Question

I am developing a C# program that will load files and get information such as loaded file created date, modification date, size etc. Another thing that I need to know is whether the loaded file (executable.exe) is linked with the LARGEADDRESSAWARE flag. The FileInfo class doesn’t provide this information.

Does anyone know how in C# can I find out whether a given executable.exe is linked with the LARGEADDRESSAWARE flag (to handle addresses larger than 2 GB)?

Answer 1

Here is some code that checks for the Large Address Aware flag. All you have to do is pass a stream that is pointed to the start of an executable.

IsLargeAware("some.exe");

static bool IsLargeAware(string file)
{
    using (var fs = File.OpenRead(file))
    {
        return IsLargeAware(fs);
    }
}
/// <summary>
/// Checks if the stream is a MZ header and if it is large address aware
/// </summary>
/// <param name="stream">Stream to check, make sure its at the start of the MZ header</param>
/// <exception cref=""></exception>
/// <returns></returns>
static bool IsLargeAware(Stream stream)
{
    const int IMAGE_FILE_LARGE_ADDRESS_AWARE = 0x20;

    var br = new BinaryReader(stream);

    if (br.ReadInt16() != 0x5A4D)       //No MZ Header
        return false;

    br.BaseStream.Position = 0x3C;
    var peloc = br.ReadInt32();         //Get the PE header location.

    br.BaseStream.Position = peloc;
    if (br.ReadInt32() != 0x4550)       //No PE header
        return false;

    br.BaseStream.Position += 0x12;
    return (br.ReadInt16() & IMAGE_FILE_LARGE_ADDRESS_AWARE) == IMAGE_FILE_LARGE_ADDRESS_AWARE;
}