How can I check how many .Net applications are installed on a Windows system?
See the question and my original answer on StackOverflowYou could write a program that runs through the disk and scan for .EXEs file, trying to determine if ther are .NET or native. Here is a piece of C# code that can determine if a file is a .NET file (DLL or EXE):
public static bool IsDotNetFile(string filePath)
{
if (filePath == null)
throw new ArgumentNullException("filePath");
using (FileStream fs = new FileStream(filePath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
{
using (BinaryReader br = new BinaryReader(fs))
{
if (br.ReadUInt16() != 0x5A4D) // IMAGE_DOS_SIGNATURE
return false;
byte[] bytes = new byte[112]; // max size we'll need
const int dosHeaderSize = (30 - 1) * 2; // see IMAGE_DOS_HEADER
if (br.Read(bytes, 0, dosHeaderSize) < dosHeaderSize)
return false;
fs.Seek(br.ReadUInt32(), SeekOrigin.Begin);
if (br.ReadUInt32() != 0x4550) // IMAGE_NT_SIGNATURE
return false;
// get machine type
ushort machine = br.ReadUInt16(); // see IMAGE_FILE_HEADER
br.Read(bytes, 0, 20 - 2); // skip the rest of IMAGE_FILE_HEADER
// skip IMAGE_OPTIONAL_HEADER
if (machine == 0x8664) //IMAGE_FILE_MACHINE_AMD64
{
br.Read(bytes, 0, 112); // IMAGE_OPTIONAL_HEADER64
}
else
{
br.Read(bytes, 0, 96); // IMAGE_OPTIONAL_HEADER32
}
// skip 14 data directories, and get to the IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR, the 15th one
br.Read(bytes, 0, 14 * 8);
// if the COR descriptor size is 0, it's not .NET
uint va = br.ReadUInt32();
uint size = br.ReadUInt32();
return size > 0;
}
}
}
It's based on PE standard file format analysis, but focuses only on .NET determination. See more on this here: An In-Depth Look into the Win32 Portable Executable File Format