From faed9872151a35aaa9ab80f376ab25651051bd36 Mon Sep 17 00:00:00 2001 From: C-Sto <7466346+C-Sto@users.noreply.github.com> Date: Sun, 26 Jul 2020 00:27:36 +0800 Subject: [PATCH] add managed check --- pe/file.go | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/pe/file.go b/pe/file.go index 81c90b9..e962b19 100644 --- a/pe/file.go +++ b/pe/file.go @@ -508,3 +508,19 @@ func (f *File) RVAToFileOffset(rva uint32) uint32 { } return offset } + +//IsManaged returns true if the loaded PE file references the CLR header (aka is a .net exe) +func (f *File) IsManaged() bool { + switch v := f.OptionalHeader.(type) { + case *OptionalHeader32: + if v.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].VirtualAddress != 0 { + return true + } + case *OptionalHeader64: + if v.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].VirtualAddress != 0 { + return true + } + } + + return false +}