Where exactly is .NET Runtime (CLR), JIT Compiler located?

Question

This question might look a bit foolish or odd but I have heard a lot of about .NET CLR, JIT compiler and how it works blah blah blah... But now I am wondering where exactly it i

Answer 1

How Windows Operating System triggers/executes .NET Executable Runs inside .NET Runtime?

Every .NET managed assembly or executable has special CLR headers, which you can see by viewing the assembly in ILDASM. This headers points to the version of the runtime that needs to be loaded. Also, there is the Image Section with the Import Address Table, pointing to what needs to be loaded:

----- Image sections:
Import Address Table
DLL : mscoree.dll
          0x00002000 Import Address Table
          0x0000a37e Import Name Table
          0          Time Date Stamp
          0          Index of First Forwarder Reference

          0x0000  _CorDllMain

 ----- CLR Header:
 Header size:                        0x00000048
 Major runtime version:              0x0002
 Minor runtime version:              0x0005
 0x00003184 [0x00007078] address [size] of Metadata Directory:        
 Flags:                              0x00000001
 Entry point token:                  0x00000000
 0x00000000 [0x00000000] address [size] of Resources Directory:       
 0x00000000 [0x00000000] address [size] of Strong Name Signature:     
 0x00000000 [0x00000000] address [size] of CodeManager Table:         
 0x00000000 [0x00000000] address [size] of VTableFixups Directory:    
 0x00000000 [0x00000000] address [size] of Export Address Table:      
 0x00000000 [0x00000000] address [size] of Precompile Header:   

When ran by the operating system, mscoree.dll (or The Shim) is loaded, and it is the bootstrapper to clr.dll and clrjit.dll for .NET 4.0 and above, or mscordacwks.dll and mscorjit.dll for .NET 2.0 or below, which are the runtime and the JIT, respectively. You can see that the native dll entry point is instructed to be the _CorDllMain method for a class library, and _CorExeMain for an executable, which is responsible for the loading and jitting of the entry point. They, in turn, will call your applications entry point, in the managed environment.