How Windows Loads a .NET Executable

All Windows executable files contain more than just compiled program code. The file start with a header, which provides the operating system with a great deal of information about the executable code. Headers can be viewed with the dumpin.exe tool that comes with Microsoft Visual Studio. (Dumpbin.exe may be found in the C:\Program Files\Microsoft Visual Studio 8\VC\bin directory.) To use this utility, you will first have to run the vcvars32.bat batch file that also comes with the Visual Studio and is found in the same directory. The batch file ensures that various environment settings are set. You can then run dumpbin /headers on the command line.

Towards the end of the output you will see an entry

RVA [size] of COM Descriptor Directory

In a native Windows executable file, this entry will have a value of 0. If the value is not 0, Windows knows that this is a managed file, and begins to load the Common Language Runtime. In Windows XP and later, the OS directly calls a function _CorExeMain, which is located in mscoree.dll. This function identifies the required CLR version, loads it, and executes the managed program file under the default settings.