如何确定DLL是托管程序集还是本机(防止加载本机DLL)?

时间:2008-12-15 08:22:26

标签: c# plugins dll assemblies native

原标题:如何防止从.NET应用程序加载本机dll?

背景

我的C#应用​​程序包括一个插件框架和通用插件加载器。

插件加载器枚举应用程序目录以识别插件dll(实质上它此时搜索* .dll)。

在同一个应用程序目录中是一个本机(Windows,非.NET)dll,间接地,其中一个插件dll依赖于它。

插件加载器盲目地假设native.dll是.NET程序集dll,只是因为它只检查文件扩展名。当它尝试加载本机dll时,会抛出异常:

“无法加载文件或程序集'native.dll'或其依赖项之一。该模块应包含程序集清单。”

如果插件加载失败,我基本上会创建一个诊断报告,所以我试图避免让这个日志填满关于无法加载本机dll的消息(我甚至不想尝试)。 / p>

问题:

是否有一些.NET API调用可用于确定二进制文件是否恰好是.NET程序集,以便我根本不尝试加载本机dll?

也许从长远来看,我会将我的插件移动到一个子目录,但是现在,我只想要一个解决方法,不涉及在我的插件加载器中硬编码“native.dll”名称。

我想我正在寻找某种静态的Assembly.IsManaged()API调用,我忽略了......大概没有这样的API存在?

6 个答案:

答案 0 :(得分:23)

lubos hasko引用的答案很好,但它不适用于64位程序集。这是一个更正版本(灵感来自http://apichange.codeplex.com/SourceControl/changeset/view/76c98b8c7311#ApiChange.Api/src/Introspection/CorFlagsReader.cs

public static bool IsManagedAssembly(string fileName)
{
    using (Stream fileStream = new FileStream(fileName, FileMode.Open, FileAccess.Read))
    using (BinaryReader binaryReader = new BinaryReader(fileStream))
    {
        if (fileStream.Length < 64)
        {
            return false;
        }

        //PE Header starts @ 0x3C (60). Its a 4 byte header.
        fileStream.Position = 0x3C;
        uint peHeaderPointer = binaryReader.ReadUInt32();
        if (peHeaderPointer == 0)
        {
            peHeaderPointer = 0x80;
        }

        // Ensure there is at least enough room for the following structures:
        //     24 byte PE Signature & Header
        //     28 byte Standard Fields         (24 bytes for PE32+)
        //     68 byte NT Fields               (88 bytes for PE32+)
        // >= 128 byte Data Dictionary Table
        if (peHeaderPointer > fileStream.Length - 256)
        {
            return false;
        }

        // Check the PE signature.  Should equal 'PE\0\0'.
        fileStream.Position = peHeaderPointer;
        uint peHeaderSignature = binaryReader.ReadUInt32();
        if (peHeaderSignature != 0x00004550)
        {
            return false;
        }

        // skip over the PEHeader fields
        fileStream.Position += 20;

        const ushort PE32 = 0x10b;
        const ushort PE32Plus = 0x20b;

        // Read PE magic number from Standard Fields to determine format.
        var peFormat = binaryReader.ReadUInt16();
        if (peFormat != PE32 && peFormat != PE32Plus)
        {
            return false;
        }

        // Read the 15th Data Dictionary RVA field which contains the CLI header RVA.
        // When this is non-zero then the file contains CLI data otherwise not.
        ushort dataDictionaryStart = (ushort)(peHeaderPointer + (peFormat == PE32 ? 232 : 248));
        fileStream.Position = dataDictionaryStart;

        uint cliHeaderRva = binaryReader.ReadUInt32();
        if (cliHeaderRva == 0)
        {
            return false;
        }

        return true;
    }
}

缺少的部分是根据我们是PE32还是PE32Plus而以不同的方式偏移到数据字典:

    // Read PE magic number from Standard Fields to determine format.
    var peFormat = binaryReader.ReadUInt16();
    if (peFormat != PE32 && peFormat != PE32Plus)
    {
        return false;
    }

