.net fwk version from exe

I had a .net binary compiled with me, but lost its source. Anyway due to some reason wanted to findout what .net framework it will need. These are just my notes about finding this information

dumpbin

dumpbin can show clr header with flags /CLRHEADER, interesting bit here is at line 13, runtime version is 2.05 so .net 2 framework will suffice to run it.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
D:\delete>dumpbin d:\tools\traceproc.exe /CLRHEADER
Microsoft (R) COFF/PE Dumper Version 14.20.27508.1
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file d:\tools\traceproc.exe

File Type: EXECUTABLE IMAGE

  clr Header:

              48 cb
            2.05 runtime version
            5790 [    E404] RVA [size] of MetaData Directory
               1 flags
                   IL Only
         6000001 entry point token
               0 [       0] RVA [size] of Resources Directory
               0 [       0] RVA [size] of StrongNameSignature Directory
               0 [       0] RVA [size] of CodeManagerTable Directory
               0 [       0] RVA [size] of VTableFixups Directory
               0 [       0] RVA [size] of ExportAddressTableJumps Directory
               0 [       0] RVA [size] of ManagedNativeHeader Directory

ildasm

Other approach is to use ildasm to check metadata with .net assembly. At line 1 it provide the information on required .net framework

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
// Metadata version: v2.0.50727
.module extern ntdll.dll
.module extern kernel32.dll
.module extern psapi.dll
.module extern dbghelp.dll
.assembly extern mscorlib
{
  .publickeytoken = (B7 7A 5C 56 19 34 E0 89 )                         // .z\V.4..
  .ver 2:0:0:0
}
.assembly extern System
{
  .publickeytoken = (B7 7A 5C 56 19 34 E0 89 )                         // .z\V.4..
  .ver 2:0:0:0
}
.assembly traceproc

ILspy

other approach is using ilspy from icsharpcode, github, it also lists my binary requires .net2 framework to run

Jetbrains dotpeek

Now interestingly, dotpeek, jetbrians says that my binary was compiled with .net framework 3.5 but will run with .net 2 framework. This extra information about .net 3.5 is not available in any other tools.

Anyway, found the information i was looking for. But it is quite interesting that dotpeek could infer more that other tools. Not sure where it found that information- but something to find out i guess..