .exe file into a 64-bit process:</p> <blockquote> <p>In Windows XP and later versions, the operating system loader checks for managed modules by examining the COM Descriptor Directory bit in the common object file format (COFF) header. A set bit indicates a managed module. If the loader detects a managed module, it loads MsCorEE.dll and calls _CorValidateImage, which performs the following actions:</p> <ul> <li>Confirms that the image is a valid managed module.</li> <li>Changes the entry point in the image to an entry point in the common language runtime (CLR).</li> <li>For 64-bit versions of Windows, modifies the image that is in memory by transforming it from PE32 to PE32+ format.</li> <li>Returns to the loader when the managed module images are loaded.</li> </ul> <p>For executable images, the operating system loader then calls the _CorExeMain function, regardless of the entry point specified in the executable. For DLL assembly images, the loader calls the _CorDllMain function.</p> <p>_CorExeMain or _CorDllMain performs the following actions:</p> <ul> <li>Initializes the CLR.</li> <li>Locates the managed entry point from the assembly's CLR header.</li> <li>Begins execution.</li> </ul> <p>The loader calls the _CorImageUnloading function when managed module images are unloaded. However, this function does not perform any action; it just returns.</p> </blockquote>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload