-1

The question is simple: i've generated an executable with ngen, his full path is:

"C:\Windows\assembly\NativeImages_v4.0.30319_32\NassilDotNet\eddb174e4a81e440633abddb977ab57a\NassilDotNet.ni.exe"

When I try to open/execute that executeable, an Error Message Dialog is displayed: This application cannot be runned on your system. Please, contact computer administrator (etc)...

The original executeable shows an Hello World message on Console.

What i'm doing wrong?

CypherPotato
  • 221
  • 7
  • 18
  • 1
    Native images are launched by the CLR when the original executable is launched (it skips the JIT process that the executable would otherwise be subject to) so you're not meant to open them directly. I feel it's a mistake by Microsoft to name the generated images `.exe`. – Dai Jan 20 '18 at 04:29
  • The original executeable content stills stored on the output image, so, how someone can execute that? – CypherPotato Jan 20 '18 at 04:30
  • Please rephrase "The original executeable content stills stored on the output image" - I don't understand you. – Dai Jan 20 '18 at 04:31
  • The output of NGEN is the addition of the X86 assembly in the original executeable to run in assembly code, but this code is stored with the original in the same output file. So could only run the X86 generated code... – CypherPotato Jan 20 '18 at 04:34

1 Answers1

2

There are several differences in ngen assemblies from the normal ones. First, they are always marked IL_LIBRARY, even if they are executable. You can see this if you open the manifest in ildasm:

.corflags 0x00000004    //  IL_LIBRARY

Whereas normal assemblies usually have .corflags 0x00000001 (ILONLY) even if they are only libraries.

Second, (even though they are .exe), the standard PE entry point is missing (and the DOS entry point is missing too). It doesn't really matter much for CIL executables, but there are already two signs to tell the system it shouldn't execute the executable.

I thought a code like this could work:

Assembly ass = Assembly.LoadFile(path);
ass.EntryPoint.Invoke(null, new object[]{new string[]{}});

But I always get BadImageFormatException in LoadFile. Strangely, I don't get this exception if I load a library file this way, but that has no entry point that can be invoked.

I suppose you can disassemble the file with ildasm, change the .corflags field and use ilasm to produce an executable. However, this will strip the native code present in the file and turn it basically to the original executable.

To sum this up, just run the original file. ngen files are part of the framework infrastructure and aren't meant to be deployed or run directly.

IS4
  • 11,945
  • 2
  • 47
  • 86