When I navigate to C:\Windows\System32
, I can see that it contains Query.exe
However, if I use IL DASM
and go to the same location, Query.exe
is missing along with a handful of other files, even though I have selected Any Types for the file types
At first I thought it might be because query.exe
is not available to be decompiled, but I am able to see other .exe
s in there which are also not available to be decompiled by IL DASM
(e.g. calc.exe
)
Why does IL DASM
behave like this?
Always beware the file system redirector. You are running the 32-bit version of ildasm.exe so it gets redirected to the home for 32-bit executables, c:\windows\syswow64.
A simple workaround is to navigate to c:\windows\sysnative instead. Or to use the 64-bit version of ildasm.exe, say C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.6.1 Tools\x64\ildasm.exe. Or to configure the Visual Studio Command Prompt (aka vcvarsall) if you use that, pass the "x64" argument.
Query.exe is not a .NET assembly so there isn't much to see.