    // Read the 15th Data Dictionary RVA field which contains the CLI header RVA.
    // When this is non-zero then the file contains CLI data otherwise not.
    ushort dataDictionaryStart = (ushort)(peHeaderPointer + (peFormat == PE32 ? 232 : 248));

答案 1 :(得分:17)

How to determine whether a file is a .NET Assembly or not?

public static bool IsManagedAssembly(string fileName)
{
    uint peHeader;
    uint peHeaderSignature;
    ushort machine;
    ushort sections;
    uint timestamp;
    uint pSymbolTable;
    uint noOfSymbol;
    ushort optionalHeaderSize;
    ushort characteristics;
    ushort dataDictionaryStart;
    uint[] dataDictionaryRVA = new uint[16];
    uint[] dataDictionarySize = new uint[16];

    Stream fs = new FileStream(fileName, FileMode.Open, FileAccess.Read);
    BinaryReader reader = new BinaryReader(fs);

    //PE Header starts @ 0x3C (60). Its a 4 byte header.
    fs.Position = 0x3C;
    peHeader = reader.ReadUInt32();

    //Moving to PE Header start location...
    fs.Position = peHeader;
    peHeaderSignature = reader.ReadUInt32();

    //We can also show all these value, but we will be       
    //limiting to the CLI header test.
    machine = reader.ReadUInt16();
    sections = reader.ReadUInt16();
    timestamp = reader.ReadUInt32();
    pSymbolTable = reader.ReadUInt32();
    noOfSymbol = reader.ReadUInt32();
    optionalHeaderSize = reader.ReadUInt16();
    characteristics = reader.ReadUInt16();

    // Now we are at the end of the PE Header and from here, the PE Optional Headers starts... To go directly to the datadictionary, we'll increase the stream’s current position to with 96 (0x60). 96 because, 28 for Standard fields 68 for NT-specific fields From here DataDictionary starts...and its of total 128 bytes. DataDictionay has 16 directories in total, doing simple maths 128/16 = 8. So each directory is of 8 bytes. In this 8 bytes, 4 bytes is of RVA and 4 bytes of Size. btw, the 15th directory consist of CLR header! if its 0, its not a CLR file :)
    dataDictionaryStart = Convert.ToUInt16(Convert.ToUInt16(fs.Position) + 0x60);
    fs.Position = dataDictionaryStart;
    for (int i = 0; i < 15; i++)
    {
        dataDictionaryRVA[i] = reader.ReadUInt32();
        dataDictionarySize[i] = reader.ReadUInt32();
    }
    fs.Close();

    if (dataDictionaryRVA[14] == 0) return false;
    else return true;
}

答案 2 :(得分:5)

我担心这样做的唯一真正方法是调用System.Reflection.AssemblyName.GetAssemblyName将完整路径传递给您要检查的文件。这将尝试从清单中提取名称而不将完整程序集加载到域中。如果该文件是托管程序集,那么它将以字符串形式返回程序集的名称,否则它将抛出BadImageFormatException,您可以在跳过程序集并移动到其他插件之前捕获并忽略它。

答案 3 :(得分:4)

正如orip建议的那样,你需要将它包装在try {} catch {}块中 - 特别是,你想要关注BadImageFormatException

foreach (string aDll in dllCollection) 
{
  try 
  {
     Assembly anAssembly = Assembly.LoadFrom(aDll);
  }
  catch (BadImageFormatException ex)
  {
    //Handle this here
  }
  catch (Exception ex)
  {
    //Other exceptions (i/o, security etc.)
   }
}

查看http://msdn.microsoft.com/en-us/library/1009fa28.aspx

中的其他例外情况

答案 4 :(得分:1)

使用BadImageFormatException异常是一种不好的方法,例如。如果您的应用程序以.NET 3.5为目标,它将无法识别让我们说针对.NET Core编译的程序集,尽管程序集是受管理的。

所以我认为解析PE头要好得多。

答案 5 :(得分:0)

您总是可以使用try / except块包装DLL加载...