AOT: Determine runtime version linked to native binary

[dlosch]

Hi,

is there any obvious mechanism to determine for a AOT compiled binary which version of the runtime it was linked against?

(It would be obvious from the build log.)

Thanks

[AustinWise]

Does Environment.Version or RuntimeInformation.FrameworkDescription have the information you are looking for?

[dlosch]

At runtime, true, Environment.Version does show the runtime version.

Is there a way to tell from looking at the binary without executing it? Metadata or resource (doesn't look like)?

[AustinWise]

Do you want a way to identify the AOT version used to create any binary, by anyone? Or just for the binaries you create?

If you want to identify an executable as being generated by NativeAOT, all NativeAOT executables export a symbol named DotNetRuntimeDebugHeader. It points to this struct. Currently this struct does not contain the product version. You could open an issue or PR requesting the product version be added to that structure.

If you have symbols for the executable, you can easily find the RhGetRuntimeVersion function. This is an implementation detail, but it currently has the product version. Here it is decompiled in Ghidra:

You could also change your build process to include version information somewhere. On Windows, the value of the AssemblyInformationalVersionAttribute is shown in the properties dialog in file explorer. For example, if have this:

[assembly: AssemblyInformationalVersion("my version")]

You can see it show up here:

A cross platform approach to encoding version information in your binary is to export a symbol with version information. In C#, define an export:

[UnmanagedCallersOnly(EntryPoint = "my-version-symbol-1-0")]
private static void func() {}

In your .csproj file, add:

<PropertyGroup>
  <IlcExportUnmanagedEntrypoints>true</IlcExportUnmanagedEntrypoints>
</PropertyGroup>

Once you compile, you can see the symbol using tools like dumpbin on Windows objdump on Linux. Here's Windows:

C:\>dumpbin /nologo /exports test.exe

Dump of file test.exe

File Type: EXECUTABLE IMAGE

  Section contains the following exports for test.exe

    00000000 characteristics
    FFFFFFFF time date stamp
        0.00 version
           1 ordinal base
           2 number of functions
           2 number of names

    ordinal hint RVA      name

          1    0 001546E8 DotNetRuntimeDebugHeader = DotNetRuntimeDebugHeader
          2    1 000A5170 my-version-symbol-1-0 = my-version-symbol-1-0

[dlosch]

Thanks for the comprehensive answer! Basically mostly own binaries, would like to be able to identify the runtime version linked even if I don't have the build log. To identify and check binaries for potential security vulns (I know each AOT build builds to IL first and I can catalog the IL build basically. Bit of an inexact science with AOT. And yes, in this case I am talking about the runtime code, not the base class libs).
Truly wondering whether the recommended way of running ASP.NET AOT apps is to rebuild and redeploy each time a runtime patch is released (so basically each patch tuesday. Same would apply to non AOT containerized apps when base images are updated)